Blog

Ransomware Threats in Commercial Real Estate – A Common Cyber Threat

Looking for strong insurance content that is specifically written for your expertise and clientele?

This is an example of content we recently wrote for a Commercial Real Estate Insurance client:

Ransomware threats in commercial real estate are increasingly a concern for real estate portfolio owners and managers. Ransomware is a type of malicious code infecting your computer. It prevents access to your own computer files, usually until you pay a ransom. Restoring your computer’s system and files may successfully combat a ransomware attack. However, many businesses and municipalities pay the ransom to regain access to their information. If ransomware strikes your computer system, you will have to decide whether to pay a ransom or restore your computer. However, payment is never a guarantee that you will regain access to your files.

Signs of a Ransomware Attack

According to CoreLogic, infected sites cause most ransomware attacks. Someone who has access to your system, often an employee, accesses an infected site. Anti-virus software developers have made infected emails rare. However, browser security flaws can lead to ransomware hacks.

Here are some signs of ransomware on your system.

  • Your web browser or computer displays a locked message that includes instructions for unlocking your system.
  • Your file directories display a .txt file titled “ransom note” or similar wording.
  • Your files have new file extensions added to filenames. Some examples include .locked, .locky, .crypto, .vault_crypt, or a longer extension with random characters.
  • Your computer files disappear and then sometimes reappear.

What to Do If Ransomware Infects Your Computer

According to UC Berkeley’s Information Security Office, if you suspect a ransomware attack, immediately take these steps.

  1. Power off all units. Having infected one machine, the malware will infect the rest of your network.
  2. Unplug your system from all networks. Then disable all network adapters, such as wireless interfaces.
  3. Contact your information technology (IT) personnel inhouse or your external IT provider.

What Steps Can You Take to Reduce the Risk of Ransomware?

Here are steps commercial real estate personnel can take to reduce their risk of ransomware attacks.

  • Using similar passwords at work and on social media can lead to ransomware attacks. Make sure your employees know this. You also can reduce or eliminate your social media presence.
  • Realize the Internet of Things (IoT) causes the emergence of new threats. According to TechRepublic, IoT can cause system vulnerability. These IoT include security monitoring systems and remote keys. Home appliances in residential commercial real estate may expose your system to ransomware attacks, according to TechRepublic.
  • Train your employees to increase their awareness of ransomware threats. After initial training, provide employees with frequent reminders and updated training.
  • Conduct “penetration testing,” an attempt to hack into your system by “ethical hackers,” to find vulnerabilities in your system.
  • Ensure your IT personnel update anti-virus protection.
  • Prohibit users from installing and using software you have not approved.
  • A “third line of defense” in the cyber battle is the internal audit. According to Deloitte, “Internal audit should play an integral role in assessing and identifying opportunities to strengthen enterprise security.” Make sure this audit tests the “full cybersecurity framework, rather than cherry pick items.”

Will Your Cyber Insurance Cover Ransomware Threats?

The standard commercial property  and businessowners policies offer limited coverage for computer-related losses. These policies provide coverage for physical loss to computer systems, such as a fire or theft. This is not the case for cyber losses, including ransomware attacks. Policyholders may find that coverage offered to meet  today’s cyber threats is inadequate without a standalone cyber policy.

Today’s standalone cyber policies, however, can offer coverages and endorsements for this type of evolving risk. A 2017 survey by the Risk Management Society (RIMS) revealed that 83% of respondents had a standalone cyber insurance policy in 2016. Granted, RIMS members are usually larger businesses. However, the smaller your business, the more likely you are to have cyber issues. Small commercial real estate businesses may use an in-house or an outsourced IT department. In either case, your IT staff’s skills may be inadequate to meet today’s rapidly emerging cyber risks.

Why risk a catastrophic breach without the proper cyber coverage? Today’s cyber policies that include ransomware risk coverage may offer the following coverages.

  • Ransom coverage for payments made to recover access to your files.
  • Extortion-related expenses such as the hiring of computer experts to help you manage the threat.
  • Restoration costs to reconstruct or repair lost or hijacked data or software.
  • Business interruption coverage for lost revenue due to a ransomware or other cyber incident.

Not all cyber coverage, however, responds to ransomware. Today’s cyber policies can contain a variety of insuring agreements, all which offer different coverages.

What Ransomware Coverages Do Commercial Real Estate Owners Need?

Working with a broker experienced in cyber coverage, here are some of the loss exposures to consider when purchasing a cyber policy.

First-party costs include loss to data, software and hardware. Lost income and business interruption also can occur while your IT department scrambles to undo the damage caused by ransomware.

Third-party costs can include privacy breaches and even stress and mental anguish claims arising from others your breach might impact.

Remediation costs include legal and forensic services. You may need a crisis management firm to help limit public relations damage.

Fines and penalties are a concern if a ransomware attack compromises the intellectual property or the trade secrets of others with whom you do business.

Cyber coverage can be confusing because one standalone cyber policy may contain as many as ten insuring agreements. New insurers enter the market almost weekly with fresh cyber coverage forms. Comparing cyber coverage is difficult even for the experienced insurance buyer. Cyber coverage options also create other questions. How can you evaluate an insurer’s breach support services, its loss prevention expertise, or its claim-handling knowledge? All these elements are crucial to consider when choosing the best cyber coverage.

Working with an experienced insurance broker can help ensure you have the tailored coverage you need in today’s commercial real estate environment.

Commercial Real Estate Insurance Practices – Emerging Challenges in the 2020 Market

Looking for strong insurance content tailored to your clientele?

This is a selection of content we recently produced for a commercial real estate insurance client:

Commercial real estate risk management faces challenges abound despite a healthy investment environment. Here are six commercial real estate challenges and their impacts on insurance coverage and rates.

Going Green and Commercial Real Estate Risk Management Implications

According to Investor Management Services, commercial real estate (CRE) properties produce 30% of all worldwide greenhouse gas emissions. Investor Management Services predicts this percentage will grow to 50% if CRE owners do not take steps to become more environmentally conscious.

From green roofs to low-flow plumbing fixtures, CRE owners can reduce their environmental impact. Such steps can yield higher profits and satisfy consumer demands. However, as you build green, consider the insurance implications of the green movement. Because green structures may be more expensive to rebuild after a loss, insurance valuations may be higher. However, something as simple as better lighting or improved ergonomic design of a commercial building’s interior can cause a 0.7% decline in employee health insurance costs, according to the US Green Building Council. This is an annual savings of about $70 per employee. As CRE owners continue their push for environmental designs, it’s important that their brokers understand the insurance coverage implications and closely align coverage with building improvements.

Environmental Challenges in Commercial Real Estate

According to Partner Engineering and Science, environmental risks can be the most expensive hazards faced by commercial real estate owners. Their site outlines three issues: vapor intrusion, radon gas exposures and emerging contaminants. Chemicals used in firefighting, in food manufacturing and in substances that degrease and increase stain resistance can all cause environmental damage.

Environmental incidents can be extremely expensive to remediate. Choosing the correct environmental insurance coverage is important. It is critical that property owners have the correct coverage for the environmental exposure. Mold issues that may impact tenancies, underground storage tanks and vapor intrusion into adjacent buildings are exposures that require specialized coverages. Working with brokers experienced in recurring and emerging environmental risks in CRE can help you tailor coverage to your risks.

Climate Change Risks and Commercial Real Estate Insurance Challenges

It comes as no surprise to CRE owners and managers that climate is hurting profits. CRE managers pay deductibles or self-insured retentions after significant storm or hurricane property losses. They face higher premiums and lower property limits in today’s hardened insurance market. CRE managers feel the effects of climate variance firsthand.

According to Forbesclimate poses a “significant threat to both residential and commercial buildings and can negatively impact a real estate investment.” This Forbes article points out gradual risks, such as ongoing sea-level changes. It also discusses sudden risks, such as increasing water intrusion from storm surges.

The Forbes article recommends a few proactive steps to help CRE owners and managers prepare for climate change impacts.

  • Evaluate climate risks as part of any CRE investment decision.
  • Mitigate with seawalls, drainage, elevation changes, or other tactics.
  • Ask your insurance carrier for their input. Insurers’ loss-prevention technicians can help you survey your risks and develop proactive risk-mitigation measures.

To learn more about how climate affects today’s commercial property insurance market, read our article about how insurance rate increases in 2020 will impact the CRE marketplace.

Changes in Construction Practices Impact Commercial Real Estate Risk Management Practices

The commercial real estate investment industry will be the center of great changes in 2020 and going forward. With more Americans moving to urban centers, the demand for commercial housing grows. Urban infill projects and the need for speedy construction and building techniques that do not require highly skilled labor will drive innovation in prefabrication and continue the movement toward frame buildings. In one study, labor shortages delayed completion time for real estate projects in 44% of responding firms.

PwC predicts that by 2025 over half of commercial construction activity will occur in emerging markets. These are the US, China, India, Indonesia, Russia, Canada and Mexico. PwC states that 2020 will be a key year because buildings in economies like the US will need sustainability ratings for increased profitability as sustainability affects building value.

In addition, amenities that improve the tenant experience will be a major trend in making commercial buildings more user-friendly. These innovations include smart thermostats, voice-activated security and other technologies.

Cyber Risk and Other Fraud Challenges 

A Deloitte analysis on cyber risk in commercial real estate recommends, “…addressing [cyber] risks through a program to become secure, vigilant and resilient….” The report states that the CRE sector “considers itself to be relatively less at risk from a potential cyberattack.” This is because CRE firms keep less consumer-identifiable information (PII) and intellectual property on their systems. The report warns that CRE information technology systems hold personal information such as credit card numbers and banking information. This PII is enough to generate cyber concerns for CRE owners and managers.

New trends in wire transfer fraud also can strike CRE firms. The Deloitte report states, “Many CRE companies have expressed concern about potential cyber vulnerabilities in wire transfer processes….” Many of these wire transfers involve large dollar transactions. According to the report, insiders provide the information needed for 37% of data attacks in real estate. It’s imperative that your cyber coverage, as well as your coverage for theft and embezzlement from within the organization, protects you in the event of a cyber or internal fraud loss.

According to Deloitte, “Many CRE companies are inadequately prepared for cyberattacks.” And after a cyber strike, coverage limitations, policy definitions and coverage wording can limit or altogether eliminate your claim recovery.

The insuring agreement spells out the risks the policy will cover.  A single cyber policy may contain up to ten insuring agreements. This can make shopping for cyber coverage confusing. An experienced agent who understands some of the coverage snafus that occur in cyber can help guide you in your cyber coverage search.

Employment Challenges in Commercial Real Estate

In both the construction of new commercial real estate and managing properties after they’re built, CRE owners face employment challenges. With record unemployment, managers struggle to fill positions with quality candidates. Connect Commercial Real Estate reports that the tighter job market forced CRE apartment operators to “renew their compensation packages against competitors” and outsource labor-intensive jobs like painting.

Using casual or outside labor to perform tasks can create risk management challenges. Casual or day labor rarely carries insurance. While the organization may consider the helper an independent contractor, the administrative law judge in the state where that person sustains an injury makes the decision if the employee files a claim. Therefore, you may be better off using only licensed contractors. Obtain certificates of insurance to protect against a costly workers’ compensation claim in the event of an injury from an uninsured worker.

In addition to obtaining a certificate, ask for a waiver of subrogation from subcontractors or contractors who may be on your premises. According to the International Risk Management Institute, a subrogation waiver is “An agreement between two parties in which one party agrees to waive subrogation rights against another in the event of a loss. The intent of the waiver is to prevent one party’s insurer from pursuing subrogation against the other party. Generally, insurance policies do not bar coverage if an insured waives subrogation against a third party before a loss. However, coverage is excluded from many policies if subrogation is waived after a loss because to do so would violate the principle of indemnity.”

Consider this incident. You hire a plumbing contractor who comes on your premises if plumbing issues arise. Rather than going to the truck and getting his ladder, he uses a ladder he finds in one of your storage areas. The ladder fails and he falls, breaking his leg. Without a waiver of subrogation, his insurer may pursue your insurance carrier for the cost of his workers compensation claim. While the waiver of subrogation won’t always prevent a successful claim, it helps in many instances.

A New Decade of Challenges Lies Ahead in Commercial Real Estate

This new decade will present many risk management challenges for CRE owners and managers. Insurance will continue to develop to meet the needs of the emerging risks faced by business owners. Working with an agent experienced in commercial real estate risk management can help you choose the broadest coverage at the most competitive price.

For more information about how <client name> can assist you in your commercial real estate risk management practices, contact us here.

Coronavirus Rattling the Commercial Real Estate World

Looking for strong insurance content tailored to your clientele?

Here is a selection of some content I recently produced for commercial real estate insurance:

Every business now needs a coronavirus (COVID-19) response plan. With this in mind, if you are a business owner, it is in your best interest to research some of the different financial relief options such as Economic Injury Disaster Loans (EIDLs) for businesses that have felt the financial impact of the coronavirus pandemic. Exactly how much money you are entitled to claim will depend on how your specific eidl status is processed. Furthermore, while experts do not expect long-term impact on the US economy immediately, the coronavirus may rock the commercial real estate sector in the short term. A new CBRE report predicts the virus may shake the retail, hospitality and industrial sectors. As of the middle of February 2020, experts predicted infections to peak in March; however, CBRE reports a short-term commercial impact on hotels and retails centers in areas heavily frequented by mainland Chinese visitors. This includes San Francisco, Los Angeles and New York city.

How can commercial real estate managers prepare?

Some COVID-19 Statistics

A flulike virus which produces “mild cold symptoms in about 80% of patients,” according to the Centers for Disease Control (CDC), the virus outbreak originated in Wuhan, China, which has been under a quarantine since January 23, 2020. At that time, the World Health Organization (WHO) did not declare the virus a global health emergency nor recommend any international restrictions on travel. However, on February 28, 2020, WHO director-general Tedros Adhanom pronounced the risk of spread and impact “very high” globally.

On February 26, 2020, President Trump announced the appointment of Vice-President Pence as the US official overseeing the Trump administration’s response to the virus.

Develop a COVID-19 Response Plan

One of the most important steps in strategic risk management is how to take a proactive approach to any threat, including viruses, without overreacting. The CRE sector has a large exposure to human traffic whether your business portfolio includes large office complexes, commercial high-rises, hotels, or apartments.

The CDC admits that little is known about how this virus will spread. One California case is of unknown origin and the first case in New York City was confirmed over the weekend.

The CDC has interim COVID-19 guidance on its website that preemptive business owners can take. As more is known, the CDC website may be the best source of current information. Avoid acting on rumors, which will no doubt spread exponentially on social media and on unvetted “news” sources.

Steps in the COVID-19 Response Plan

Here are some of the steps the CDC recommends businesses follow.

  • Encourage sick employees to stay home. Any employees with acute respiratory illness should not work “until they are free of fever (100.4F).” This can cause some worries for families who need that paycheck, luckily sites like GoFundMe are there to help people who are in dire need.
  • Ensure any temporary service agencies you work with follow similar protocol. A European study found that temporary workers were less likely to call in sick than their employed counterparts, probably due to their more tenuous financial situations.
  • Encourage workers with family members with COVID-19 to avoid coming to work because they may carry the virus without showing symptoms and inadvertently infect their coworkers. The CDC offers a COVID-19 risk assessment tool for returning employees who are COVID-19 caregivers.
  • Make sure employees are aware of current guidelines and offer help and advice on staying safe during the pandemic. This will limit the chances of any employees catching the virus and spreading it around the workplace.
  • Place reminders in the workplace and on entrances that remind workers and visitors to practice appropriate hygiene. Handwashing should last at least 20 seconds. Make hand sanitizer available, as well.
  • Install no-touch waste receptacles and encourage employees to exit restrooms using hand towels or hygiene squares to avoid touching knobs.
  • Consider bringing in a face mask policy in line with current WHO recommendations. You could get your workers the N95 Mask Canada as one example to help keep them safe.
  • Increase routine environmental cleaning. Clean workstations, shared keyboards, countertops, remote controls and doorknobs.
  • Consider reducing employee travel when possible. Can you reschedule a meeting to a web-based conference, avoiding a flight? If not, check the CDC’s Travelers’ Health Notices for travel updates and recommendations. As of this writing, it lists at-risk destinations as China, Hong Kong, Iran, Italy, Japan, Singapore, South Korea, Taiwan and Thailand. That is subject to change rapidly, however. Nigeria reported its first case on February 28, 2020.
  • Don’t run afoul of the Americans with Disabilities Act by announcing specific employee medical situations to others without their need to know. Talk to your legal counsel or your human resource officer before making any illness-related announcements that involve specific employees.

Supply Chain Disruptions May Impact US Business Owners

If you’re buying supplies from manufacturers in impacted countries, you may experience significant disruption to your supply chain. While much emphasis is on the pharmaceutical industry since the US imports medical supplies, devices and pharmaceuticals from China, deliveries of steel and other manufactured goods have caused concerns in both the US and Europe. A recent Forbes article highlighted a shortage of shipping containers due to “the virtual shutdown of commercial traffic in China,” which impacted global shipping.

Cleaning and other supplies may be in short supply given this virus-related disruption. Consider stocking up on needed supplies that originate abroad.

Will Our Insurance Coverage Respond?

According to Business Insurance, traditional commercial policies provide limited coverage for diseases and outbreaks. In many circumstances, employment practices policies will respond if your organization allegedly mishandles its human resources response to COVID-19. If shareholders allege your organization failed to prepare adequately, your directors and officers (D&O) policy may respond, largely dependent on how your insurer words the D&O policy.

General liability policies may provide some coverage if guests or visitors allege they contracted the virus on your premises. If your organization incurs cleanup costs, your pollution liability policy might cover the costs. Again, the wording of your coverage matters.

Standard property policies usually contain contamination exclusions, and business interruption costs may go unpaid without special endorsements. Typically, the business income policy, which covers business interruption costs, provides coverage only after a natural disaster or other peril listed in the policy, such as a fire, caused property damage. This damage is the trigger for many business income policies. Additionally, only a government-ordered business closure triggers coverage in many instances. Some endorsements that would provide broader business income coverage may be on the horizon.

How Should the Commercial Real Estate Sector Respond to COVID-19?

Just like any other threat, don’t overreact. It is a great time to schedule a meeting with your insurance broker. Review coverages that might apply in the event your organization feels the impact of COVID-19.

How Active Assailant Insurance Can Help Your Business Survive after a Mass Casualty Event

Co-authored by Chantal Roberts, CPCU, AIC, RPA

Are those firecrackers? Is a car backfiring? Perhaps there’s a disturbance of some kind. Today’s managers and owners rarely consider if an active shooter incident can occur on their property. Unfortunately, active shooter or active assailant incidents are more prevalent in the United States than ever before. Due to the increasing occurrence of this type of loss, a business that faces this situation may find itself without coverage for many claims that arise post-event. These uncovered losses can include posttraumatic stress (PTSD) treatment, structural improvements of buildings, post-event security, or the inability to handle the onslaught of media post-event.

This article outlines typical policies most businesses buy and describes additional coverage business owners should consider to protect their business, employees and customers/guests if the unthinkable event occurs. It discusses active assailant policies along with other risk prevention techniques. This article helps business owners understand the liability products available and provides some pricing examples. Active assailant coverage is surprisingly affordable, and while not right for every business, certain owners will want to obtain a quote for this important coverage.

Continue reading “How Active Assailant Insurance Can Help Your Business Survive after a Mass Casualty Event”

Has the Insurance Industry Missed the Recruiting Boat?


All of us in the industry responsible for training and recruiting are working as hard as we can to attract new Millennials to our business. Focusing on colleges, we’re teaching, recruiting, interning and trying our hardest to attract new candidates. Sadly, our insurance classes are lucky if they have ten students.

Maybe our industry has missed the boat.

In 2008 – 09 when the economy tanked, the insurance industry missed a great opportunity. When the economy dissolved, the first thing to crash was the construction industry. What if our recruiters had focused on cherry picking construction managers, loss prevention personnel, estimators and other construction personnel who suddenly found themselves jobless? We wouldn’t be having the claims talent crunch we now face, at least in the property arena.

Continue reading “Has the Insurance Industry Missed the Recruiting Boat?”

The power of the press release

A press release does several things for your business.

  • A news release announces a recent accomplishment you have achieved. For example, it could be a class you completed; a professional designation you earned; a civic award; your appointment to a board or charity; an educational goal you may have attained; a new program you are rolling out; an office expansion; or any noteworthy event that keeps your name in the public arena. One caveat: Don’t fall into the trap of the “I feel good” press release. Find the hook in the accomplishment, which means that the accomplishment also helps your clients, not just you.
  • A press release announces a new program roll out or personnel change. Maybe you have partnered with a new carrier or formed a new strategic alliance. Perhaps you’ve lured a new hire with impressive credentials. Maybe you’ve grown so much that you’re opening a new location.

Continue reading “The power of the press release”