A single cyberattack that affects major ports across Asia-Pacific could cost US$110 billion, which is roughly equivalent to half of all losses from natural catastrophes globally in 2018.
These losses could occur in an extreme scenario in which a computer virus infects 15 ports across Japan, Malaysia, Singapore, South Korea and China, according to the report – ‘Shen attack: Cyber risk in Asia Pacific ports’ – produced by the University of Cambridge Centre for Risk Studies, on behalf of the Cyber Risk Management (CyRiM) project.
The report depicts a plausible scenario in which a cyberattack is launched via a computer virus carried by ships, which then scrambles the cargo database records at major ports and leads to severe disruption.
Although in this scenario the virus only directly affects ports in Asia-Pacific, economic losses would be felt around the world due to the global interconnectivity of the maritime supply chain, through reduced productivity and consumption, incident response costs, and supply chain disruption.
The scenario estimates that:
- Transportation, aviation and aerospace sectors would be the most affected ($28.2bn of economic losses in total), followed by manufacturing ($23.6bn) and retail ($18.5bn).
- Productivity losses affect each country that has bilateral trade with the attacked ports.
- Asia would be the worst affected region, set to lose up to $27bn in indirect economic losses, followed by $623m in Europe and $266m in North America.
Despite the high costs to business and international trade, the report shows the global economy is underprepared for such an attack with 92% of the total economic costs uninsured, leaving an insurance gap of $101bn.
Other key findings from the report included:
- The transportation sector in Singapore would take the biggest economic hit, followed by the same sector in South Korea.
- ‘Business interruption’ and ‘contingent business interruption’ insurance coverages would be the main drivers of the insured losses (60% of the loss in the most extreme version of the scenario).
- Non-affirmative cyber, meaning cyber risk that is not explicitly mentioned in an insurance policy, would account for up to 57% of the total insured losses.
- The primary categories of policyholders that would make claims in this scenario are port operators (50% of insured losses), companies along the supply chain (21% of insured losses), and logistics and cargo handling companies (16% of insured losses).
- There are opportunities for insurers and policyholders to expand their view of cyber risks ahead of the next event and the report helps to inform in a way to support new products, services and mitigation strategies that make businesses and communities more resilient.