County to Consider Increase to Cybersecurity Insurance

Jan. 30--Amid an increase in cyber attacks on municipalities across the country, Lewis County is considering upping its insurance coverage to provide greater security in the event of a breach.

"A multi-million dollar hit to Lewis County could set us back a generation," said IT Services director Steve Wohld. "We feel that the increase of attacks that we're seeing across the country and the relatively low cost of increasing the premium justifies the consideration."

Currently, the county is part of a 26-member risk pool run through Chubb Insurance. The agencies in the pool share $5 million in coverage, with each entity only able to claim $1 million at most. That payout may also be unavailable if other agencies are struck with attacks and make their insurance claims first.

On average, Wohld said, a data breach from a local government costs about $3.5 million, though numbers can fluctuate greatly. Much of that is compensating local citizens for the costs associated with having their identity or personal information compromised.

With that in mind, Wohld and Wayne Whiton, the county's risk and safety administrator, have put together a plan to bolster Lewis County's cybersecurity coverage. The new policy would be in addition to the risk pool, and also purchased from Chubb. For an additional $20,000 a year, it would provide the county with $4 million more in coverage.

"This is a moving target," Whiton said. "Staying ahead of these organizations and this criminal activity is a challenge."

In a meeting with county commissioners, Wohld referenced the recent ransomware attack that recently compromised government services in the city of Sammamish. Ransomware hackers typically gain entry to a user's computers, take over the system and then demand payment to restore access.

Lewis County does not have an official policy on paying hackers who steal government data.

Though the proposal to increase the county's coverage was in the works long before the Sammamish attack, it illustrates the danger the county would face if it were to suffer a data breach.

"From IT's perspective, we like the policy, we would like to pursue (increased insurance)," Wohld said. "It's within the reasonable amount of what a breach would cost."

Commissioners acknowledged that cybersecurity is a serious issue, and pledged to consider the proposal. Whiton said they're looking at "all options" for implementing the increase, which may include a budget amendment.

"We presented it to the commissioners, and it's on their plate," he said.

___

(c)2019 The Chronicle (Centralia, Wash.)

Visit The Chronicle (Centralia, Wash.) at www.chronline.com

Distributed by Tribune Content Agency, LLC.