Market Trends of Canada Cyber (Liability) Insurance Industry
Evolving Regulatory Reforms are Boosting the Market's Growth
In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) is guiding companies to adopt proactive cybersecurity measures, shifting focus from traditional reactive approaches. Insurers are increasingly prioritizing system security and the safeguarding of personal information. Canada was among the pioneers globally, enacting federal legislation mandating notifications for cyber and privacy breaches. However, the absence of explicit minimum standards in Canadian legislation means companies lack a baseline to follow, leading to a notable degree of cyber apathy in the country.
While PIPEDA has undoubtedly heightened awareness of cyber policies as risk transfer tools for businesses, the infrequency of regulatory fines, especially for entities like manufacturers or construction firms that do not handle significant personally identifiable information (PII), has resulted in minimal claims activity for the average Canadian business. In fact, under 4% of cyber claims arise from third-party or regulatory actions. Privacy laws have intersected with emerging ransomware variants that exfiltrate sensitive data, leveraging this to coerce companies into meeting their demands.
Ransomware Dominates the Cyber Threat Landscape in Canada, Targeting Key Industries
Ransomware attacks emerged as the most disruptive cyber threat in Canada. Ransomware constituted 31% of total claims last year, with Canadian businesses accounting for nearly half of that figure across the world. Criminals are increasingly stealing confidential information and threatening its release unless ransom demands are met. They now conduct thorough due diligence to gauge the maximum amount an organization can afford, tailoring their extortion demands accordingly.
Key targets include companies in manufacturing, construction, healthcare, and pharmaceuticals. Ransomware, once primarily viewed as a concern for business interruptions or system damage, is now increasingly seen as a privacy issue, triggering obligations to notify customers and stakeholders. However, businesses must remain vigilant. While ransomware attacks dominate headlines, traditional phishing attacks leading to business email compromises and wire transfer fraud still represent a significant portion of global claims, including from Canadian policyholders.
