The Case for Banning (and Mandating) Ransomware Insurance

Ransomware attacks are becoming increasingly pervasive and disruptive. Not only they shutting down (or at least “holding up”) businesses local governments all around the country, disrupting institutions in many sectors of U.S. economy — from school systems, to medical facilities, critical elements energy infrastructure as well food supply chain. also growing more frequent ransom demands exorbitant. Those payments being covered by insurance. That insurance offers coverage for a variety cyber-related losses, including costs arising out ransomware attacks, such hiring expert negotiators, recovering data backups, legal liabilities exposing sensitive customer information, themselves. Some commentators have expressed concern with this market phenomenon. Specifically, is that presence making problem worse, on following theory: Because there covers payments, because paying often far cheaper than restoration business interruption under policy, an increased tendency pay willingness higher amounts. This fact, known criminals, increases their incentive engage first place. And demand increases; cycle continues. This Article demonstrates picture not simple thi story would suggest. Insurance pre-breach post-breach services aimed reducing likelihood severity attack. Thus, over long-term, cyber has potential lower ransomware-related costs. But we yet. discusses ways help ensure force good. Among our suggestions limited ban indemnity exceptions cases involving threats life limb, coupled mandate property/casualty insurers provide other attacks. We explain how government regulator could serve coordinating function internalize externalities associated insurers’ decisions reimburse role played reinsurers context Kidnap-and-ransom