An increase in cyberattacks on casinos, hotels, and other businesses has reduced the availability of cyber insurance and substantially increased premiums and deductibles, prompting some to look at self-insurance. That daunting message was delivered by Lance Ewing, Vice President of Enterprise Risk Management and Operations for the San Manuel Band of Mission Indians, who spoke at TribalHub’s second annual virtual summit on cybersecurity.
Cyber security continues to grab headlines for both commercial and tribal casinos that have been hacked, had customer data stolen, and in some cases had to close temporarily. The problem for tribal casinos has gained prominence more recently, with the Indian Gaming Commission reporting in 2021 that cyberattacks jumped 1,000% since 2019.
“If you’re in Las Vegas or a resort area, you’re not an attractive risk for the insurance industry,” said Ewing, who added some carriers are dropping hotels and casinos altogether. “It doesn’t matter if you’re Marriott, Hilton, or Disney. There’s no love in the cyber world for us right now.”
If properties don’t have cyber insurance, it’s not a question of if, but when, they’ll be hit by hackers, Ewing said. “Every day, someone is trying to get your information,” Ewing said. “It doesn’t matter if you’re a large or small tribe or entity. They’re knocking on all of our doors.”
In 2019, there were reports of MGM Resorts being hacked and making data available on more than 10 million guests. In May, reports surfaced of hackers dumping tens of millions of customer records on Telegram that included names, email addresses, phone numbers, and birth dates.
“Hackers are getting smarter and they’re looking at the vulnerable for exposure and see the casinos, resorts, and hotels as easier targets,” Ewing said. “Underwriters see this on the front pages and every time something bad happens, they keep trying to add zeros to your insurance premium. The average risk insurance payment is up 82% in one year. … As to when this will end and when we will stop seeing these increases are not in sight.”
For many properties, those premium increases are even higher, Ewing said. Rates are rising even if properties don’t have claims, with one of his colleagues in manufacturing citing a 200% increase. It’s a tough marketplace to explain to tribal leaders and executives, he said.
“This is a huge topic, not just in the tribal world, but also in the outside world,” according to Ewing, who has spent most of his career in insurance and risk management. “This is one of the toughest markets I’ve seen in my entire career. I’ve been through property with Hurricane Katrina and (other natural disasters), workers compensation when it went through the roof, general liability, and auto liability when they weren’t writing, especially with public entities. This current cyber situation has become untenable.”
Ewing said he was at a Las Vegas property last week and had an hour-long discussion, of which 50 minutes were devoted to cyber insurance.
“The field is narrowing as to how many insurance carriers are saying yes and want to write your business,” Ewing said. “They’re not interested in hotels, casinos, or dealing with tribal law. … As much as you’re doing, you’re just a hamster on the wheel, running to keep up with what the insurance carriers are expecting in the current marketplace.”
The amount that companies will insure for has come way down, Ewing said. In the past, companies could get $25 million in cyber insurance, but today it’s even difficult to get $5 million to $10 million in coverage. Even then, insurers are limiting coverage, he added.
The problem developed years ago, when a lot of insurance companies saw an opportunity to write cyber business without doing the underwriting that was necessary, Ewing said. “They didn’t understand the risk and got burned. They had to shell out more money, which insurance carriers aren’t used to. They’re used to taking in more in premiums and having a profit.”
Even if casino operators and other entities are willing to increase their deductibles from $250,000 to $500,000, that’s not enough to make a dent in premiums, Ewing said. They would have to increase it to $2 million to get that.
Casinos and other businesses continue to be frustrated by what they’re facing, with carriers waiting until the last minute to provide a quote on renewals. That backs properties into a corner to pay it. Those that haven’t had any problems are especially frustrated by increases or being dropped altogether.
“Even if I’m pure as the driven snow and not a huge target, it won’t matter,” Ewing said. “Certain industries, like hotels, casinos, restaurants, and retail, are considered risks. You may have been with carriers for three, five, or seven years and you can’t take it personally. It’s the nature of where we are right now in the industry.”
