Amid growing concerns about a Russian invasion of Ukraine, the last month has seen the US, UK, and Australian governments urging businesses to strengthen their IT defences against cyber attacks. Russia’s invasion is not limited to physical force and troops on the ground, but an assault on Ukraine government and business' IT systems through a barrage of sophisticated cyber attacks, aimed at destabilising the country.Recently, there have been instances of "wiper" attacks, which destroy all data on infected machines, and DDoS (Distributed Denial of Service) attacks, which are designed to knock a website offline by flooding it with requests until it crashes.

‍

WHAT DOES THIS MEAN FOR AUSTRALIAN BUSINESSES?

‍

DATA BREACHES

These developments could have far-reaching implications for Australian and International businesses. Over 100 international companies from the Fortune 500 list are clients of Ukraine IT companies, including Lenovo, Google, IBM, Amazon, Boeing, Swedbank, Visa, and many more. An attack on a Ukraine IT provider could result in a data breach or failure of critical services for Australian businesses, triggering a potential notification to regulators and impacts to consumers.

‍

TRADE & SUPPLY CHAIN DISRUPTIONS

Australia has a strong trade relationship with Ukraine, being the leading Ukraine trading partner in Oceania.

Having just battled through the global disruptions caused by the Omicron outbreak, Australian businesses could suffer further supply chain disruptions, affecting their ability to deliver goods and services to their clients, triggering contractual breaches, and major hits to profitability.

In Australia, we import over AUD 40 million, mainly in edible oils, metallurgy, fertilisers, machinery, and vessels from Ukraine, and export about AUD 110 million, including pharmaceuticals, machinery, optics, jewellery, carton, and paper. Two of the main types of services provided by Australian and Ukrainian companies are logistics and telecommunications.

Furthermore, Australia has significant investments in Ukraine, totalling almost AUD 700,000 in 2021. The largest share of funding was invested into retail trade, information technology, and telecommunications, so disruptions to these areas could cause major impacts on Australian businesses.  

‍

WHERE DOES INSURANCE COVER COME INTO THIS EQUATION?

Most policies contain broad form exclusions for losses resulting from Acts of War. Business interruption and contractual breaches stemming from civil unrest or acts of war will not be covered by most insurance policies, unless specific (and very expensive) endorsements are negotiated with insurers prior to the occurrence.

Cyber policies contain the same general exclusions, but insurers generally do not apply them to cyber attacks stemming from overseas threat actors.

Whether your business has cyber insurance cover or not, Australian businesses should be taking actions to limit their cyber risk exposures, including:

• reviewing their IT security protocols and defence networks;
• ensuring a current and tested business continuity and disaster recovery plan is in place;
• ensuring a cyber attack framework is established, with a clear path to notifying brokers/insurers, engaging external cyber incident response managers, and notifying key internal stakeholders;
• reviewing all contracts with clients and suppliers for any “suspected breach” notification requirements, ensuring readiness to notify as necessary.

‍

WITH YOU ALL THE WAY

Be sure to reach out to your broker to ensure you have the right guidance and cover in place.

‍

Poppy Foxton

National Head of Corporate Insurance &Risk Solutions

poppy.foxton@honan.com.au