Reinsurance exclusions limiting cyber cover from P&I clubs (source Lloyd’s List)

EXCLUSIONS on the part of reinsurers have forced Steamship to restrict cyber cover for non-poolable risks to sit within retention levels, according to the marine mutual’s head of reinsurance.

The comments from Rupert Harris — contained in the club’s annual management highlights — come after another senior figure in the sector told a recent webinar that the cyber issue has now reached “considerable magnitude”, prompting underwriters to look more closely at potential exposure.

Cyber security is rapidly shooting up the industry agenda after hacks at a number of major shipping companies, including Maersk, CMA CGM and HMM.

Other maritime concerns, such as the International Maritime Organization, Rina and Clarksons, have all also been hit.

The IMO has adopted a resolution requiring companies to demonstrate that cyber security is an integral part of their safety management system, no later than the next annual verification of their Document of Compliance.

As things stand, there is no exclusion in P&I cover in respect of liabilities caused through a cyber event.

However, liability cover alone leaves owners uninsured for the costs of restoring systems and data, and for losses where a vessel goes off hire or is unable to trade as a result of cyber attack.

Steamship has launched a product explicitly to plug some of these gaps, as well as providing access to expert assistance and free security awareness training for employees.

But even this cover is only in respect of events affecting an entered vessel and does not extend to shoreside offices or other property.

There is a $10m aggregate per fleet per policy year, as well as a cap of $1m per vessel per event.

In his section of the management highlights document, Mr Harris pointed out that while Steamship’s own reinsurances had successfully been renewed, many reinsurers had introduced exclusions for both the coronavirus pandemic and cyber risk.

“Unfortunately this meant the club had to similarly restrict the cover it could offer its members in respect of charterers and non-poolable risks,” he said. “The club did offer members limited cover for Covid-19 and cyber risks within its retention levels.”

Joe Hughes, chief executive of American Club, told a webinar organised by Capital Link last week: “The general view is that, yes, these risks are of very considerable magnitude.”

While the American Club had not had significant exposure so far, underwriters “will be looking very closely at their exposures going forward, more perhaps than they might have been inclined to do even two or three years ago,” he said.

“Clubs will do their very best to provide the greatest levels of cover that are realistically available”.

<>Thomas Brown, chief executive at marine insurer Shoreline, said many applications he received from companies were incomplete and lacked even the minimum security measures needed to get cyber cover. 

Many shipowners maintain a false sense of security, and were complacent, since they had not yet been attacked themselves, Capt Brown said.

Steamship’s management highlights document reports a jump in its combined ratio from 100% to 125% in the last policy, indicating a technical loss of $5 for every $4 of premium income, thanks to the impact of coronavirus and record level International Group pool claims.

Gross written premiums fell back to $284m, compared with $308.7m last time round, with an underwriting loss of over $59m instead of the small surplus recorded in 2019-20, according to the marine mutual’s financial statements.

But this was mitigated by investment returns, finally resulting in an overall deficit of $4.28m and a small hit to free reserves, which fell to $511m.

Claims net of reinsurance recoveries came in at $256m, up by 3.7% compared with $246.9m recorded in 2019-20.

Steamship experienced three pool claims, two of which were coronavirus-linked claims from cruise operators, in which the club participated on a quota share basis, thus limiting exposure.

The de facto shutdown of the cruise industry will reduce subsequent exposure.

The third pool claim was a pollution claim resulting from loss of containers overboard.

Steamship saw 48 claims in excess of $250,000 in 2020, six fewer than in 2019. The total estimated exposure was just over $80m, a year-on-year reduction of $24.5m.

Cyber security is rapidly shooting up the industry agenda after hacks at a number of major shipping companies. ( Source: Panther Media GmbH / Alamy Stock Photo )