From hacker attacks to shareholder lawsuits, insurance industry braces for COVID-19 fallout

There's a growing consensus among industry experts that insurance policies won't cover pandemic revenue losses for the vast majority of shuttered or hobbled businesses in Canada.

But the insurance industry faces looming waves of separate perils in the form of policies that cover hacker attacks and shareholder lawsuits related to COVID-19 losses.

"I understand everybody wanting to shake every tree and see what money they can get from it," said David Mackenzie, an insurance lawyer with the Toronto firm Blaney McMurtry LLP.

"The business interruption part of the forest I don't think is going to result in a lot of money but " other claims will arise that are more clearly within the scope of the insurance that the market is providing."

For example, Mackenzie says so-called "cyber" insurance policies taken out by many companies could clearly be taxed heavily by the pandemic.

Because so many people are working from home during the pandemic, computer hackers have far more opportunities to break into systems, he says - doing damage that cyber policies clearly insure.

"When you're in the office it tends to be secure, or if you're set up well to work from home," he said.

"But there has been such a rush to add everybody and their home computers and their cellphones and their own devices to the system " that security levels have gone down."

A recent cyber industry report said hackers could stay in your system for nearly 200 days before they'll give away their presence, Mackenzie says.

"And so down the road there may be an enormous spike in things like ransomware claims and other forms of cyber-breach claims," he said.

"And I think everybody is sort of seeing the potential tidal wave of those sorts of issues once the hackers have taken everything they want out of people's computer systems."

Toronto lawyer Marcus Knapp agrees, saying there are far more opportunities for hackers and far less IT supervision with millions working from home.

"If people are remoting in you've got a lot more windows for hackers " to gain access to what would other wise be secure facilities," said Knapp, an insurance expert with the firm Ricketts Harris LLP.

"And these aren't claims that would be subject to virus exclusions because they're not driven by the virus," he said.

Mackenzie says there are also likely to be privacy issues that could tax insurance companies through lawsuits brought against governments and companies.

"If we really do go down the road of having to track people and trace people " it's not just the hacking scenarios that are covered by cyber policies," he said.

"It's also if you breach somebody's privacy rights and they sue you, that can trigger coverage as well."

Mackenzie says company directors may face lawsuits in the coming months from shareholders blaming poor management for their losses - lawsuits that could lead to vast liability-insurance payouts.

"Are the decisions they are making now exposing them (boards of directors) to lawsuits from shareholders for the crash in share prices," Mackenzie said.

"That's insured under directors and officers liability policies," he added.

Despite a class-action suit launched recently on behalf of business owners in Saskatchewan, claimants will have an uphill struggle to pry money out of insurance companies for their COVID-19 interruptions, Knapp says.

Unless there is specific language listing pandemics - as is the case with most Canadian dentists - then lawsuits seeking insurance payouts on property policies are likely to fail, he says.

"It has to be tied to physical damage, and so the big question in all of this is, 'Does the virus constitute physical damage?' " he said.

"That's going to be the big line of attack, or the big focus for any litigation over coverage in that area - does the virus constitute physical loss."

In a written statement to the Star, Insurance Bureau of Canada spokesperson Steve Kee said most policies do not cover business interruptions caused by the viral emergency.

"Generally, commercial insurance policies and traditional business-interruption policies do not offer coverage for business interruption or supply-chain disruption due to a pandemic such as COVID-19," Kee wrote.

Mackenzie says the entire industry would likely go broke if pandemic business- interruption claims had to be paid out.

"The belief among most lawyers and most brokers - so more or less both sides of the equation - is that it is only going to be the very rare business-interruption claim that might thread the needle here," he said.

"Just because this wasn't what anybody had intended these things to do. The terms of the coverage that is being granted under are fairly narrowly drafted to meet certain circumstances, and this just isn't it."

Most policies only cover physical damage due to floods, fires and accidents, and a virus doesn't make that obvious and tangible grade, Knapp adds.

Still, Knapp expects to see a slew of lawsuits testing the insurance industry's general business-interruption denial policy in the courts.

He also expects to see lawsuits by employees who get sick after their companies ordered them into work - something that liability insurance might be made to cover.

That doesn't mean insurance companies won't be facing a spate of undeniable damage claims as shops and factories sit closed and empty, Mackenzie says.

"If you have a building that isn't occupied or is less occupied, that is inherently a higher risk for loss," he said.

"Whether it's fire, whether it's breakdowns, whether it's break-ins, I think if this goes on much longer, actuarially all insurers would expect to see a rise in property claims."