How Does Your Industry Shape the Real Cost of Cybercrime?

Cyber attacks affect every industry, but the nature of the exposure varies significantly from sector to sector. Healthcare organizations must protect sensitive patient records and maintain operational continuity, while manufacturers face risks tied to operational technology and supply chain disruption. Retailers handle large volumes of customer payment data, making them prime targets for breaches, while financial institutions face intense regulatory scrutiny alongside the threat of sophisticated cybercrime.

“The public sector is at significant risk from a cybersecurity standpoint,” said Spencer Timmel, Head of Cyber Insurance at Safety National. “Municipalities, schools and similar public entities do not have the funds that private companies typically have. From that standpoint, they rely on legacy systems with sometimes outdated security tools and are therefore more vulnerable to cybersecurity threats — ransomware, improper disclosure of data, and similar risks.”

In the face of such differing cyber challenges, coverage has evolved to adapt to each sector’s individual needs.

Healthcare-Targeted Attacks and Patient Care

Many of the largest claims are tied to ransomware targeting clinical systems or events that directly impact patient care. If systems go down and hospitals are forced to shut down emergency rooms or divert patients to competing facilities, they lose the ability to deliver care.

From a hospital perspective, patient care is always top of mind; however, there is also the potential of major liabilities if people do not receive the care they need or if outcomes worsen due to a cyberattack. The impact may be both clinical and financial. In many other industries, losses are primarily financial, but healthcare introduces a much higher level of risk, which is why threat actors often target healthcare entities. Cyber criminals know organizations are more likely to pay ransom demands when patient care is involved.

Manufacturing and Supply Chain Concerns

In manufacturing, the focus shifts from traditional IT environments to operational technology (OT), including systems in warehouses, industrial control systems and production environments. Here, cyber incidents can shut down production lines, damage equipment, or disrupt global distribution — all of which carry major financial consequences.

Customer expectations have changed dramatically over the last five years, with products expected to arrive within a couple of days and sometimes within hours. Any disruption in the supply chain can have a tremendous impact on an organization’s reputation.

Customers may opt to purchase from a competitor due to a delay caused by a cyber incident and may not return, making cybersecurity critical for protecting both operations and reputation.

In retail, key risks include improper data collection, payment card data exposure and consumer privacy issues. While point-of-sale breaches have become less common, disruptions to e-commerce platforms can still be highly damaging. And, if a retailer cannot sell products online, the financial and reputational impact can be significant.

Another growing issue in retail is improper data collection, particularly related to pixel tracking technologies. These tools collect user information, often tied to IP addresses, for marketing purposes, but are not always properly disclosed — which in turn has led to a rise in privacy-related class actions, especially in the U.S. under wiretapping and similar legislation. And these claims are increasing rapidly.

In financial services, the primary concern is the movement of money. Threat actors often target wire transfers, attempting to redirect funds. Additionally, this sector is highly regulated, which brings increased regulatory oversight, fines, and penalties. There are also more class actions as a result of violating certain regulations.

Coverage Considerations for Interconnected Risks

When it comes to healthcare coverage specifically, there are generally two major areas of concern, the first is the improper disclosure of data, where insurers have developed strong solutions to handle regulatory investigations, violations (such as HIPAA), and associated liabilities.

The second area is operational disruption, particularly clinical downtime. In ransomware situations, the focus is on restoring systems quickly, facilitating ransom payments where necessary, and addressing business interruption. As such, coverage has evolved to include contingent business interruption, where losses occur due to outages at third-party providers. For example, if a key medical device supplier or electronic medical records provider experiences a disruption, it can directly impact a hospital’s ability to operate and generate revenue.

In manufacturing, one major concern is reliance on a single supplier. If a critical component is sourced from only one provider and that provider is disrupted, it can halt production, and this risk is greater in highly technical or specialized manufacturing environments where components are harder to replace. This concept, often referred to as a “single point of failure”, applies across industries. Whether it is a hospital relying on one electronic medical records provider or a manufacturer depending on a single chip supplier, these dependencies are key considerations in both risk management and underwriting.