Hack of insurance company Shirbit erased its 2020 profits

Shirbit published its financial reports Sunday evening which revealed the severity of the damage caused by the cyberattack it experienced in November. Shirbit’s losses for the fourth quarter were capped at NIS 8 million ($2.4 million) and erased its annual 2020 profits, marking its earnings at only NIS 800,000 ($240,000), compared to NIS 26 million ($7.8 million) in 2019. The loss stems, among other factors, from the company’s inability to renew its insurance policies during December after the company’s servers were shut down.

On Nov. 20, a group of hackers named Black Shadows hacked into the insurance company’s system in what has been defined as the worst cyberattack in Israeli history. The hackers weren’t content with only encrytpting and stealing the data, but also tried to blackmail the company by threatening to leak the data, which they did but to a lesser extent than expected.

The direct losses, aside from the hack, include four class-action lawsuits amounting to NIS 1.2 billion ($360 million) which have been filed against the company. The filed lawsuits claimed that the company did not address the security breach issue appropriately, in line with its obligations, and thereby relinquished its customers’ details which led to the widespread exposure of their information some of which was highly sensitive. In addition, the company chose to cut back on cybersecurity costs at the expense of its insured customers and managed the incident without the expected transparency. The four lawsuits are at the initial stages. At this time, the complete details remain unclear and it has not been decided which of those lawsuits will be examined in full-detail by the courts, leaving the company’s legal counsel unable to estimate whether the suits will be heard.

Shirbit is managed by CEO Zvi Leibushor. The majority of its activity involves providing insurance for government employees’ vehicles, having repeatedly won a government tender to do so. According to the report, 25% of the company’s mandatory car and property insurance is conducted through group insurance and large factories.

The company’s premiums in 2020 amounted to NIS 453 million ($136 million) compared to NIS 532 million ($160 million) in 2019, showing a decline of 15%. During the fourth quarter, when the company’s systems were hacked, the premiums dropped to NIS 91.5 million ($27.5 million), a decline of 8% compared to the corresponding quarter.

Phoenix Insurance Ltd is currently in talks to acquire Shirbit. Shirbit was founded in 2000 and is fully owned by Chairman Igal Ravnof, who is demanding the company be sold for NIS 100 million ($30 million). The Phoenix group is offering around NIS 60 million - 70 million ($18 million - 21 million) for the company, due to concerns over the hacking incident which may harm Phoenix's future operations.