ALBANY – The increasing frequency and sophistication of cyberattacks is translating into higher insurance costs for local governments in New York trying to protect their networks from breaches and ransomware.
Such attacks can have a devastating financial impact on county governments and potentially compromise confidential data on individuals and businesses that have transacted with local agencies.
“We’ve seen the cost of cyber insurance rise for years, but this year it’s taken to a whole new level,” said Michael Zurlo, president of the New York State Counties Association and Clinton County Administrator.
It’s a kind of insurance that local governments can’t live without, Zurlo said.
“The world is now run by computers and so most of our information is electronic,” he said from his office in Plattsburgh.
This year, Clinton County paid some $48,000 for its cyber coverage, he said. The estimated premium for the coming year is $72,000 – a 50% jump, Zurlo said
In Cooperstown, the Otsego County Board of Representatives, whose agencies were hit by cyberattacks, chose to spend some $1.8 million on a comprehensive update to its computer systems, Brian Pokorny said, who oversees information technology for the county government.
“I have to give credit to the county council for understanding how serious the problem is,” Pokorny said.
County government leaders cite a major security breach attacking Suffolk County computer networks last month as an example of the nightmares that arise when electronic data flows to an unauthorized party.
The breach resulted in millions of dollars in unforeseen costs for county sellers, slowed the processing of real estate titles, and caused some county staff to communicate via old-fashioned pen and paper.
Two years ago, a similar turmoil befell the Chenango County government, when a ransomware attack left many computer users locked out of the network.
“Every day people with far more resources than us try to hack”, said David Bliss, chairman of the Otsego County Council of Representatives “It’s a constant battle.”
He said his county, like many local governments, gets its cyber insurance through New York Municipal Insurance Reciprocal, a regulated insurer owned by some 900 municipalities across the state.
According to the Council of Insurance Agents and Brokers, a trade association for the commercial insurance industry, cyber insurance premiums have risen amid heightened awareness of the threats posed by cyberattacks, not only against government agencies, but also against private companies.
In the first quarter of this year, cyber premiums were 28% higher than they were in the fourth quarter of 2021, the council reported.
According to the New York State Counties Association, ransomware is implicated in the overwhelming majority of cyber insurance claims.
Last year, the average ransom payments sent to attackers following such breaches exceeded $800,000.
“Insurance experts view municipalities as a high cybersecurity risk right now, which is why it’s important that municipal leaders begin to strengthen their cybersecurity efforts,” NYSAC warned in its report. Its release coincides with National Cybersecurity Awareness Month.
The association also advised county government leaders and staff on the availability of a national 12-week online training program aimed at providing information on business continuity and effective responses during cyber attacks.
Pokorny said it was crucial for local governments to have the information technology defenses that can prevent the type of attack that has crippled Suffolk County government.
“We hold a lot of sensitive information, so we want to make sure it’s not passed on to the wrong people,” he said. “And we want to make sure that we secure taxpayer funds so the bad guys can’t access them.”