School district reports 334% rise in cybersecurity insurance costs
Bloomington School District 87 in Illinois has released details of its cyber insurance renewal, and the cost has risen from $6,661 in 2021 to $22,229 this year.
This dramatic 334% increase in bounties is attributed to the sudden increase in the number of threats, their severity and the potential for costly disruptions.
“In light of the events that negatively impacted the cyber insurance market, SSCIP was unable to initially source the required coverage for the group,” the memo reads.
“After a short delay, the Cooperative was finally able to find an insurer willing to accept the risks of the pool.”
The Suburban School Cooperative Insurance Program (SSCIP) is an insurance pool for school districts to join together to negotiate better insurance rates and reduced administration fees.
The most significant issue driving this sudden cost increase is ransomware and the long-lasting disruption that encryption attacks and data theft can have on compromised school networks, employees, and students.
Ransomware actors, especially less skilled affiliates, target small school districts because they are rarely well-protected from attack and usually cannot afford a large dedicated IT and security team.
However, because schools usually have an active insurance policy, they are attractive targets for threat actors hoping for prompt payout from insurance companies.
Emsisoft released a report summarizing the 2021 ransomware attacks against the US public sector, where they count 77 governments, 1,043 schools, and 1,203 healthcare victims.
MFA now required
As District 87’s memo mentions, the insurer also required the district to fully implement multi-factor authentication protection on all of its accounts.
The school estimates that it can conclude this change by March 30, 2022. However, until this happens, the coverage limits will remain reduced, well below the agreed amount.
This reflects the importance insurers and security experts place on using MFA to protect network connections.
MFA is a method of validating user identity through a combination of things beyond passwords. For example, they can take the form of one-time passwords, key cards or biometric data.
Ransomware actors typically deploy their encryption tools using compromised user credentials to gain access to target systems. As such, having MFA in place is often enough to stop the attack before attacks can begin.
Additionally, connections to the backup service must be protected using MFA, which prevents ransomware actors from accessing and deleting backups. With reliable backups in hand, this significantly weakens a ransomware gang’s negotiating position and speeds up recovery.
A large-scale problem
District 87 is just one of many U.S. public educational institutions that will face this substantial additional burden on its annual budget, and it doesn’t just apply to schools.
Hospitals, nonprofits, and local governments will all face significantly higher cyber insurance costs in 2022 due to an increase in cyberattacks in 2021.
The healthcare industry has also been bombarded by ransomware actors in 2021, mostly for the same reasons that make school districts prime targets for cybercriminals.
Universities are also in the crosshairs of ransomware actors, and they too have to strike a delicate balance between budget allocation and cyber protection as they have limited resources.
Lori Sussman, assistant professor of cybersecurity at the University of Southern Maine, told Bleeping Computer that cyberinsurance premium increases will continue to outpace other insurance instruments until organizations can stem growing attacks. .
These scammers also attack targets they perceive as “soft”, including small municipalities, schools, universities, and other organizations that may not have large budgets for IT staff, let alone experts. in cybersecurity.
This is arguably the reason why cyber insurance premiums increased by more than a quarter (25.5%) in 2021 (according to the Council of Insurance Agents & Brokers), which is well above other instruments insurance.
The CIO of the University of Maine system has prioritized safety for the state’s higher education system. However, more awareness of all stakeholders – students, faculty, staff – will be needed to defeat these predators.