Casualty Quarterly, Fall 2023

Cyber Risk Webinar Highlights Growing Risks to Commercial, Consumer Networks

Key Highlights:

• U.S. ransomware incidents hit an all-time high in 2023.
• Cryptocurrency accounts held on decentralized platforms and protocols are increasingly vulnerable to hacking.
• More people working from home means more complications when it comes to who is responsible for keeping commercial systems safe.
• Increased use of artificial intelligence (AI) will cause additional cyber risks in the years to come.
• There is a growing number of services available to safeguard networks.

Financial losses due to cybercrime are increasingly a problem. Digital assets like cryptocurrency held on decentralized platforms and protocols, known as DeFi, are often the target of theft because they are unregulated and don’t have the same verification, anti-money laundering, and know-your-customer requirements as those in centralized digital asset exchanges.

“Over time, there has been an increased number of hacks into DeFi protocols. The threat actors get a foothold into these exchanges and extract from them,” Tashima said. “As a consumer, it is something to be aware of.”

There has been an uptick in the number of losses of $100 million or more this year, including by Mixin Network, Euler Finance, Multichain, BonqDAO, and Atomic Wallet, he said.

Additionally, ransomware incidents have hit an all-time high in 2023 even before the year is over. Through the first three quarters of the year, the frequency has already exceeded the number of incidents in 2021, which previously held the record. Ransomware revenue reached $450 million through June, closing in on the nearly $500 million collected last year.

“The revenue continues to increase. It has a significant impact when it comes to cyber insurance,” Tashima said, adding that actuaries need to be cognizant about underwriting/pricing with regard to crime and money policies.

Consumers are facing additional risks as well, as they go online increasingly with multiple devices, potentially falling victim to phishing schemes, social engineering, network hacking, malware, spyware, and ransomware. Such incidents can result in data breaches, online fraud, theft, and cyber extortion.

“The losses to an individual will be much smaller, but a couple of thousand dollars would have a much bigger impact to an individual,” Jaegers said.

Additionally, at a time when people are increasingly working from home, there is also a hazier line between what is personal and what is commercial cyber risk. If a worker’s home wireless network is hacked, for example, and an attacker is able to access one’s work computer as well as personally identifiable information, who is liable?

To reduce risks at home to both personal and professional systems, it is essential to keep software and hardware up to date, avoid opening suspicious emails, and use antivirus and antimalware software. Also, using a virtual private network (VPN) to privatize connections, changing passwords often, and enabling two-factor authentication is strongly recommended.

Mitigation efforts can also help stem problems before they get bigger. Passive methods like monitoring one’s credit score or more active methods like monitoring services that scan the dark web to see whether information has been leaked (but don’t reimburse you for the costs associated with the leak) are a possible solution.

The availability of cyber insurance for consumers is growing to cover damages such as financial loss, unrecoverable funds, breach of personal information, and identity restoration.

Jaegers said that the need for such services is only going to increase in the years ahead. “There will be more cyberattacks as [the use of] AI increases and makes emails or communications more believable,” he stated.

Koch detailed the committee’s work on creating a cyber vendor model comparison that was motivated by the influx of models and services in the market designed to address various aspects of cyber risk quantification. The committee conducted direct discussions with the vendors, some with interviews and others with publicly available information.

Her suggestion from working on the project? “If you are using a vendor, asking a lot of questions might be a good thing,” she said.

Slides and an on-demand recording are available as a complimentary member benefit to logged-in Academy members.

‘Envision Tomorrow’ P/C Session Highlights

Property/casualty breakout sessions at the Academy’s Envision Tomorrow: 2023 Annual Meeting coming next month will explore:

• Medical marijuana and workers’ compensation, which will feature two actuaries who co-wrote an issue brief on the topic released earlier this year, along with an attorney and a claims specialist.
• Attribution and climate data, in which presenters will discuss the background of attribution science and the increasing relevance it has in the world of climate change, and the future collaboration with actuarial work as both fields continue to evolve.
• The National Flood Insurance Program (NFIP), which continues to be a significant public policy issue at the federal level. Panelists will explore the current state of the NFIP and ideas for improvements in fighting flood risk and its impact on property owners and the economy.

Award Recipients

KentAlso at Envision Tomorrow, Susan Kent will receive an Outstanding Volunteerism Award. Kent has led efforts to address bias issues in P/C insurance. She has been especially engaged, offering valuable actuarial perspective as the Academy has engaged with state regulators and other policymakers in Colorado related to the recent insurance anti-discrimination law.

P/C practice-area recipients of the Academy’s Rising Actuary Award, now in its second year, will be Peter Ott (Swiss Re), Monica Shokrai (Google Inc.), and Sam Tashima (Aon).

MulderPhilip Mulder will receive the Academy’s inaugural Award for Research for his paper, Mismeasuring Risk: The Welfare Effects of Climate Risk Information, and will present his research at an Envision Tomorrow casualty breakout session. Andrew Ireland, a Ph.D. candidate at Monash University in Australia, received honorable mention for his research on “Heat and Worker Health.” Read the Academy news release.

Envision Tomorrow, being held Nov. 13–14 at the historic Omni Shoreham Hotel in Washington, D.C., will feature keynote speakers including Pulitzer Prize winners George Will and Mona Chalabi; sessions on AI and technology, ethics, and hidden biases; and will offer multiple opportunities for CE credit.

Registration options include an All-Access Pass for those at the in-person two-day event, a Daily Pass for those attending for just one day, and a Digital Pass, which will allow access to all general sessions and a curated selection of breakout sessions. For details, visit the registration page.

Academy Presents at CLRS

Casualty volunteers at the medical marijuana session

Academy volunteers presented at the Casualty Loss Reserve Seminar, sponsored jointly by the Academy and the Casualty Actuarial Society, which was held in mid-September in Orlando, Fla.

Senior Casualty Fellow Rich Gibson moderated several panels, and volunteers presented on the Cyber Risk Toolkit, the medical marijuana and workers’ compensation issue brief released earlier this year, reserving “war stories,” a sampler of sessions at last December’s P/C Opinion Seminar, and an introduction to P/C risk-based capital.

The annual CLRS had about 350 in-person attendees and 300 virtual attendees—a big increase from last year.

Academy Engages on Cyber on International Stage

Jackson presents at the Paris conferenceAcademy Director of Research Steve Jackson presented Sept. 14 on the Academy’s activities in the cyber risk space at the International Workshop on Cyber Risk and Security in Paris, France, sponsored by the Center of Research in Econo-finance and Actuarial Sciences on Risk (CREAR).

He highlighted multiyear research the Academy is conducting with international experts, underscoring the global impact that cyber risk is having on the profession and in the broader risk community.

Public Policy Outreach—Jackson also delivered a virtual presentation on the Actuaries Climate Index (ACI) to the Liberty Mutual Actuarial Forum on Sept. 25. He discussed the current construction of the ACI, which the Academy jointly sponsors with other actuarial organizations, and the ways in which new data sources could help improve the index going forward.

Webinar Highlights Key P/C Issues

The Casualty Practice Council’s (CPC) Aug. 31 webinar “P/C Public Policy Update—Summer 2023” offered CPC updates and recaps from the NAIC Summer National Meeting, a P/C Risk-Based Capital Committee report to the NAIC, an update on the P/C Committee on Equity and Fairness’ engagement with Colorado and District of Columbia regulators on bias and discrimination in automobile insurance. Casualty Vice President Amy Angell moderated. Slides and an on-demand recording are available as a complimentary member benefit.

COPLFR Meets With NAIC

Committee on Property and Liability Financial Reporting (COPLFR) Vice Chairperson Michelle Iarkowski led discussions on two topics during a Sept. 5 virtual meeting of the NAIC’s Casualty Actuarial and Statistical (C) Task Force on COPLFR’s proposal regarding increasing the number of years of data in Schedule P triangles.

Webinar Explores Climate Risk Impacts

An Aug. 9 webinar, “How Climate Risk Applies to All Actuaries,” featured Climate Change Joint Committee members who discussed the recently released Climate Risks Pose Broad Impacts on Financial Security Systems issue paper, and more. View an on-demand recording and read an in-depth recap, free as a member benefit.