The cyber war in Ukraine has heightened fears of major hacking attacks on Germany and German businesses. Although more and more companies have taken protective measures against security breaches in recent years, the likelihood of loss events has nevertheless increased, experts warn.
Hours before Russia attacked Ukraine with missiles and tanks on February 24, the war had already begun on another front. Hackers had crippled the websites of several Ukrainian ministries, including the Ministry of Defence. However, the cyber terrorists’ targets went beyond Ukrainian systems. There was also an attack on ViaSat’s KA-SAT satellite system, with collateral damage occurring across Europe. In Germany, wind turbines and emergency communications for fire departments failed, and customers of a French telecommunications company temporarily had no Internet access. And the digital war continues: Since the end of February, there have been so many attacks that the Ukrainian defence minister has publicly appealed to hackers to build an IT army.
Cyberattacks can cause devastating damage – economically as well as physically. In 2021, they destroyed a record 223 million euros worth of assets in Germany. Nevertheless, a Forsa study conducted in April 2020 on behalf of the German Insurance Association (GDV) shows that for a long time, medium-sized businesses in particular did nothing to counter the dangers of cyberattacks. Until two years ago, only eight percent of small and medium-sized businesses were insured against cyberattacks. About half of the 300 respondents also said they had no contingency plan. At the same time, the survey revealed one in four medium-sized companies had already been the victim of a cyberattack. “Many companies react to a cyberattack in a haphazard and mindless manner. In the event of an emergency, this costs a lot of money because it takes longer to clean up the IT systems and restore the data,” says GDV cyber expert Peter Graß.
Yet awareness of the risk has been around for some time. As early as 2019, 43 percent of small and medium-sized companies said in a Gothaer survey they were afraid of hacker attacks. A new Hiscox survey shows that the effects on businesses go well beyond the direct financial consequences. A lot has happened in the last few years: during the corona crisis, mobile working and home offices became commonplace, and functioning digital communication has become absolutely indispensable in business life. The war in Ukraine is now fuelling fears of hacker attacks: According to a survey by the inter-branch organisation Bitkom, the German Association for Information Technology, Telecommunications and New Media, 76 percent of people in the country fear an escalation in the digital sphere.
Cyber security is no longer considered a marketing gimmick pushed by insurers. “In the last two years in particular, insurers are noticing an increase in the demand for cyber insurance cover, and companies are now actively asking their insurers for it,” confirms Torsten Töllner. He is the managing director of cyber security services provider CyCo, a subsidiary of Deutsche Assistance Versicherung, and is keeping a close eye on developments. “The demand for cyber security consulting services is high. Many companies are now insured against damage caused by cyberattacks.” These insurances include damage caused by viruses, Trojans, data loss or website downtime, but also ransomware, which criminals use to encrypt company data and then threaten to delete it.
Currently, 47% of cyber insurers and as many as 78% of intermediaries in Germany rate the business situation for cyber insurance as (rather) strong.
In 2019, the majority of cyber insurance providers (68%) had still assessed the market situation as weak.
Source: Instinctif Deutschland
Dr Oliver Lamberty, department head of facultative liability, accident and motor business and line management at Deutsche Rück, observes a change in the market. With the increasing number of cyberattacks, premiums also need to be calculated differently. “Claims and the demand for cyber insurance are increasing, leading to rising premiums and, in some cases, narrower scope of cover,” Lamberty says.
Were you able to determine from where or from which region these actions were taken?
Although it is often difficult to track where a cyberattack is coming from, attacks from Russia and Eastern Europe increased compared to 2019. Attacks from Eastern Europe occurred nine percent more frequently and attacks from Russia four percent more frequently. However, that was before the Russian attack on Ukraine.
Source: Bitkom Research 2021
In the medium term, there’s the risk of cover gaps causing misery for business customers. According to press reports, the first insurers refuse to settle claims resulting from attacks by Russian or Ukrainian hackers, their argument being such attacks were acts of war and thus contractually excluded from protection. Experts, however, consider it unlikely that such a war exclusion will take effect. Insurers would have to prove that it was a government attack, and that is likely to be difficult. To prevent this from happening in the first place, companies should focus on upgrading their security systems now. IT security expert Töllner and Deutsche Rück expert Lamberty have so far been unable to identify any evidence that Russia is systematically expanding its combat operations into “German cyberspace”. “But you can’t rule that out for the future,” Lamberty says. “No company is too small and no private individual too unimportant to be of no interest to an attacker.” Hackers are constantly scanning the web for vulnerabilities – and they are doing so through fully automated means.” Therefore, he warns, no one should speculate that cyber criminals will simply “overlook” his or her company.
The flood disaster in the Ahr Valley left Germany in a state of shock last summer. People were aghast that a natural disaster on this scale – which caused over 180 fatalities – could happen in modern Germany. Even the experts were surprised by the extent of the devastation in a relatively small area.
It’s not that Germany had never experienced severe flood events before – for example, the August floods of 2002 in the Ore Mountains in Saxony or in 2016 in Braunsbach, Baden-Württemberg. In those events many houses were destroyed and entire villages were devastated. But in the case of storm BERND in 2021, the sheer number of victims and the extent of the damage to the entire infrastructure reached another dimension. Insured losses soared to record levels and rebuilding the region has proved to be a massive undertaking.
The question for politicians – and also for the insurance industry – is how to deal with such catastrophe risks in the future, especially in view of climate change. The effects of global warming are now being felt with increasingly extreme weather events in Germany and all over the world. For example, higher average temperatures mean higher humidity, which increases the risk of very intense rainfall – and that’s what caused last year’s flood.
Like the Hamburg storm surge of 1962, BERND could lead to a wholesale rethinking of policy. At that time, following the shock, flood protection on the German North Sea coast was massively expanded and disaster control was reorganised with substantial financial support. Today, the challenge is twofold: on the one hand, it’s about how to rebuild the villages in the Ahr Valley in such a way that mitigates the effects of such disasters in the future. On the other, the overarching issue is how to ensure that, in addition to climate protection efforts, Germany is fundamentally more resilient to the extreme weather events that are becoming more common.
It would be dangerous if, after the initial shock of the 2021 flood has passed, politicians were to fall back into old behaviours – i.e. absorbing material losses with compensation for the victims – without actually changing the way they deal with the risk. The state should play an active role in improving flood protection and implementing corresponding rules, for example on building in risk areas. In addition, policy-makers need to solve the fundamental problem of “rebuilding destroyed homes in at-risk areas.” This also raises the question of the extent to which the insurability of these houses can still be guaranteed if they are rebuilt on site in the Ahr Valley.
Photo left
Like the Eifel town of Dernau in the district of Ahrweiler (Rhineland-Palatinate), villages were almost completely flooded.
Photo right
The image that went around the world: The water inflow in a gravel pit near Erftstadt-Blessem (southwest of Cologne, North Rhine-Westphalia) swallowed entire houses into a huge earth crater.
Photo left
Like the Eifel town of Dernau in the district of Ahrweiler (Rhineland-Palatinate), villages were almost completely flooded.
Photo right
The image that went around the world: The water inflow in a gravel pit near Erftstadt-Blessem (southwest of Cologne, North Rhine-Westphalia) swallowed entire houses into a huge earth crater.
Unlike the aftermath of the 1962 storm surge, the insurance industry has an important role to play as a private carrier of natural hazard risks. And it therefore needs to reflect on whether its previous assessment of the risk situation is still appropriate in light of the BERND experience and what role it should play in the future in assuming risk and improving prevention.
The way in which politicians deal with natural hazards also determines to a large extent the way in which the insurance industry deals with this challenge. In the future, for example, it will only be possible to insure the private sector against flood risks in endangered areas if politicians take the appropriate measures. “Business as usual” is no longer a safe line for insurers to take in the wake of the BERND shock.
To a greater extent, the standard practice of assuming risk and passing it on to reinsurers has worked. Despite the record claims payments, no insurer has run into difficulties, and the insurance industry has impressively demonstrated its role and responsibility to the public by providing benefits to flood victims.
What’s clear is that a catastrophic flash flood like we saw in the Ahr Valley could repeat itself in several other parts of Germany – for example where there are narrow river valleys. Therefore the time has come to look at whether flood risks should be reassessed. In addition, insurers should leverage their risk expertise and increase public awareness of the dangers of natural disasters, demonstrating the consequences of inaction with hard facts. This would empower insurers in the debate on how to achieve greater sustainability in business and society.
Insurers must make it clear that they can, in principle, continue to insure these kinds of elementary risks if the framework conditions set by policy-makers to strengthen resilience are right. Over and above the well-trodden debate about mandatory insurance, this remains the central criterion for dealing with natural hazards. A smart policy of effective preventive measures not only saves lives and prevents billions of euros in damages, but it also allows these risks to be borne collectively through insurance, as they have been in the past.
Thanks to today’s technological advances, the valuation of residential building portfolios is easier, more precise and runs more efficiently. 3D building data combined with satellite imagery help primary insurers offer custom-fit policies. The new climate protection requirements are also taken into account.
Kronshagen in Schleswig-Holstein, Germany: the community on the western outskirts of Kiel has a population of around 12,000. Hans-Hermann Lahrs has been living here with his wife Gertrud for half-a-lifetime and they own their single-family house outright. In their regional newspaper, they both read about the possible underinsurance of many German buildings, and they briefly began to wonder. Because over the years they have made a number of changes to their home, and the value of their property has increased as a result. However, they didn’t notify the building insurer at the time or subsequently made any adjustments to their insurance contract. The danger is, if the sum insured and the actual value of the insured property do not match, an underinsurance situation arises; in the event of a claim, this would have financial consequences.
The Lahrs are not alone. “Many policyholders fail to notify their insurer of additions or renovations that increase the value of the property. As a result, there will be no reassessment of the sum insured or necessary adjustments to the coverage,” says Daniel Hernandez, underwriter of facultative property reinsurance at Deutsche Rück. “The result is that the primary insurer may not receive risk-adequate premiums for entire building portfolios – so there’s a premium and pricing risk for them – and ultimately untapped potential for value creation,” Hernandez says. “That’s why insurers should proactively handle homeowners` insurance that hasn’t been adjusted in a while in an inventory management process.”
In the wake of the digital transformation, new technologies now offer insurers the opportunity to precisely identify this pricing risk and take the next step towards closing coverage gaps for their customers. For an entire portfolio built over decades, a value analysis can be performed via cost-efficient mass processing. The market leader in the field of digital building valuation is SkenData GmbH. The Rostock-based company determines and aggregates the associated satellite data – i.e. official aerial photographs – current data from building authorities, e.g. land registry offices, and open source geodata, e.g. from OpenStreetMap, for the insurer’s address data.
This data, which is available for over 51 million buildings in Germany and 3.8 million buildings in Austria, is used to create a digital twin as a realistic image of the building landscape and to determine the building values automatically. To do this, an artificial intelligence-based process checks the state and structure of a building, such as whether the photovoltaic system is really on the roof or not. “Then, the four standardised valuation methods available on the market are used,” says SkenData CEO Sven Jantzen. Each method calculates a different value due to the different weighting of the underlying criteria. The sum of the four values generates the final value. At the end, the program determines an insured value and a regionalised insured value as of the valuation date.
The quantum leap in technology allows insurers to avoid having to inspect properties on site, which is time-consuming and costly. This is done by the building valuation tool. “An insurance advisor has about 20 minutes to talk to a customer. He doesn’t want to spend that time filling out a seven-page valuation sheet. That leads to mistakes and time pressure,” Jantzen says.
“So the technologies add a lot of value, in more ways than one,” says Daniel Hernandez, “because not only can insurers have entire residential building portfolios evaluated and their exposure accurately assessed in a very short time, but on top of that, SkenData also has a direct interface to ZÜRS Geo, the German Insurance Association`s (GDV) zoning system for flooding, backwater and heavy rain.” This means that the ZÜRS hazard class can also be automatically determined for the addresses. A separate determination of the hazard class via ZÜRS Geo is thus no longer necessary. This is a synergy effect that should not be underestimated, because according to the GDV, more than half of the buildings throughout Germany are not insured against natural hazards such as floods and heavy rain. “So it’s a perfect starting point for insurers to use promotional campaigns for existing customers, for example, to adjust sums insured and also coverage,” Hernandez says.
Looking ahead, use of the pioneering technology has also been fuelled by the pressure to meet German and European climate protection targets. “The building data we already have can be used to determine ESG risks in addition to value,” Jantzen says. His company already determines three important characteristics: CO2 emissions, primary energy demand and energy efficiency class. “So the fact that the new technology can more quickly determine carbon footprints based on existing data offers additional potential for insurers, because they will ultimately pay more attention to ESG aspects when underwriting risks in the future,” says Hernandez.
Buildings account for 30 percent of total CO2 emissions in Europe. Experts like Hernandez and Jantzen are well aware that the pressure on the insurance sector – which actively supports the goals of the Paris Climate Agreement – is quite high. In order to achieve these goals, German insurers have set their own targets accordingly as part of GDV’s sustainability positioning.
The coronavirus pandemic hit the global insurance industry hard, and the ever-mutating virus continues to make long-term assessments difficult. Deutsche Rück conducted its own study on the subject and assessed the risks for life insurers. Its author Florian Stanlein explains the results.
New virus variants, lockdowns in different countries and interrupted supply chains – the corona pandemic keeps the world on tenterhooks. And insurers face particular challenges. According to a study by insurance broker Howden, the global pandemic is already the third-largest insurance loss of all time at about 39 billion euros – and it is far from over. Only Hurricane KATRINA in 2005 and the attacks on the World Trade Center in 2001 have been more costly for insurers worldwide. So much for looking in the rear-view mirror. But how can insurers realistically calculate future risk from a pandemic?
Some initial answers can be found in a study conducted by Deutsche Rück, which provides a risk assessment for life insurers. Pandemic models do exist, but in reality, with the parameters continually shifting, initial assumptions no longer apply. “For insurers, it is particularly important to correctly assess the new risk potential,” says Florian Stanlein, actuary in the life/health division at Deutsche Rück and author of the study. One of the main problems he found was that public data was often shaky. “In the public figures, testing for the novel corona virus in particular was never subject to the same conditions,” he says.
Stanlein and his colleagues therefore decided not to settle for the official case numbers. Deutsche Rück’s actuaries developed two different estimators for adjusting the data to compensate for the fact that the number of people testing for COVID-19 was anything but consistent. As a result, they were able to determine the potential danger of the virus more precisely. The first estimator is based on the rate of COVID-infected individuals without symptoms (symptomless rate), the second estimator is based on the percentage of all COVID tests with a positive result (positive rate, see diagram). Especially when many tests are available and people without symptoms also get tested regularly, a high rate of positive results is a good indicator of high infection rates. “These estimators are deliberately chosen to be simple and thus subject to error, but they provide a more realistic picture than the official case numbers. In addition, the figures become comparable over time,” maintains Stanlein.
The Robert Koch Institute (RKI) publishes the 7-day incidence. It shows the officially reported positive corona tests per week per 100,000 inhabitants (raw incidence). If many infections are asymptomatic, it suggests extensive testing has been conducted and infections have been detected that may otherwise have gone unchecked. Thus, a high rate of symptomless infection means a low rate of unreported cases in the incidence. Another way to determine the number of unreported cases is to use the positive rate, among other factors. This rate increased greatly during the omicron wave and recently reached over 50%. This is reflected in the much higher number of unreported cases.
In addition to adjusting for the number of cases, Stanlein and his colleagues also looked at different time periods for examining the different variants – and what effect the vaccination had. The study looks at lethality – the proportion of all people who died from different variants during the pandemic (see diagram). “This is highly interesting for the insurance industry, which wants to assess the actual risk potential of the virus,” Stanlein says. This is where the difference between the more dangerous alpha and the more contagious but less lethal omicron variant becomes apparent. “Furthermore, as the vaccination campaign progresses, we see a decoupling of death rates and hospitalisations from incidence,” Stanlein says. “That speaks in favour of vaccination, that has proven to prevent deaths and hospitalisations.”
This diagram shows the lethality rate of the different virus variants for different age groups if the data are adjusted for test activity. Here, the estimator based on the positive rate was used. The effect of vaccination was not factored out.
For insurers and reinsurers, these more realistic figures are important for estimating future benefit claims. “The corona pandemic causes an increased risk of death in the population and also an increased risk of occupational disability due to long COVID,” Stanlein explains. “For these two insured risks, it is reasonable to assume that the pandemic will cause more claims here." Life reinsurers in particular, who often do not reinsure annuities, need to look closely: “If a company essentially insures only these two risks, it is particularly affected,” he says. While higher benefit expenses are expected for the insured risks of death and disability, the opposite effect is expected for endowment insurance. This is because if more insured people die prematurely, it means that insurers can discontinue pension payments to them. So far, Deutsche Rück’s reinsurance portfolio shows only a slight excess in mortality in the pandemic year 2020.
The pandemic is also beginning to have an impact on occupational disability. “We are starting to see insurance cases through long COVID,” Stanlein says. Although there may be some shifts in results internally, he estimates the overall impact of this pandemic on life insurance to be low. “Severe excess mortality is only seen in older age groups, and coverages for these risks usually do not extend very far beyond the statutory retirement age.” One side-effect is still unclear: The pandemic forced hospitals to postpone many elective treatments and operations if the lives of patients were not acutely threatened. This could have a negative impact in the long term because, for example, cancers are treated too late.
With more virus variants predicted, the pandemic situation is expected to remain dynamic, which necessitates regular reassessment. Deutsche Rück will continue to monitor the situation.
This diagram shows the correlation of the different prevailing virus variants and the effect of vaccination.
2020: Wild type of the virus meets unvaccinated population.
Weeks 10-21 in 2021: Alpha variant, which was significantly worse in terms of lethality and hospitalisation despite initial vaccination.
Weeks 28-49 in 2021: Delta variant encountering a mostly vaccinated population, especially in the older age groups.
Since week 2 in 2022, the Omicron variant has been prevalent, which is milder and, together with the booster campaign, allows us to breathe a little easier, as hospitalisation and mortality are significantly reduced.
Deutsche Rückversicherung
Aktiengesellschaft
Hansaallee 177
40549 Düsseldorf, Germany
Phone +49 211 4554-01
info@deutscherueck.de
www.deutscherueck.de
www.deutscherueck.com
www.drswiss.ch
Jan Stepic, Melanie Dahms, Stephanie Embach-Stein, Sven Klein
Andreas Meinhardt (responsible for contents)
intellitext SprachenService
www.intellitext.de
bernauer designbüro
www.bernauer-design.de
ENORM Digital GmbH
www.enorm.digital
picture alliance / Geisler-Fotopress / Christoph Hardt/Geisler-Fotopres
picture alliance / Rhein-Erft-Kreis
picture alliance / Geisler-Fotopress / Christoph Hardt/Geisler-Fotopres
picture alliance / Boris Roessler
stock.adobe.com/kamichou
shutterstock.com/r.classen
shutterstock.com/JuliRose
shutterstock.com/Net Vector
Published in June 2022
Sie verwenden einen veralteten Browser, in dem diese Seite möglicherweise nicht korrekt dargestellt wird.
