Insurers will not cover stores’ cyberattack-related property damage

Retailers would have to bear any property damage caused by a cyberattack themselves, ERR reported. Insurance expert Helen Evert said property insurance excludes such losses, while cyber insurance covers damage related to information systems and data.

A cyberattack on Selver grocery stores on Monday caused no significant damage. Evert, a cyber insurance expert at IIZI, said businesses should keep funds available for crises and be prepared to cover this type of loss themselves. She said similar exclusions apply in international insurance markets.

Whether Estonian insurers begin offering this kind of cover depends on the international market, Evert said. If they do, premiums are likely to rise as attacks become more frequent, although the size of any increase is difficult to predict.

Coop IT director Kaspar Hioväin said store security was the retailers’ responsibility. Although Coop was not targeted, the chain reviewed its security systems. Hioväin identified third-party maintenance providers as a key risk, saying companies responsible for equipment such as refrigeration and security systems may lack cybersecurity expertise.

Erki Sirel, head of the Estonian Refrigeration Association, said he did not consider it common for maintenance providers to install equipment or use a network without first consulting its owner. He said companies coordinate with one another over which networks can be used.

Rimi and Lidl declined to comment. Selver said it would not disclose further security plans.