Explore the Cyber Risk Insurance Policy from Pinc Insurance

Page 1

LEVERAGING OVER THREE DECADES OF FINANCIAL EXPERIENCE


• Pioneer Investcorp (PINC) is an India-focused integrated financial services company serving the mid-

Overview

market companies

• Three decades of experience in serving the needs of corporates, institutional & government clients and family offices

• Excellent deal track record • Pioneer Group has a professional team of over 300 members with a strong entrepreneurial mindset

• Presence across 7 cities Mumbai | Delhi | Chennai | Bengaluru | Kolkata | Pune | Coimbatore


Leadership Gaurang Gandhi, Managing Director

Ketan Gandhi, Director

• Over 30 years of professional experience across financial services mainly investment banking, leasing, structured products and project finance

• Over 20 years of comprehensive equity market experience with key strengths in stock picking and developing corporate relationships

• Qualified Chartered Accountant

• Bachelor’s of Commerce, HR College of Commerce, Mumbai

Sushant Kumar, Director & CEO

Rakesh Bhatia, Director

• Nearly 30 years of experience in corporate banking, SME financing, institutional sales, loan syndication and capital markets advisory

• A qualified chartered accountant and a rank holder from ICAI • Associated with Pioneer since 1993

• Masters of Economics, Guwahati University; Global Executive Leadership Program, University of Michigan and Certified Associate of the Indian Institute of Bankers

Hemang Gandhi, Director

Sathish Mathur, CEO - Insurance and Reinsurance Broking

• More than 20 years of experience in the financial services industry, with a focus on investment banking

▪20+ years in corporate finance, leasing and liability insurance

• Bachelors of Commerce, Mumbai University

▪AICWA, CPA, Masters in Business Administration


Group History

1985 Establishment of Lease Syndication Business

1995

2003

Rights issue offering of Pioneer Investcorp Ltd on Bombay Stock Exchange

Initiated Private Equity Advisory line of business. Commenced Insurance Indian Markets for

1990 Started Investment Banking and Institutional Trading business

2011 Strengthening and consolidation of Debt Syndication and Investment Banking across business verticals.

2019 Launching Portfolio Management Services

2000

2007

2017

Commenced Equity derivatives segment

Launched new Businesses:

Acquired Lloyd’s License Traded volume in Institutional securities worth INR 80,000Cr (USD 12.3 billion) in FY17

• Wholesale Debt Management CDSL • Reinsurance broking covering 22 countries


The Pinc Edge Strong Capabilities

Disciplined Approach

• Depth of Leadership

• In-depth research

• Execution Experience

• Due Diligence & Deal Structuring

• Global Best Practices with

• Continuous engagement with

Local Expertise

client companies

Diversified Presence

Robust Compliance & Governance

• Pan-India reached through

• Strict adherence to regulations

5 offices

• Risk Management & Corporate

• Integrated B2B Solutions across insurance and reinsurance • Prestigious Clientele with long-term relationships

Governance • Transparency in all dealings


Full-Service Spectrum Service Offerings

Investment Banking

Institutional Securities

Insurance Advisory and Intermediation

Debt Syndication & Advisory

Bond Trading PE Advisory

M&A Advisory

Institutional

Direct Insurance

Equities

Broking

Global Reinsurance Broking


INSURANCE & REINSURANCE


Direct Insurance Deep understanding of various product options and expertise in the portfolio analysis of the client, advisory services for selection of the right coverage.

8. Credit Insurance

8 7. Liability & Specie

1

This involved extensive analysis of existing risk profile of the corporate and ensuring a through the

2. Marine

Insurance 6. Employee Benefit Insurance

Structured, designed and placed a comprehensive Marine Stock through put insurance for a Retail conglomerate.

1.Property & Project Insurance

7 Classes Handled

6 5

4

5. Miscellaneous

Recent Transactions

2

Comprehensive Insurance

3

3.Oil & Energy Insurance

value chain

4. Aviation Insurance

Our Approach

Understanding Client Business Strategies

Risk Evaluation & Management

Structuring Insurance Programs

Seeking Quotes & Placement

Claims Handling


Reinsurance - Treaty • • •

In-depth understanding of the market to develop and design capacities for our clients and analysing rating standards of reinsurers and markets. Track record of concluding proportional & non-proportional treaties for our clients across the globe Expertise in treaty accounting and stitching complex tailormade treaty programs

Classes Handled Fire & Engineering

Marine Hull & Cargo

Oil & Energy

Aviation

Miscellaneous Accident, Medical &Health

Agriculture & Livestock

Liability

Credit

Terrorism

Recent Transactions • Designed and placed an Oil and Energy Pool for an African Based Reinsurer • Designed and placed Weather index proportional program for an African reinsurer

Our Approach

Review & Analysis

Structuring & Designing

Quotes Management

Placement

Claims Servicing


Reinsurance - Facultative • •

Expertise in structuring and placing facultative deals across Leveraging excellent relationships with rated reliable and stable reinsurers from across the globe

Recent Transactions • Designed and placed an All-Risk Policy for one of the biggest art galleries in India

Classes Handled

Oil & Energy

• Placed a standalone terrorism cover for one of the biggest oil & Energy groups in India

Terrorism

Specialty Lines

Property & Engineering

Aviation

Bonds

Marine Hull & Cargo Financial & Casualty Lines

Our Approach

Review & Analysis

Structuring & Designing

Quotes Management

Placement

Claims Servicing


Domain Expertise Our team specializes in customized reinsurance solutions across verticals which include Mega Risk

Oil & Energy

Aviation

Marine & Hull

Terrorism

Liability

Infrastructure

Specialty Lines

Treaties


They are slowly realizing that pharmaceutical companies house a treasure trove of highly valuable data such as the latest drugs and vaccines, the newest researches, as well as medical secrets and carry business using system Automation.


Cyber attacks Put Every Enterprise at Risk Most of us have heard or seen the famous quote from FBI Director Robert S. Mueller “There are only two types of companies; Those that have been hacked and those that will be hacked.�


Cyber exposure to Pharmaceutical Industry

➢ Phishing attacks and fraudulent business email compromise against the pharmaceutical sector have jumped 149 percent in the past year, making the Pharma sector the most targeted industry by hackers ➢ Drug manufacturers are a prime target given the intellectual property on medicines and new compounds, which could be profitable on dark web markets ➢ There were four times as many email-based, credential phishing attacks compared to the previous quarter ➢ India is the sixth country in the world where more and more pharmaceutical companies are being targeted by cybercriminals ➢ As per the cyber-security firm, Kaspersky, nearly 45% of Indian pharmaceutical organizations faced malicious cyber-attack attempts this year & more than four in 10 devices, were detected with malicious attempts ➢ From 44 per cent of machines infected in 2017 and a 1 per cent increase in 2018, this year's number of detected attempts shows that nearly every 5-in-10 devices inside a pharmaceutical facility are now being targeted globally



Some recent cases A leading Global Pharmaceutical company had to shell out around INR 10 Crore as hacker gains entry into their systems via VPN connection. 2 German drug maker giants has contained a cyber attack it believes was hatched in China, the company said, highlighting the risk of data theft and disruption faced by them further leading to regulatory investigations Another US Pharma giant came under the purview of Notpetya malware wherein the entire IT infrastructure was infected and encrypted leading to standstill in their business operations.


Some recent cases Hackers exploited a Vulnerability while software upgrading resulting into an entire Manufacturing facility coming to standstill

One of a mid size Contract Manufacturer succumbed to Man in the Middle Attack loosing US$ 50,000.

One of the reputed hospital in south Mumbai lost Rs 20 Lakh last year to an email from a fake account created in the owner’s name.


Organisation should be only concern on data breach‌. Ransomware is a type of malicious software that gains access to files or systems and blocks user access to those files or systems. Then, all files, or even entire devices, are held hostage using encryption until the victim pays a ransom in exchange for a decryption key. The key allows the user to access the files or systems encrypted by the program.


Facts on Ransom ware Attacks ➢ The average cost of a ransomware attack on businesses was $133,000. (Source: Sophos) ➢ 75% of companies infected with ransomware were running up-to-date endpoint protection. (Source: Sophos) ➢ A new organization will fall victim to ransomware every 14 seconds in 2019, and every 11 seconds by 2021. (Source: Cyber Security Ventures) ➢ 1.5 million new phishing sites are created every month. (Source: webroot.com) ➢ Ransomware attacks have increased over 97 percent in the past two years. (Source: Phishme). ➢ 34% of businesses hit with malware took a week or more to regain access to their data. (Source: Kaspersky) ➢ In 2019 ransomware from phishing emails increased 109 percent over 2017. (Source: PhishMe) ➢ Ransomware generates over $25 million in revenue for hackers each year. (Source: Business Insider) ➢ More than half of ransoms were paid bit coin. ➢ 50% of companies report that they do not feel as though they are adequately prepared for the threat. (healthitsecurity.com)


How cyber breach can lead to catastrophe business interruption losses? ➢ NotPetya attacked at Merck had halted production of some drugs. ➢ The attack also slowed deliveries at FedEx ➢ German consumer goods provider Beiersdorf was also hit by the attack and while it expects sales worth roughly €35 million ($41 million) to be shifted from the second quarter to the third. ➢ Disrupted port operations of Danish shipping giant AP Moller-Maersk estimates that the attack has cost it $200-$300 million. ➢ Reckitt Benckiser, the British consumer goods company that makes Nurofen, Dettol and Durex, said the attack disrupted its ability to manufacture and distribute products. It estimated that the incident could have an impact of $130 million on its revenue. ➢ Mondelez International, owner of U.K. chocolate maker Cadbury, estimated the cost of the attack at just over $150 million in lost sales and incremental expenses. The company, whose sales, distribution and financial networks were impacted by the malware. ➢ French construction giant Saint-Gobain said the attack led to downtime of IT systems and supply chain disruptions. The NotPetya attack has had a negative impact of €220 million ($258 million) on sales and €65 million ($76 million) on operating income in the first half of 2017. ➢ Taiwan Semiconductor Manufacturing Company—the world’s largest maker of semiconductors and processors—was forced to shut down several of its plants in August 2018 after it was infected by a variant of the WannaCry virus.

Impact on India ➢Two South Indian Banks ➢Two Delhi based manufacturing companies ➢One Manufacturing unit of MNC ➢Corporate headquarters of a Mumbai based conglomerate ➢Mumbai based FMGC maker ➢Computer Systems of Andhra Police, Power Companies


Potential Impact on ICS Components following Cyber Attacks Industrial Control Systems (ICS) are found everywhere-from automated machines that manufacture goods to an office building’s cooling system.

The impact of cyber attacks on industries using ICS depends on the target’s nature of operation or the motivation of cybercriminals pursuing the attack. Every effect listed below may be felt by a target’s internal, as well as external, clientele. • Changes in a system, an operation system, or in application configurations. When systems are tampered with, it may produce unwanted or unpredictable results. This may be done to mask malware behavior or any malicious activity. This may also affect the output of a threat actor’s target.

➢ Cyber attacks against ICS computers are considered extremely dangerous, as they potentially cause material losses and production downtime in the operation of industrial facilities.

• Change in Programmable Logic Controllers (PLC), Remote Terminal Units (RTU), and other controllers. Similar to a change in systems, a change in controller modules and other devices can lead to damaged equipment or facilities. This can also cause process malfunction and disabled controls over a process.

➢ In 2014 for example, a blast furnace at a steelworks in Germany was badly damaged by a cyber attack. That attack resulted in “massive damage to machinery” at the unnamed German steel mill.

• Misinformation reported to operations. This scenario may lead to the implementation of unwanted or unnecessary actions due to wrong information. Such an event can result in a change in the programmable logics. This can also help hide malicious activity, which includes the incident itself or the injected code. • Tampered safety controls. Preventing the proper operation of fail safes, and other safeguards put the lives of employees, and possibly even external clients, at risk.

➢ It comes after Norwegian manufacturing firm Norsk Hydro admitted it had lost more than $40m, in the week following a ransomware attack that crippled large parts of its control systems for its plants around the world.


Mitigating Cyber Risk ➢ Identify a company's crown jewels and allocate the highest protection to the most important/valuable data ➢ Adequately staff and budget for cyber security risk according to the value of an enterprises digital systems ➢ Constantly review the operational environment to determine the likelihood of a cyber security event and the impact it may have ➢ Make cyber security training and awareness mandatory for all personnel, and ensure that all personnel understand their roles and responsibilities with regard to cyber security ➢ Consider conducting vendor cyber security assessments ➢ Do not focus on just preventing of cyber attacks, also consider policies and procedures to detect cyber intrusion and to remove any malicious code ➢ Ensure your company consistently and frequently creates backups to safeguard information in the event of a cyber-attack ➢ Transfer of Risks - Careful consideration of available cyber insurance coverage should be part of any risk mitigation practices.




Coverage under Cyber Insurance Policy trigger point - Cyber Attack Cyber-attack means the transmission of fraudulent or unauthorized Data that is designed to modify, alter, damage, destroy, delete, record or transmit information within a System without authorization, including Data that is self-replicating or selfpropagating and is designed to contaminate other computer programs or legitimate computer Data, consume computer resources or in some fashion usurp the normal operation of a System.

First Party Loss (Direct Expense/Losses)

Third Party Loss (Legal Cost & Damages)

➢ Regulatory investigation

➢ Data Breach

➢ Fines & Penalties wherever insurable by law ➢

➢ Transmission of malicious code/Virus

Forensic Investigation Cost

➢ Denial of third party’s access to company’s network ➢

➢ Public Relation Expense

Disclosure of third-party data by an employee

➢ Notification Expense

➢ Theft of physical asset of company containing third party data

➢ Credit Monitoring Cost ➢ Data Restoration Cost ➢ Cyber Extortion including ransom payment ➢ Business Interruption Loss

➢ Multimedia Activities


Commercial Crime Insurance


Typical Crimes in Industry

Employee Dishonesty

Cyber Crime

Third Party Fraud

Robbery & Theft of Money, Securities & Property

Forgery

Fund Transfer Fraud

Cheque Forgery

At Premises

Theft

Computer Fraud

Acceptance of Counterfeit Money

In Transit

Social Engineering Fraud


Employee Dishonesty Act • Times of India employee allegedly conspires to defraud newspaper of Rs 15 crore • An employee of consumer goods maker Godrej Consumer Products Ltd or GCPL, has embezzled gold worth crore of rupees. • Wipro employee commits $4 Million fraud

• Inventory Theft • An employee steals product from a company, either by physically taking it or diverting it in some other way. • Procurement Fraud • This type of fraud includes schemes such as over-ordering product then returning some and pocketing the refund, purchase order fraud where the employee sets up a phantom vendor account into which are paid fraudulent invoices, or initiating the purchase of goods for personal use. • Overbilling • A vendor pads invoices to charge the company for more goods than it ships or to charge a higher price than agreed when done in collusion with an employee, who receives a kickback. • Payroll Fraud • A fake employee or ex-employee is kept on the payroll with pay being diverted to the fraudster. • Fake Supplier Fraud • An employee sets up a fake supplier and bills the company for good or services not provided. • Embezzlement

• Citibank India employee arrested for alleged £57m fraud

• Cheque forgery • An employee steals checks for payment to a vendor and alters the payee or forges the vendor’s signature to deposit them in his or her personal account.


Cyber Crime Acts •

Cyber criminals hacked into the current account of Harsh Goenka-led RPG Group and siphoned off Rs 2.4 crore through 13 transactions.

• Computer Fraud • When someone hacks into your computer from home (not your premises) and bypasses your firewall in order to tell your computer (your premises) to send money to the thief's personal bank account (not your banking premises). • When someone breaks into your office (your premises) and uses your computer to transfer funds from your account into his/her Swiss bank account. • Fund Transfer Fraud

A trojan malware sent via email enabled hackers to siphon off another Rs 1 crore from the current account of Mulund cosmetics company. A gang of Chinese fraudsters stole $18.6 million (Rs 130 crore) from the Indian arm of Italian company Tecnimont SpA by convincing local managers that the money was needed for an acquisition.

• When a third party somehow gains access to the Insured’s banking credentials (username, password and in many cases access to temporary PIN or token credentials), and logs in to the website or portal to instruct the financial institution to move money out of the Insured’s accounts and into accounts held by the third party. • Social Engineering Fraud • When a fraudulent party, acting as a legitimate business associate or vendor, influences an employee to transfer money or securities. • clothing company’s accounts payable manager received an email that appeared to be from a familiar overseas supplier requesting payment for an order and including payment instructions for $60,000. The company realized the email was fraudulent when the supplier called looking for payment. • Fake President Fraud • A criminal posing as a company executive convinces an employee to voluntarily transfer a large sum of money directly to the criminal’s account.


Cheque Forgery Act & Theft, Robbery or Burglary Act •

• Cheque Forgery • A resort decided to enlarge the poolside area. When a member of the finance team went to the bank to encash money for the enhancement works, he was surprised to note that only the minimum balance amount was available in the account. When he enquired further, he came to A 42-year-old woman has been awarded three year know that one of their supplier's employee had forged the Finance imprisonment for misappropriating cheques of a Manager's signature & withdrawn the money from the bank. leading travel company she was working in and forging them to purchase jewellery worth over Rs 17 lakh 20 years ago. • Theft or Robbery of Money, Securities & Property A gang of seven robbers, wielding knives and chopper, • An employee at the cash counter is being held at gun point and is being robbed the office of the ATM cash handling company robbed of the cash here and decamped with nearly Rs 9.16 crore. he • The account manager of a firm based in Hyderabad was to hand over Rs. robbers kept the three security guards and staffers at 63 lakhs cash to a supplier in Chennai. He withdraws the money from the gun-point while some of them stacked off the cash. bank in the evening, keeps the money at his home that night as he was Two robbers on a bike barged into a South Indian gold supposed to board the early morning flight the next day. A burglary finance Begampul branch in Meerut and decamped happens at his house that night & the money is stolen. with 15 kg gold estimted to be over Rs 4.5 crore. • In a actual or attempt robbery/burglary, burglars/robbers break down the door or damages any other property, all are covered. A person who allegedly forged a cheque of a south Mumbai-based event management and trade fair organising company and withdrew Rs. 5.85 Lakh through from the firm’s account.


Crime insurance is designed to protect the direct financial loss suffered by a company arising from any employee fraud or a dishonest act of a third party and is a key component of risk management strategy against crime loss.


CRIME INSURANCE COVERAGES

Employee Theft

Premises

Transit

Depositors Forgery

Computer Fraud

• Losses from dishonest Act of employees working alone or in collusion with third party - which would result in Direct financial Loss to company.

• Losses from destruction, disappearance, wrongful abstraction or computer theft of money or securities from the Insured’s premises by third parties

• Losses from disappearance, destruction of money or security outside the insured’s premise by a third-party while being conveyed.

• Losses from instruments such as cheques fraudulently drawn on the Insured’s accounts by a thirdparty

• Losses resulting from the fraudulently induced transfer of money, securities or property through the use by a third party of a computer network • Fund Transfer Fraud

32


EXTENSIONS • Social Engineering Fraud • Fake President Fraud • Care, Custody and Control • Court Attendance Cost • Credit Card Fraud • Data Reconstitution Costs • Extortion • Interest • Investigation Costs • Loss Investigator • New Subsidiaries • Legal Fees 33


Our Clients


Strong Corporate Relationships Infrastructure

Auto

Real Estate

Financial Services


Thank You Prathamesh Gangnaik +91 9769870161 Prathamesh.gangnaik@pincinsure.com http://www.pincinsure.com


Contact Us Corporate Office: MUMBAI 1218, 12th Floor, Maker Chamber V, Nariman Point, Mumbai 400 021. Tel: +91 22 6618 6400 / 022-6618 6633 Fax: +91 22 6618 6623 DELHI 812, 8th Floor, Kailash Building, 26, Kasturba Gandhi Marg, Connaught Place, New Delhi- 110 001. Tel: +91 11 4516 6705 Fax: +91 11 4516 6704

KOLKATA Flat No.GF-1, Ground Floor, Block B, Tivoli Court, 1C, Ballygunge, Circular Rd, Kolkata - 700 019. Tel: +91 33 4064 7970 Fax: +91 33 4064 7971

BENGALURU

CHENNAI

No.105 - 105A, Prestige Terminus 1, 1st Floor, Old Airport Exit Road, Bengaluru - 560 017. Tel: +91 80 2522 0110

Vasanth Business Centre 86 TTK Road, Alwarpet, Chennai 600 018. Tel: +91 44 4214 2914 Fax: +91 44 4214 2914


Disclaimer The information and material provided in this presentation do not constitute an offer or solicitation for the purchase or sale of any security and financial instrument. The information may be obtained from various sources and PINC and/or its affiliates do not represent that the information is accurate or complete, and it should not be relied upon as such. PINC accepts no liability whatsoever for any direct or consequential loss arising from the use of this material or its contents. All estimates and opinions provided herein constitute the original researcher’s judgment as of the date of the report and may be subject to change witho ut notice. PINC will not be responsible for the consequences of reliance upon any opinion or statement contained herein. The returns on the products discussed in this material are not guaranteed by any bank unless specifically stated and are subject to investment risks, including possible loss of the principal amount invested. An investment in any product should be made only after careful study of the most recent sales prospectus, term sheets, relevant fund regulations and basic legal information contained therein. Furthermore, investments in foreign currencies are subject to exchange rate fluctuations. Before entering into any transaction, you should consider the suitability of the transaction to your particular circumstances and independently review (with your professional advisors as necessary) the specific financial risks as well as legal, regulatory, credit, tax and accounting consequences.


Issuu converts static files into: digital portfolios, online yearbooks, online catalogs, digital photo albums and more. Sign up and create your flipbook.