It has been reported that Norsk Hydro may have lost $40 million following last week’s ransomware attack. On a preliminary basis, the financial impact during the first week was estimated at between 300 million and 350 million Norwegian crowns ($35 million-$41 million).
Experts Comments Below:
Oleg Kolesnikov, VP of Threat Research and Head of Securonix Research Labs at Securonix:
To illustrate, in case of the Mondelez’s NotPetya cyberattack that reportedly resulted in over US$100 million in damages that was in many ways similar to the Norsk Hydro LockerGoga ransomware attack, the claim was being disputed by the Mondelez’s cybersecurity insurer Zurich citing the so called “war exclusion” in the policy language for hostile acts by sovereign actors.
While the cost of the Norsk Hydro attack is significantly lower, at roughly US$35-41 million, recovering the costs of the cyberattack even with reputable cybersecurity insurers can be non-trivial. Fortunately, NotPetya had a number of differences from LockerGoga, particularly in that, as the UK officials believed, a nation-state-level malicious threat actor was involved with NotPetya, and the purpose of the NotPetya attack was more along the lines of a cyber sabotage than a classic ransomware attack.
In contrast, LockerGaga currently looks much more like a traditional ransomware attack than a nation-state-sponsored malicious breach, so this is something that Norsk Hydro might be looking into further once they are able to fully restore their normal business operations.”
Deborah Chang, Vice President of Business Development and Policy at HackerOne:
We encourage more cooperation and collaboration between all functions with an organization to the issue of cybersecurity and cyber risk.
Insurers like AIG are most likely invested in encouraging or requiring post breach cybersecurity practices that can limit the extent of the breach as much as possible and ensure a company is as secure as it possibly can be. The question that will most likely be asked is how AIG and other insurers do this post-breach, and pre-breach, when the insurance buyer or risk team doesn’t necessarily have the influence or ability to collaborate with the security team.”
Ilia Kolochenko, CEO at High-Tech Bridge:
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.