The government will put an end to the gray zone surrounding the payment, by insurers, of ransoms linked to computer hacking. It is about to validate the practice provided that a complaint is filed, according to the Ministry of the Economy.
This measure linked to cyber-ransoms “will be an integral part of the orientation and programming bill of the Ministry of the Interior (LOPMI)”, adds the Ministry of the Economy. And “a task force (Editor’s note: a specialized team) dedicated to cyber risk insurance, involving the actors concerned, will be put in place by the end of September, ”also indicates Bercy, the headquarters of the ministry.
According to a report by the Directorate General of the Treasury aimed at developing cyber risk insurance, it is necessary to “clarify the legal framework”, in particular through “the obligation to file a complaint from the victim to allow insurability of a cyber-ransom”, explains the ministry.
Axa and Generali had suspended their option
Until now, a gray area remained on this subject. While indemnification by ransom insurers was not illegal, a parliamentary report proposed a year ago to ban it, judging that “the payment of ransoms (by insurers) feeds cyber-crime” and that “there is no guarantee that the ransom paid will guarantee a return to the initial situation” for the attacked company.
Axa France had suspended the marketing of the “cyber-ransom” option since May 2021, until the insurance intervention framework was clarified. The insurer had been followed by Generali France in early 2022.
In its report, the Treasury stresses that in order to develop cyber insurance, which represents only 3% of professional damage insurance contributions, it is necessary, among other things, to better measure damage and therefore cyber risk, by sharing data between the public and the private sector, and to “increase efforts to raise awareness among businesses”. “I would like these guidelines to be implemented as quickly as possible,” said the Minister of the Economy, Bruno Le Maire.