Losses from natural and human-made catastrophes can negatively impact our financial results. Examples include hurricanes, tornadoes, windstorms, earthquakes, hail, severe convective storms, severe winter weather, derechos, floods, and fires, some related to climate change, and criminal and terrorist acts, including cyber-attacks, civil unrest, and explosions. The frequency and severity of these catastrophes are inherently unpredictable, and the frequency and severity of catastrophe losses have increased globally in recent years. In many cases, the increase in catastrophe losses relate to small- to- medium-sized events that primary insurers retain and do not cede to reinsurers. Although we use sophisticated catastrophe modeling techniques to manage our catastrophe exposure, catastrophe models provide estimates that may materially differ from actual exposure and loss experience. For example, catastrophe models did not fully estimate the potential for some recent catastrophe loss activity (such as Winter Storm Elliott freeze losses in December 2022) and the concurrent recent economic inflation on construction costs.
Our insurance operations primarily write risks in the Eastern, Midwestern, and Southwestern regions of the U.S. Our most significant natural and/or human-made catastrophe exposures are (i) hurricanes impacting the Eastern U.S., (ii) severe convective storms, including hailstorms and tornadoes, (iii) winter storms, (iv) earthquakes, and (v) terrorism events. Single storms could adversely impact our financial results, but it is also possible that we could experience more than one severe catastrophic event in any given calendar year. We track our severe weather and catastrophe losses using definitions and information we obtain from Insurance Services Office, Inc.'s ("ISO") Property Claim Services unit, an internationally recognized authority on insured property losses from catastrophes in the U.S., Puerto Rico, and the U.S. Virgin Islands.
Certain factors can impact our estimates of ultimate costs for natural and/or human-made catastrophes, including:
- Inability to access portions of the affected areas after a catastrophic event;- Scarcity of necessary labor and materials that delay repairs and increase our loss costs;- Regulatory uncertainties, including new or expanded interpretations of coverage;- Residual market assessment-related increases in our catastrophe losses;- Potential fraud and inflated repair costs, partly driven by (a) demand surge post-event and (b) opportunistic service providers;- Higher loss expenses due to shortages of claims adjusters available to appraise damage;- Late claims reporting;- Escalation of business interruption costs due to infrastructure disruption; and - Whether the U.S. Secretary of the Treasury certifies an event as a terrorist act under TRIPRA.
Natural catastrophes
Temperature changes can impact weather patterns and the frequency and/or severity of catastrophes, including hurricanes, severe convective storms, wildfires, and flooding - all of which could cause our catastrophe losses to increase relative to historical levels.
A significant component of climate change risk is that the frequency and severity of extreme weather events may evolve differently relative to historical levels – leading to greater model uncertainty. Climate change models project significant differences in global regional warming above pre-industrial levels, depending on future levels of climate mitigation and geographic location. These global regional differences, whether attributable to nature or human activities, include increases in (i) mean temperature in most land and ocean regions, (ii) hot extremes in most inhabited regions, (iii) heavy precipitation in several regions, and (iv) the probability of drought and precipitation deficits in some regions.
Human-made catastrophes
Cyber Attacks and Incidents
The risk of a wide-scale criminal or terrorist cyber-attack has become more significant and has drawn increased attention from IT and national security experts, U.S. policymakers, the U.S. military, and the insurance industry. There is general recognition that a wide-scale cyber-attack that simultaneously impacts multiple victims is more likely, and insurance industry systemic risk has increased. We have identified three primary sources of potential insured exposure to cyber losses: (i) cyber-specific policies designed to cover both first-party and third-party losses; (ii) affirmative cyber coverage grants included in other types of policies, such as commercial property or businessowners policies; and (iii) "silent cyber" exposures, otherwise known as non-affirmative cyber exposures, which describes cyber risk that is neither expressly covered nor excluded in insurance policies. This exposure may exist if courts, regardless of intent, interpret policy forms without specific related coverage exclusions to provide coverage for a cyber-related incident.
We provide cyber-specific policies to our commercial lines and personal lines customers through 100% reinsured solutions with highly-rated specialty cyber markets. These solutions allow us to meet our customers' needs for cyber insurance while mitigating our underwriting risk as we develop our expertise in the cyber insurance market.
Beyond our cyber-specific policies, our other insurance policies provide some first- and third-party cyber coverages:
- We offer limited first-party affirmative cyber coverage in our commercial property and businessowners' policy forms. We limited our "silent cyber" exposure through an affirmative coverage grant subject to a sub-limit.
- Our base property forms typically include a coverage grant of $2,000 or $10,000. Most of our property policies also contain an affirmative endorsement providing "virus and harmful code" coverage subject to a sub-limit. Over 90% of our policies with virus/harmful code coverage on commercial property, businessowners', commercial output policy, or inland marine forms have sub-limits of $25,000 or lower. For policies effective October 1, 2022 and later, we implemented cyber incident exclusions that exclude malicious cyber except for the sub-limited coverage provided in the base ISO coverage forms and our property and businessowners' property "virus and harmful code" extension endorsements. These exclusions clarify coverage and have no premium impact.
- Most of our general liability and businessowners' policies exclude cyber-related liability losses, except for "bodily injury." Our specific cyber-exclusion and liability forms' lack of affirmative sub-limited cyber coverage, effectively limit most "silent cyber" exposure.
- By statute, workers compensation policies do not have cyber exclusions, and a cyber-attack-related workplace injury could trigger coverage.
Terrorism
We are required to participate in TRIPRA, now extended to December 31, 2027, for our Standard Commercial Lines and E&S Lines business. TRIPRA rescinded all previously approved coverage exclusions for terrorism and requires private insurers and the U.S. government to share the risk of loss on future acts of terrorism certified by the U.S. Secretary of the Treasury. Under TRIPRA, each participating insurer must pay a significant deductible of specified losses before federal assistance is available. Our $543 million deductible is based on a percentage of our prior year's applicable Standard Commercial Lines and E&S Lines premiums. In 2024, the federal government will pay 80% of losses above the deductible, with the insurer retaining 20%. Although TRIPRA will mitigate some of our loss exposure to a large-scale terrorist attack, our deductible could have a material adverse effect on our results of operations, liquidity, financial condition, financial strength, and debt ratings. If the U.S. Secretary of the Treasury does not certify specific terrorist events, we could be required to pay terrorism-related covered losses without TRIPRA's risk-sharing benefits. We also could be required to pay terrorism-related losses for customers who declined terrorism coverage.
Our primary workers compensation policies are required to cover terrorism risk, so TRIPRA applies to those policies. Insureds with non-workers compensation commercial policies can accept or decline our terrorism coverage or negotiate with us for other terms. In 2023, 85% of our Standard Commercial Lines non-workers compensation policyholders purchased terrorism coverage that included nuclear, biological, chemical, and radioactive ("NBCR") events. TRIPRA also applies to cyber liability insurance policies reported under a Terrorism Risk Insurance Program-eligible line of insurance.
Many states mandate that commercial property policies cover fire following an act of terrorism - regardless of whether the insured purchased terrorism coverage. We also sometimes elect to provide terrorism coverage for lines of business not included in TRIPRA, such as Commercial Automobile. TRIPRA has never covered personal lines of business. Our Standard Personal Lines homeowner policies exclude nuclear losses but not biological, chemical, or conventional terrorism losses. Our current reinsurance programs cover some losses from conventional foreign and domestic terrorism acts but not NBCR events.
An increase in natural or man-made catastrophe losses, including a systemic cyber-attack that produces an aggregation of property and/or casualty cyber losses, will reduce our net income and stockholders' equity and could have a material adverse effect on our liquidity, financial strength, and debt ratings. The closer a catastrophe occurs to the end of a reporting period, the more likely we have limited information to estimate loss and loss expense reserves, increasing the uncertainty of our estimates. More comprehensive claims information available after a reporting period may result in reserve changes in subsequent periods.