Navigating Automotive Cybersecurity Risks: Key Insights for Insurers

As the automotive industry undergoes a profound transformation driven by software-defined vehicles and connected ecosystems, new cybersecurity risks are emerging at an unprecedented scale. For insurers, understanding these risks is critical to assessing liabilities, determining premiums, and managing claims. This article explores the most pressing cybersecurity trends in the automotive sector, focusing on their implications for auto insurers as they navigate the complexities of connected vehicles in 2024.

1. Escalating Scale of Cyber Attacks and Insurance Implications

The number of large-scale cybersecurity incidents affecting the automotive sector has grown significantly over recent years. By 2023, nearly 50% of attacks had a "High" or "Massive" impact, affecting thousands to millions of vehicles and mobility assets. These incidents include ransomware attacks that disrupt fleets and telematics systems, potentially leading to operational delays and high costs for insured entities.

For insurers, this trend presents new challenges in calculating premiums and managing risks associated with connected vehicles. The financial impact of cyber incidents on businesses, whether in terms of ransom payments or service disruptions, must now be factored into coverage assessments for both individual consumers and commercial fleet operators.

2. Remote Attacks: A Growing Threat to Insurers

By 2023, 93% of automotive cyberattacks were conducted remotely, with 85% of these targeting APIs, mobile applications, and telematics systems. The increasing reliance on digital infrastructure and over-the-air (OTA) updates has made vehicles more vulnerable to cyberattacks, which can compromise sensitive vehicle data, customer information, and even the control of vehicles themselves.

From an insurance perspective, the rise in remote attacks creates new exposures that must be addressed through enhanced cyber liability policies. Insurers will need to consider data breaches, vehicle manipulation, and service interruptions in their risk models, particularly as they impact large commercial fleets that rely on telematics for logistics.

3. The Rising Cost of Cyber Attacks for Insurers

The financial repercussions of automotive cyber incidents can be severe. In 2023, a $70 million ransom demand was reported, marking one of the largest automotive-related ransom demands in history. Additionally, widespread recalls or over-the-air (OTA) updates) to fix cybersecurity vulnerabilities have become common, presenting insurers with the challenge of managing claims related to these incidents.

• A commercial fleet operator facing a ransomware attack may suffer not only the direct financial impact of the ransom but also the downtime and disruption caused by service outages.
• The cost of data breaches, where personal identifiable information (PII) and vehicle data are compromised, can lead to hefty fines and penalties for companies.

4. The Growing Threat to EV Charging Infrastructure and Insurers

Electric vehicles (EVs) and their associated charging infrastructure are becoming key targets for cybercriminals. Vulnerabilities in charging stations and their network interfaces have been exposed, leaving millions of charging points susceptible to attacks.

For insurers, the risks associated with EV charging infrastructure go beyond vehicle theft. API exploitation could lead to widespread operational disruption, creating a direct impact on consumers and commercial operators. Cyber policies for EV owners and charging station operators must evolve to address these emerging threats.

5. Data-Driven Risk Assessment in Automotive Insurance

With vehicles now acting as data generators, capturing everything from telematics to driving patterns, insurers have a wealth of information to aid in risk assessment. However, this also makes vehicles and their systems attractive targets for cybercriminals seeking to exploit sensitive data.

The theft of vehicle data or manipulation of telematics systems could have wide-reaching consequences for claims and policy assessments. As the automotive industry increasingly relies on these data-driven technologies, insurers must adopt more sophisticated cyber risk models to evaluate potential liabilities.

Key Takeaways for Insurers

• Cyber liability policies must be enhanced to cover the full scope of risks associated with connected vehicles, from remote attacks to ransomware incidents.
• Commercial fleets and EV charging infrastructure are particularly vulnerable and should be prioritized in risk assessments and policy updates.
• Insurers need to leverage data-driven insights from telematics and connected systems to better evaluate premiums, claims, and risk models in a rapidly evolving automotive landscape.

Conclusion

As we move deeper into 2024, insurers must adopt a proactive stance on automotive cybersecurity risks. By understanding the scale and nature of these threats, insurers can better tailor their policies and risk assessments to meet the challenges posed by a connected, software-driven automotive industry.

Sources

1. National Vulnerability Database (NVD): Tracks known vulnerabilities, including those impacting automotive systems. NVD Vulnerability Metrics
2. Common Vulnerabilities and Exposures (CVE): Provides detailed analysis of API and telematics vulnerabilities. CVE Database
3. National Highway Traffic Safety Administration (NHTSA): Offers best practices and guidelines for automotive cybersecurity. NHTSA Cybersecurity Best Practices
4. European Union Agency for Cybersecurity (ENISA): Publishes annual threat landscape reports, covering automotive cybersecurity. ENISA Report
5. OWASP API Security Top 10: Provides detailed information on API vulnerabilities, widely exploited in the automotive sector. OWASP API Security Top 10