Two thirds (66%) of Irish businesses have experienced at least one cyber-attack in the last year, while more than a third have been hit with over three attacks over the last twelve months.
This is according to research amongst 250 Irish businesses by leading Irish insurance broker, Gallagher and the Centre for Economics and Business Research (CEBR). The research provides a unique insight into the impact of cybercrime on Irish companies, and just how common cyber-attacks on Irish firms are.
Asked about the impact of cybercrime incidents on their organisation over the last year:
- Three in ten (30%) Irish businesses said they had incurred legal costs
- Almost three in ten (29%) lost revenue
- More than one in five (22%) of those who experienced a cyber-attack were fined by a regulator
- A third (32%) said they were unable to service customers in the downtime that arose following a cyber incident.
Commenting on the research, Michael Cunningham, Head of Financial Lines at Gallagher said:
“The frequency, severity and intensity of cyber-attacks has increased in recent years and our research reflects that - with two-thirds of Irish businesses experiencing at least one attack in the last year. The huge repercussions that these can have on businesses should not be underestimated. Businesses can face substantial hits to their profit, or even bankruptcy, after a breach.
“Legal costs that arise from a cyber-attack can put a huge financial strain on businesses, as can reputational damage. As well as leading to a loss of trust and confidence in the company amongst customers, investors and partners, reputational damage can lead to negative media attention. Revenue can be lost when customers cancel contracts, reduce spending, or switch to alternative suppliers after a cyber-attack. It can take a company years to rebuild trust – and revenue – after an incident.”
Misplaced confidence?
Despite the significant number of Irish businesses that have experienced a cyber-attack, most (95%) are confident that they could detect and contain a cyber breach, even if the intruder remains hidden for some time, with more than half (55%) of Irish businesses saying they are “very confident” of this.
Growing threat of litigation
According to the Gallagher research, Irish businesses are keenly aware that they could face litigation following a cyber-attack:
- Seven in ten (70%) Irish businesses expect a serious cybercrime incident to lead to legal or shareholder/investor action for their company, with three in ten (30%) believing this prospect to be “very likely”.
- The vast majority (84%) of businesses are aware that company directors could face personal liability or legal actions in the event of a cyber breach.
Mr Cunningham added:
“Shareholder litigation costs are emerging as one of the costliest consequence of cyber-attacks for businesses. This is something which Irish businesses need to be increasingly mindful of and to prepare for.
“As the high-profile attacks on high street retailers last year show, the legal, financial and reputational fallout from cyber-attacks can drag on for months, even years. In the US, breaches have gone even further, triggering costly shareholder lawsuits focused entirely onboard oversight and disclosure.
Taking action
The Gallagher research also shows that Irish businesses have taken steps to combat cybercrime, with more than seven in ten (72%) Irish businesses having a standalone cyber-insurance policy in place. However, with costs emerging from cyber-attacks, evolving businesses need to be aware of what these policies do and don’t cover.
According to the Gallagher survey, the main costs covered by the cyber insurance policies held by Irish businesses are:
- Business interruption costs, with 56% of firms saying these costs are covered by their cyber insurance policy
- Third-party legal costs (50% of firms said these costs are covered by their cyber insurance),
- Data recovery and forensic payments (46%)
- Ransomware payments (42%).
Mr Cunningham concluded:
"While it’s encouraging to see businesses investing in cyber insurance, directors need to understand this does not cover every single aspect of a cyber-attack. Cyber insurance covers the operational fallout, system damage, and liability caused by a digital attack. Directors & Officers (D&O) insurance will usually be needed to cover costs relating to directors not adequately protecting the business and being held liable by shareholders, whilst commercial crime insurance reimburses firms for direct financial losses resulting from theft and fraud. Firms should engage the support of a specialist insurance broker who can advise them how to protect against the fallout from cyber issues such as those we see today.
“It is important for firms to remember security measures should also go beyond just financial protection. Many businesses are still vulnerable due to gaps in employee training, system monitoring, and access controls. For Irish businesses to be able to withstand and recover from cyberattacks, putting all the necessary guardrails in place ahead of time is paramount”.
