Insurance claims don't reflect spread of viruses


June 10, 1991|By Russ Banham | Russ Banham,Journal of Commerce

Computer viruses are spreading rapidly, but most companies appear reluctant to file insurance claims covering their loss, say insurance and computer experts.

While viruses are covered under standard electronic data-processing insurance policies, most companies rarely use their insurance. Reasons for the reluctance range from ignorance about the coverage to stockholder concerns about a company's internal security to the difficulty in quantifying the extent of damage.

A computer virus is a software program with a destructive mission that duplicates itself and spreads. Once a computer is infected, other computers that share programs with the infected computer via diskettes or a network can also become infected.

According to the Computer Virus Industry Association in Santa Clara, Calif., an organization monitoring the electronic disease, computer viruses are reaching plague proportions.

"We log in about 30 calls a day from companies with infected systems," says John McAfee, chairman of the association and president of McAfee Associates, an anti-viral software company. "These are just the companies that we log, so I'm imagining there are plenty other companies out there also with virus problems."

Most companies have standard EDP insurance covering their computer systems and software. But they are not filing claims to financially recover from the cost of a virus, say insurance brokers and companies covering the exposure.

"I've heard of only three to four claims that have been filed involving a virus in the past few years and that's nationwide," says John Lamberson, vice president of Corroon & Black Corp., an insurance brokerage in San Jose, Calif. "It's very surprising."

"We've experienced maybe two or three claims filed for a virus," says Thomas Cornwell, manager of the electronic insurance department for Chubb Group of Insurance Cos. in Warren, N.J. "I remember one cost about $100,000 and the other, though it's not settled yet, will be about $200,000."

Ben Hedrick, commercial inland marine manager for Atlantic Mutual Cos. in Murray Hill, N.J., says the insurer has never received a claim for the damage arising from a virus.

"I keep reading in computer magazines that the incidence of viruses is way up," Mr. Hedrick says. "It's just not showing up at this end, though."

The lack of claims activity may be linked to the desire among companies not to arouse stockholder concerns about company security, the insurance representatives say.

"It's not very good public relations to announce to the world that your system has been broken into," Mr. Lamberson says. "It depends on the sort of business involved. Companies such as stock brokerages or law firms, for example, realize their customers wouldn't be too excited to know someone had been rummaging around in confidential files."

He knows of "quite a few companies" that have had internal security breaches from an outside computer virus. "The companies tended to whisper about these things. They didn't call on their insurance," Mr. Lamberson says. "They wanted to keep things hush-hush."

"I was in a prospective client's office last week and read on their bulletin board that a couple of their computers had become infected with a virus," notes Mr. Cornwell of Atlantic Mutual. "They were not planning on filing a claim."

Companies may be reluctant to file claims, because the cost of a minor virus is frequently small, Mr. Cornwell adds.

"Why risk adverse publicity when it could be easier to just absorb the problem in-house," he says. "If it's something like $5,000, it's just a nuisance factor. When it gets into the $25,000 range, then we're talking something else."

Companies may also have difficulty determining the actual cost of a virus, the insurers say. "It's difficult to estimate the amount of time it takes to cure a virus," Mr. Cornwell says. "I suppose these things can be quantified, but it'll take time and is not easy."

Mr. McAfee of the computer virus association agrees that quantifying a virus-related loss is burdensome. "Probably the overriding reason companies don't file claims is that it takes as much time to determine the extent of damage as to recover from it," he says. "It costs you many weeks in recovery efforts to remove a virus."

He speculates that many companies may not even know they are covered against the damage caused by a virus.

"A computer virus is the largest security risk faced by a company, yet it probably never occurs to anyone to claim this as an insured loss," he says. "The average company is going to look at a virus and feel it's a problem with the company's own policies and procedures."

Mr. Cornwell disagrees. "I can't believe most companies don't know they are covered at this time," he says. "There's been so much publicity."

Another reason for the rare occurrence of virus claims is only now materializing, Mr. McAfee says.

"Many companies are now beginning to seek recompense for a virus from the company that gave it to them," he explains.

"Liability is being assessed against companies who inadvertently have shipped a virus to another company. Rather than risk the incredibly bad PR, these companies fork over."

Baltimore Sun Articles
Please note the green-lined linked article text has been applied commercially without any involvement from our newsroom editors, reporters or any other editorial staff.