Bodily injury
Harm to the physical integrity of a person, irreversible and heavily indemnified, which distinguishes the serious claim from mere material damage.
In July 2019, during the ransomware attack that crippled Springhill Medical Center in Alabama, a baby girl was born with severe brain injuries. Her mother's lawsuit, amended after the child's death in April 2020, blames that bodily injury on the attack. Bodily injury is harm to the physical integrity of a person, wound, worsening of a condition or death, as opposed to material damage to property. For the insurer it has two singularities: it is irreversible, and it follows entirely different indemnification rules, founded on human harm, with amounts that are both heavier and more uncertain. This register breaks into hospital cyber insurance, a domain that thought itself purely immaterial: ransomware paralyzes care, causes excess mortality and opens the way to medical-malpractice actions. The tail of the distribution then sits in this bodily injury rather than in the ransom, and models designed for data breach cannot price it.
Textbook case: a cyberattack that delays a vital operation and leads to a patient's death turns a computer claim into bodily injury, whose indemnification far exceeds the cost of the ransom.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.