Marsh Re says precautionary PHP2Shell shutdowns, not breaches, are driving early cyber losses

Marsh Re's October report on the PHP2Shell vulnerabilities says precautionary shutdowns, not confirmed breaches, are causing the first losses, Insurance Business reported on 30 October. The reinsurance broker expects business interruption to be the main loss driver, rated medium to high, with online retailers most exposed.

According to the report, whether these losses are recoverable depends on policy wording: the trigger, the waiting period, sublimits and how the policy treats a voluntary shutdown. Simon Hughes of Cowbell told Insurance Business that businesses which switch off as a precaution, and their brokers, "should check now" how their policy treats such a shutdown. Coalition said its policy has no clause that removes cover when a client does not install the patch.

Marsh Re says insured portfolios lean towards better-resourced firms that patch faster, but smaller companies could need longer to fix the problem. For now it puts PHP2Shell closer to routine patching than to an acute catastrophe. Marsh Re estimates that PHP runs 77% of websites. Emergency patches came out on 21 October.

Disruption has been wide. Dutch government services, Finland's state IT centre and a Danish municipal IT provider restricted access or went offline for a period. The US Cybersecurity and Infrastructure Security Agency added both flaws to its catalogue of known exploited vulnerabilities and told federal agencies to patch by 29 October. AM Best called the flaw a systemic risk scenario that "has long worried cyber insurers". William Altman of CyberCube said PHP2Shell is not a true 1-in-200-year cyber event today.