Baltimore to purchase $20M in cyber insurance as it pays off contractors who helped city recover from ransomware

As costs from this spring’s ransomware attack on Baltimore continue to come due, officials are set to buy $20 million in cyber liability insurance to cover any additional disruptions to city networks over the next year.

A pair of coverage plans, the result of a competitive bidding process involving 17 carriers, was approved by the Board of Estimates on Wednesday.

The first plan, for $10 million in liability coverage from Chubb Insurance, will cost $500,103 in premium. The second, for $10 million in excess coverage, will be provided by AXA XL Insurance for $335,000.

The plans hold a $1 million deductible, officials said.

The term of the coverage is one year, though Lester Davis, a spokesman for Democratic Mayor Bernard C. “Jack” Young, said the expectation is that the city will maintain cyber insurance in future years, as well.

“The city is going to reassess every year,” Davis said. "They will have to go through this process again when the terms are nearing maturity.”

In the May attack, hackers gained access to city systems, encrypted files using ransomware and then demanded payment for the decryption keys, which Young refused to pay. The attack crippled many systems, disrupting employees’ email service, halting water billing and suspending real estate transactions.

City officials previously said that the attack would cost more than $18 million, although much of that was in estimated lost productivity and some has been clawed back with the recovery of systems, such as the water billing system.

In addition to business interruption costs, the insurance package will cover digital data recovery, “network extortion" and a team to investigate attacks, officials said.

The board previously approved a $10 million supplemental budget for costs associated with the attack.

Also approved Wednesday were a slate of payments -- more than $3.7 million in all -- for contractors who were called into the city after the attack to help the city get back on its feet. That funding will be drawn from the previously approved supplemental budget.

The largest payment would be $1.3 million for “enhanced detection and remediation services," which will continue through the end of the year, from Mandiant FireEye. Another $816,613 will go to Seculore for network monitoring; $771,708 to Crypsis for forensic services; $384,588 to Dyntek to rebuild Microsoft products; $311,261 to Clark Hill for response plan assistance; $150,000 to Deloitte for evaluation services, and $43,200 to Dysis Solutions for a network engineer.

In addition, the board approved an additional $300,000 for Crypsis to continue working for another 130 calendar days. That noncompetitive procurement was justified by the fact that the company has experience with the system it is working on that no competitor would have, officials said.

“The contractor was brought on board during the ransomware event for support and other tasks. During this time, the contractor was able to identify risks and provide remediation suggestions based on the city’s environment,” the board’s agenda said. “As a result, the contractor obtained unique familiarity with [the city’s] network current environment.”

The new contract “will provide the necessary evaluation of current security policies and procedures, identify gaps, and provide recommendations to assist the city’s cyber program to maturation,” the agenda states. “Otherwise, the city would be at risk if another cyber event were to take place.”

Davis said he does not know how having insurance will impact future decisions on how to deal with hackers, including whether to pay them, if the city were attacked again.

“We’ll consult with the appropriate law enforcement officials and make the best decision for the city and the taxpayers,” he said. “The insurance is not just for paying ransoms.”

He said the city hopes to avoid ever being in such a position, and that the work before the spending panel is part of a robust effort to harden the city’s system’s against any future attacks over the next 12 to 18 months.

___

(c)2019 The Baltimore Sun

Visit The Baltimore Sun at www.baltimoresun.com

Distributed by Tribune Content Agency, LLC.