Cyber spotlights on the land transportation industry: Identify, assess, protect

This spotlight delivers an overview of the latest cyber risks impacting the sector generally, including recent incidents and emerging threat vectors. We also highlight our insurance solutions that can address the cyber vulnerabilities faced by land transportation organisations. Read more from our insights to help enhance your organisation’s cyber risk management approach.

What cyber incidents have we seen from the transportation industry?

Cyber insurance claims we have seen from the land transportation industry

The following anonymised examples show recent claims handled by WTW’s claims team:

Ransomware

The insured informed their cyber insurers that eighty percent of their network was encrypted due to a ransomware attack. The insured disconnected the environments and began an investigation which revealed that several back-up files were corrupted. The insured worked with cybersecurity experts to remove the virus and restore systems. The insured received a large number of claims from its customers for the losses they incurred due to system downtime. The insured appointed legal, forensic, cybersecurity, public relations and incident response vendors to assist.

Accidental data breach

The insured's accounts receivable area accidentally made hundreds of customer email addresses available to other customers, as a result of accidentally sending a group email using the ‘to’ rather than ‘blind carbon copy’ section of the email address bar. The reason for the email was a change in procedures and was intended to be solely for information purposes. The insured was formally contacted by several customers expressing concerns. The insured reported this incident to the regulator, as required under the mandatory notifiable data breach scheme and a formal email was being drafted to be sent to the affected parties.

Social engineering

Multiple spoofed emails were sent to the Human Resource department of a subsidiary, purporting to be from various senior personnel. The emails requested a change of the personnel’s direct deposit account, which were subsequently made, and wage payments were deposited in accounts controlled by fraudsters.

Source: WTW proprietary claims data

NIS 2 imminent: The NIS 2 Directive must be implemented by European Union (EU) member states by 17 October 2024. The Directive aims to achieve a common level of cybersecurity across the EU, imposing stricter cyber-security requirements with regard to risk management, incident reporting and the exchange of information. It comes in response to the escalating threats brought on by digital transformation and the rise in cyber-attacks, and replaces the Network and Information Security (NIS) Directive of 2016, which will be repealed with effect from 18 October 2024.

Like the 2016 Directive, the new directive will inevitably be mirrored by the EU’s closest trading partners including the UK and those members of the European Economic Area (EEA) who are not already members of the EU (eg Norway). It bears other similarities to the 2016 Directive, laying down obligations that require Member States to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity, and computer security incident response teams (CSIRTs). Essential sectors – including air transportation and space - will be covered by the Directive.

In order to achieve greater harmonisation than was the case with the 2016 Directive, NIS 2 sets out minimum rules for a regulatory framework and lays down mechanisms for effective cooperation among relevant authorities in each Member State. It formally establishes the European cyber crisis liaison organisation network (EU-CyCLONe), which will support the coordinated management of large-scale cybersecurity incidents and crises at the operational level and ensure the regular exchange of relevant information.

Read more here arrow_forward

WTW Insight: Road and rail companies throughout Europe and the UK who previously navigated the regulatory challenges posed by the 2016 NIS Directive, will now need to recalibrate so as to comply with their obligations under NIS 2. Whilst in some cases the burden will be greater, it is hoped that the greater uniformity and clarity in the new Directive’s requirements will avoid some of the frustrations experienced in attempting to comply with the 2016 Directive’s sometimes vague and nebulous provisions.

Our perspective on cyber market trends for the land transportation industry

How WTW can help with identifying, assessing, and protecting your business