'Cyber Protect' insurance

Talk about perfect timing. "It was pure coincidence," Hartmut Mai said about his company's good fortune. Shortly after whistleblower Edward Snowden leaked top secret US intelligence information to the press, Allianz Global Corporate & Specialty (AGCS) released an insurance package that covers cyber attacks. In his leaks, Snowden alleged that the US had been hacking Chinese cellular companies.

For AGCS board member Mai, the public discussion came at just the right time. "We couldn't have planned for it, but it was a good opportunity for us," Mai told to DW.

The Allianz group's package for companies consists of a multi-tier insurance that covers various risks according to need. What happens when a cyber attack leads to a production standstill for days on end? And what happens, when the company's reputation suffers as a result? The insurance promises to take care of such cases and other problems.

A market with lots of potential

The idea isn't entirely new. For companies in the US, it's common to purchase cyber insurance. They pay roughly one billion euros ($1.3 billion) a year for it. But in Europe and Germany, the market is "highly underdeveloped," according to Martin Eling from the Institute for Insurance Economics in St. Gallen, Switzerland. But Eling estimates that there's a billion-euro demand in Europe, since "there are many high-profile examples of cyber risks."

Edward Snowden's revelations aren't the only sign that many computer systems have patchy security. Sony, for example, struggled with a large security leak concerning their Playstation 3 videogame console, which is connected to the Internet. In 2011, hackers got into the online portal and gained access to a huge amount of personal data, including credit card information. The case caused a large stir and significantly damaged Sony's reputation.

It's hard to put a number on such damage, and yet harder to cover it, Hartmut Mai said. Allianz's "Cyber Protect" insurance has a coverage limit of 50 million euros, which can quickly be surpassed. That's why his company doesn't cover reputation damage directly. But the coverage does include PR-specialists assigned to conduct damage control in the media - "communication counter-measures," as Mai calls it.

Wide range of possible damage

IT failure isn't always as spectacular as the Sony case. The new Allianz insurance also covers human error, "when a poorly trained employee causes a system error, for example," Mai told DW. When a company's production is halted for days or weeks as a result, the loss is covered by the insurance.

Another example: A business has saved important data on the Cloud, i.e., on the computers of an outside provider. When this Cloud-provider cannot offer access to the data anymore, possibly because of a hacker attack, the Allianz Group helps to hold the provider accountable.

The insurance also covers cases of accidental breach of copyright or patent law abroad. "The Internet is a global space, and thus you're acting in a global accountability realm as well," Mai explained. Allianz's "Cyber Protect" also covers the high cost that can result from internal reviews, which authorities might request after a data leak.

For big players only

How much companies have to pay for these insurances varies widely. "The insurance premium depends on the field, the size of the business and on how well the systems are protected," insurance expert Martin Eling said.

Despite the experience gathered from the US and some predecessors to Allianz's "Cyber Protect" and others, the field is relatively new. "There's hardly any information on market experience, unfortunately," Eling said. At this point, there are few products and hardly any standards.

The AGCS only targets an exclusive circle of companies. They must have a turnover of at least 500 million euros to even be considered as clients. The Allianz Group plans to offer its insurance in other European countries soon, and expand to Australia, New Zealand and Asia later.

Individuals cannot purchase the "Cyber Protect" service. Such personal insurances are rare, Eling said, but sometimes similar offers are included in household inventory insurances. The expert explained that in such cases, the costs of restoring data on a computer after virus attacks could be covered.