How about having your private IT technician on hand, 24 hours a day? It would be able to help you avoid viruses, save your data encrypted by ransomware, could even help your teenage victim of sextortion. These are a bit like the promises of an insurance product that is emerging in Quebec, cyber risk insurance for individuals.
“The question today is not whether, one day, I will be hacked. That’s when. » Like all his colleagues interviewed by The Press, Maryse Rivard is enthusiastic about the usefulness of cyber risk insurance for individuals. Vice-president at Synex Assurance and broker at Synex/Deslauriers, she has been president of the Regroupement des cabinets de courtage d’assurance du Québec (RCCAQ) since November 2022.
[L’assurance cyberrisques pour particuliers], it’s a beautiful product, super interesting. Because we are all moving into a technological world. Before, the thief would enter through the door of my house. Now it comes in through my machine. How can I protect her?
Maryse Rivard
“Before, during, after”
An example of what this coverage can provide? Mila Araujo, practice head of personal cyber insurance, North America, at broker NFP, a subsidiary of Aon which opened an office in Montreal, cites the case of one of her clients who was the victim of SIM card hijacking – “SIM swap”, in the jargon.
“Her phone stopped working one evening, she went to her store the next day,” she says. In the meantime, bad actors took control of her bank account, and were able to use two-factor authentication because they controlled her phone number and withdrew $50,000. As the fraudsters had all the access, and there was social engineering involved in all of this, the bank concluded that the transaction was legitimate […] Cyber risk insurance covers that. »
At the Insurance Bureau of Canada, Mahan Azemi is one of the pioneers of this brand new product, on which he wrote a first article last March. This senior policy advisor sees it as an intervention tool “before, during and after” cybercrime. “Individuals, like businesses, are very vulnerable in this regard. Your insurance can help you understand your risk, help you improve, give you access to resources. »
One in four Canadians victims
The statistics prove these three experts right. On average, every day in 2023, 115 Canadians were victims of fraud, the overwhelming majority of which were committed using technological tools. Financial losses were estimated that year by the Canadian Anti-Fraud Center at $569 million.
According to a 2022 survey commissioned by the Communications Security Establishment, one in four Canadians say their computer has been the victim of malware.
There are cyber risk insurance policies for businesses. Their popularity has exploded in Canada in recent years, going from 5,143 policies taken out at the start of 2019 in Canada to 174,805 at the end of 2022. The Office of the Superintendent of Financial Institutions has no longer compiled this precise statistic since the latter date.
But products for individuals are still very rare: in Quebec, the president of the RCCAQ, Maryse Rivard, believes she saw them appear on her radar screen barely two years ago. She is also one of the handful of people in Quebec to have cyber risk insurance for individuals – statistics are almost non-existent on this subject.
Because this product is still difficult to access in Quebec. The insurers most present on the market do not offer it. Desjardins, specifies its spokesperson Jean-Benoit Turcotti, does not have specific cyber risk insurance for individuals, rather a range of measures grouped under “Desjardins Protection”. This, however, we learned on Friday, will no longer include free membership to the Equifax monitoring service, offered at Desjardins’ expense for five years after the massive data theft, and which is expiring.
Language question
Brokerage firm NFP, for example, created and launched in March 2021 one of the few standalone cyber risk insurance policies for individuals, DigitalShield, for US$99 per year. “We have it everywhere in North America, except in Quebec and New York: we are finalizing our offer on that,” explains M.me Ajaurno.
“But we have options, people can contact us,” she adds, a little mysteriously.
BFL Canada brokers explain that specialized insurers have been offering it in Quebec and Canada for a year, but “not the insurance companies that everyone knows.” “It’s not having much success at the moment,” spokesperson Walid Khayate said by email.
According to Maryse Rivard, four firms offer it in Quebec, but only as an addition to a so-called “high-end” home insurance policy. Intact Prestige, Ovation by Aviva, Chubb and the latest in the running, Onyx, offer these riders at widely varying costs, the standard being around $100 per year for coverage between $50,000 and $100,000, with IT service agreements with specialized firms.
Chubb, for example, offers this additional coverage in Quebec integrated into its Chef-d’oeuvre home insurance “since 2018,” the firm indicated by email to The Press. Premiums range from $127 to $577.
This rarity for a product much more present outside of Quebec, Mme Rivard associates it with the new provisions of the Charter of the French language with Law 96, adopted in May 2022 and which in certain cases forces the translation of insurance policies. “When we come up with very niche products, sometimes we have customers who cannot find insurance,” she says. If we cannot find the product in French, or the product in French has less coverage, the only loser is the consumer. »
Five cover examples
Prevention
This is probably the most important aspect for insurers, less so for consumers given the wide availability of this advice. Essentially, any insurer will want to ensure that the client is aware of good cybersecurity practices, that their devices are adequately protected, and that they have minimal knowledge of the behavior to adopt online. The insurer will offer training, documentation and, in certain cases, will have a form completed to ensure compliance with the main clauses.
Monitoring
Several insurance plans offer hidden web monitoring (dark web) to detect whether their clients’ confidential information is there, as well as registration with credit firms like Equifax for active monitoring of changes to the credit file. This monitoring can even extend, if the client requests it, to protection against cyberbullying and intervention in cases of sextortion, i.e. blackmail using compromising data or photos. Some policies provide a confidential mechanism offered to the whole family.
Rescue
If the victim was affected by malware, simply adware which places unwanted advertisements on ransomware which encrypts the data on a device, cyber insurance almost all involves recourse to a specialized firm. These are the experts who will be able to determine the steps to follow, the possibility of recovering data, restoring the system or cleaning the computer. In the event of financial fraud, the insurer may also take charge of recovering the accounts.
Refund
This is, obviously, one of the most attractive benefits of such a policy. Depending on the coverage obtained, one can recover all or part of stolen funds, repair or replace damaged goods or obtain more advanced protection of online transactions. Legal costs and lost wages caused by such events are also considered. The amounts reimbursed generally range from $50,000 to $250,000, depending on online offers.
Psychological support
One of the most common aspects of cybersecurity events is that the victim feels completely helpless and may panic. Virtually all cyber risk insurance includes technical and psychological assistance components offered to all members of the family. Some, notably Chubb, add services to counter defamation or restore online reputation. Ovation even covers temporary moving costs and social media monitoring.