Workers’ Comp Ripe for Cyber Attacks

Experts say it's only a matter of time before hackers train their sights on the workers' comp community.

By: Nancy Grover | September 25, 2015

The workers’ comp industry is ripe for cyber attacks, according to insiders. Identity theft, company embarrassment, and even blackmail are potential risks. The threats to an employer can range from reputational damage to criminal charges.

With organizations such as Sony, Anthem Blue Cross, and the Internal Revenue Service recently being hacked, it’s likely just a matter of time before such an incident occurs in workers’ comp. In fact, it may have happened already.

“In many cases where there may have been a threat or even an intrusion, there may still be research going on, or it may not be of the type that requires state reporting,” said Bob Jackson, a longtime security officer in the claims management industry. “My guess is there is some growing level of cyber threat in the workers’ comp industry.”

The workers’ comp industry may one day soon find itself the victim of a major cyber attack, experts warn. While there are no solid solutions just yet, the industry would be well-served to at least try to answer some key questions.

“What information is at risk for the company?” said Jeffrey Austin White, director of innovation for Accident Fund Holdings Inc. “What will the landscape look like in the future as hacking technology gets more sophisticated? Do we need to establish more stringent policies and procedures or start setting aside money for damages?”

Risks/Damages

“Systems these days are so complex that in order to truly understand the scope of an attack takes days, weeks, or months,” Jackson said.

Information is breached for a variety of reasons, the experts say. Many hackers are paid by large organizations for their efforts.

“We have professional hackers associated with organized crime that are paid professionally,” Jackson said. “We have groups that have an agenda; it may be political or it may be a public values agenda.”

Some hackers seek to embarrass a company, and there are hackers motivated by the fun in doing it.

“I do think workers’ comp is a very rich community for almost all those audiences,” Jackson said. “In workers’ comp, we have information that by itself would lead to identity theft for pretty well every claim being managed.”

“All these hacks are exploiting vulnerabilities that arise from updates to software and the operating system that are ongoing. … Technology is progressing so fast that keeping on top of this stuff requires dedicated resources.” — Jeffrey Austin White, director of innovation for Accident Fund Holdings Inc.

The fact that most states require Social Security numbers for injured workers is one of the key factors making workers’ comp claims information a target for security breaches. Jackson says it goes beyond that.

“This is not spoken of very much but … there’s potential for blackmail,” he said. “Material may have sensitive information about [an injured worker’s] status; that he/she is HIV positive, or the circumstances of an accident may be embarrassing, there may be a chronic disease, or a pregnancy that has not been announced yet.”

A company that has had its information breached may have difficulty keeping its reputation intact. It may lose contracts from clients.

“Most organizations in workers’ comp have contracts which entitle clients to terminate contracts upon these types of breaches without further arbitration,” Jackson said. “I’m seeing that contractual language more and more.”

Hacking 101

There are a couple of ways people can hack into an organization’s data. One is a derivative of Bad USB, described as a security flaw that can be put on the firmware of a USB drive and turn a user’s keyboard, mouse, storage device of any USB device into a cyber threat.

Another way secure information can be breached is through external attacks to a company’s website or network. A system called Regin, for example, is sophisticated espionage software that can be used to get inside a company’s firewall and provide access to its internal computer network.

Information can also be breached through mobile devices brought in and out of a company by its own employees or by sending sensitive data through email. “There are also cloud computing platforms and outsourcing relationships,” said Jeffrey Austin White, director of innovation for Accident Fund Holdings Inc. “If you do business with a company that has access to your company or client information, how do you make sure they have the proper safeguards to protect your data?”

Solutions

Because cyber threats are a moving target, reliable long-term solutions are an elusive goal. “There is no silver bullet,” White said. “All these hacks are exploiting vulnerabilities that arise from updates to software and the operating system that are ongoing. Companies are having a hard time keeping software current, especially when vendor solutions are not compatible with the latest releases. Technology is progressing so fast that keeping on top of this stuff requires dedicated resources.”

White likens the threat of cyber attacks to natural catastrophes and suggests the industry try to figure out how to prepare for these digital disasters as they are bound to happen. Both experts say the industry needs to at least develop policies and procedures for the emerging threat.

“The industry would be well-served to gather together [just] as high-tech industries have done, and create a forum for sharing concerns, solutions, and issues that sometimes are unique to the workers’ comp environment,” Jackson said. “I just don’t see that evolving. There’s such fear of sharing with your competition that you may have an issue or not know how to evaluate. People don’t want to talk. That’s unfortunate.”

In the absence of such a solution, Jackson says organizations would be well-advised to employ security officers who are aware of the needs of the business and have a strong working relationship with key personnel.

“When issues come up, they have authority and the relevance to go to the business and say ‘we need to make this change and use some [particular] tool and here’s why. Let me explain why this will reduce risk to the organization,’” he said. “They should have a business-to-business dialogue rather than imposing what seem to be random tactics. If the business is engaged and understands why [the security officer makes a recommendation], the business will embrace it and support it.”

Nancy Grover is the president of NMG Consulting and the Editor of Workers' Compensation Report, a publication of our parent company, LRP Publications. She can be reached at [email protected].

How a Carrier Partner Can Help Navigate a Challenging Management and Professional Liability Market

A combination of a choppy economy with increased claims frequency and severity could lead to rate increases in the Management & Professional Liability market.

By: Risk & Insurance | April 3, 2024

Rates in the management & professional liability (M&PL) markets were on the rise from 2020 to early 2023 and are now falling rapidly.

M&PL divisions manage a number of different insurance products including management liability (D&O), professional liability (E&O), employment practices liability (EPL), fiduciary liability policies, cyber, etc. In 2023 and into 2024, a big influence on the marketplace has been the extremely aggressive and softening public company D&O market.

Though these rates have been softening for management liability, that may change over the next few years as companies continue to adjust their business models motivated by economic uncertainty. Layoffs were up nearly 200% last year, Forbes reported, even as other recession indicators, like the inflation rate, improved. A recession could lead to an increased claim activity and force carriers to raise rates.

“Whenever there is a meaningful downturn in the economy, we tend to see claim frequency pop up,” said George Schalick, Jr., senior vice president of the Management and Professional Liability Division at Philadelphia Insurance Companies (PHLY).

With continued fiscal uncertainty, businesses potentially already burdened with pandemic-related claims should seek a carrier with a long history in M&PL products. They will provide much-needed risk management guidance and be better positioned to support their insureds during market fluctuations.

Why Insureds Might See an Uptick in M&PL Claims

George Schalick, Jr., Senior Vice President of the Management and Professional Liability Division, Philadelphia Insurance Companies

The current soft market might come as a bit of a surprise as it does not track with previous underwriting cycles and economic conditions. Afterall, many privately held and non-profit organizations struggled during the early days of the pandemic with shutdowns and rapidly declining revenues. But the Government assistance programs, like the Paycheck Protection Program loans, helped keep many afloat during the tough times.

“During COVID many organizations stopped doing business until they were able to sort out all of the health and safety challenges,” Schalick said. “They were forced to lock down, but then all the government assistance programs allowed them to keep people employed. The increased volume of claims we anticipated we would see coming from the lockdowns and restrictions that were imposed upon businesses in the U.S. didn’t manifest at first.”

“Just because there wasn’t an onslaught of reported claims at the beginning of the pandemic, doesn’t mean the circumstances that would give rise to a claim being reported didn’t occur. Courts and the judicial system were closed or slowed and now that they are back open, we’re starting to see the circumstances that occurred during the COVID lockdowns becoming claims today,” Schalick said. “Litigation is progressing.”

Added to the delayed pandemic litigation is a concern over newer claims that might be filed as the country inches toward an economic downturn. Though a recession was avoided in 2023, experts think a soft dip could occur in 2024, with 76% of economists saying there’s a 50% or less chance of an economic downturn this year — that almost always results in more management liability claims.

“During the Great Recession in 2008, we saw an almost immediate spike in claims because of the economic conditions and the pressure it placed on organizations. They were making personnel changes with significant belt tightening almost immediately.” Schalick said.

What’s in Store for M&PL Policy Rates in 2024?

Despite an uptick in claims and increased economic uncertainty, management liability rates haven’t increased, resulting in market-wide pricing levels that may not meet the increased pressure of rising settlements and jury verdicts.

“Rates are going the other direction and settlement values are not falling,” Schalick said.

The mismatch between rates, claim frequency and severity is, in part, because carriers experiencing the dramatic soft market in the public D&O market are seeking premium gain in the private and non-profit market.

“In the public company market, the rates have been decreasing significantly. The rates were increasing in the private, not-for-profit market, and rightfully so, but there’s a desire to supplement overall mid-size D&O for carriers who also write private not-for-profit, and they see that as an opportunity to aggregate premium,” Schalick said. “So the always competitive landscape in the private, not-for-profit market has dramatically increased in the last 18 to 24 months.”

Still, companies of all sizes and types should be concerned about management liability rates in the future. Legal system abuse is resulting in increases in both the amount of litigation and the size of verdicts plaintiffs are receiving.

Certain areas of the country are particularly vulnerable to this type of legal system abuse. As a result, insureds in these localities are likely to be vulnerable to rate increases.

“The environment is so positive for the plaintiff that forces premium increases so carriers are able to stay in that market long term,” Schalick said.

Why a Tenured Carrier Partner Can Help Insureds Navigate An Uncertain Market

It’s clear that insureds are facing an uncertain M&PL market over the next few years. Fortunately, carriers with a long history in the M&PL space will be there to offer stability.

Philadelphia Insurance Companies has been supporting this market for 35 years. PHLY is committed to offering long-term rate stability, even as economic and claims trends start to push premiums upwards. They have an appetite for all sorts of companies, large and small, for-profit and nonprofit alike.

“We’ve been at this game for a long time and are one of the most tenured underwriters in this space,” Schalick said. “We like to stay very consistent.”

PHLY has worked with both for-profit and non-profit on management liability policies. With dedicated M&PL teams throughout the company’s 13 regions, PHLY provides the support agents and brokers are looking for on behalf of their clients. The teams know their regions well and can respond to local trends. They’re also dedicated to making the renewal process as easy as possible for their partners and policyholders.

“We have real confidence in our results, so we focus a lot on making the renewal experience as painless as possible for all agents and insureds,” Schalick said.

The company is also investing in tools to help insureds avoid losses. Earlier this year, they launched a new online risk management platform, PHLYGateway, which offers resources for insureds on how to create an employee handbook and trainings on issues such as recognizing workplace sexual harassment and discrimination.

If insureds have questions, they can consult a Best Practices Help Line, provided via the platform. That way, they can get on the spot risk management guidance to help them prevent claims.

To learn more, visit: https://www.phly.com/mplDivision/managementLiability/default.aspx.

This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Philadelphia Insurance Companies. The editorial staff of Risk & Insurance had no role in its preparation.

Emerging Cyber Risks