Brazil cyber insurance premiums rise amid challenging pricing risk
Brazil Property/Casualty (P/C) insurers that underwrite cyber coverage are seeing a rapid increase in direct written premium (DWP), with the growth of 2020 gaining momentum in 2021.
Demand for cyber insurance coverage by companies in Latin America is increasing as the frequency and severity of ransomware and other cyber-attacks rises. However, pricing for the segment is expected to remain challenging given limited and potentially inaccurate historical underwriting data, which could pressure segment returns, Fitch Ratings says.
Cyber insurance is growing at various rates throughout Latin America. Brazil’s insurance market the largest and most developed in the region, with product offerings from local companies and subsidiaries of large, international carriers. Cybersecurity gained substantial attention during 2020, as the pandemic resulted in a swift transition to a virtual work environment that strained companies’ network security efforts and information, creating more opportunity for cyber criminals.
Cyber insurance DWP in Brazil rose 99% for YE2020 to BRL41.3million (USD7.9 million) from BRL 20.7million, and rose a further 145% to BRL33.5million (USD6.36 million) as of May, 2021 compared to May 2020, according to SUSEP cyber insurance data.
Fitch believes an unforeseen major cyber event, such as a massive cloud intrusion or infrastructure attack, would result in substantial individual claims losses incurred that could pressure on insurers’ earnings. Should underwriters report substantially higher segment claims losses, Fitch would anticipate premium rate increases, tighter coverage terms and robust technological requirements to support the segment’s underwriting performance.
The cyber insurance segment’s limited historical claims and underwriting data also create significant challenges, especially for new underwriters entering the segment. The segment’s loss ratio has been highly volatile since January 2019, when SUSEP began to disclose cyber insurance data. However, a higher number of cyber incidents, particularly ransomware attacks, could easily affect this short-term loss ratio.
Cyber insurance is a modest but growing part of the overall underwriting exposure for Brazil’s P/C insurance sector, representing less than 1% of P/C’s DWPs.
Cyber insurance typically covers payments for ransomware and forensics associated with cyber events. AIG does not include extortion payments in standard coverage from policies, but does not exclude them as optional extensions to coverage. Zurich also includes “internet extortion” coverage as an optional extension and Allianz includes this coverage in its general conditions, subject to a maximum indemnity limit.
Axa S.A, a leading writer of cyber insurance in France and Brazil, announced it would no longer cover ransomware payments for cyber-insurance policies in France. This may lead other market participants and jurisdictions to follow suit.
Demand is driven by the need for risk management expertise and insurance protection for firms of all sizes due to the substantial increase in network intrusions, data theft and ransomware incidents in the last two years.
Fifty-seven percent of Brazilian companies are targets for fraud and digital attacks with medium or high frequency, according to a study by the Datafolha Research institute, which also found that only 32% of surveyed companies had in-house cyber security teams, indicating a potential lack of in-depth cybersecurity policies and training for employees.
Without the ability to assess and mitigate cyber attacks, affected companies would face increased financial risk from ransomware or other cyber attacks, which would expose insurance companies to the upper limits of coverage. Other credit considerations would include reputational, operational and regulatory risks.
