Marsh McLennan’s Guy Carpenter: Business email compromise – a potentially devastating yet often overlooked cyber threat

New York, July 9, 2024 - While the cyber insurance market may categorize business email compromise (BEC) claims as more attritional and frequency-driven, a new report from Guy Carpenter, a leading global risk and reinsurance specialist and business of Marsh McLennan, sheds light on the potentially devastating financial consequences of this often-overlooked threat.

The report, Cyber's Sleeper Threat: Business Email Compromise, was published in conjunction with Marsh McLennan's Cyber Risk Intelligence Center and investigates the threat and impact of BEC attacks - sophisticated forms of phishing that exploit human vulnerabilities rather than technical weaknesses. In these scenarios, attackers impersonate trusted entities to deceive employees into transferring funds, making it difficult for traditional security measures to detect and mitigate the risk effectively.

An analysis of Marsh's proprietary claims database over the last five years found more than 550 successful BEC events impacting Marsh clients with either a cyber or crime insurance policy in place. Of these events for which loss data is available, the report reveals the greatest number have a loss around 0.1% of the company revenue. For a company with $1 billion in revenue that amounts to a $1 million loss.

Despite the considerable financial threat, commercially available cyber vendor models have mixed approaches as to whether BEC claims should be accounted for in their catastrophe event catalogue, the report says. The report found that only one industry-leading vendor has incorporated BEC as an explicit cyber peril into its models.

"Cyber threats such as ransomware attacks, zero-day vulnerability exploits, and cloud service provider outages dominate the headlines. The consequences of a successful BEC attack, however, can also be devastating for an organization and create large losses for cyber (re)insurers," said Erica Davis, global co-head of cyber, Guy Carpenter. "By driving awareness of the right cybersecurity measures, we can collectively improve the resilience of organizations against BEC threats and mitigate its impact on underwriting profitability."

About Guy Carpenter

Guy Carpenter & Company, LLC is a leading global risk and reinsurance specialist with 3,500 professionals in over 60 offices around the world. Guy Carpenter delivers a powerful combination of broking expertise, trusted strategic advisory services and industry-leading analytics to help clients adapt to emerging opportunities and achieve profitable growth. Guy Carpenter is a business of Marsh McLennan (NYSE: MMC), the world's leading professional services firm in the areas of risk, strategy and people. The company's more than 85,000 colleagues advise clients in over 130 countries. With annual revenue of $23 billion, Marsh McLennan helps clients navigate an increasingly dynamic and complex environment through four market-leading businesses including Marsh, Mercer and Oliver Wyman. For more information, visit www.guycarp.com and follow us on LinkedIn and X.