Aransas County commissioners, at their regular meeting Monday, June 8, table with a 3-2 vote authorizing Aransas County Judge C.H. “Burt” Mills to purchase cyber insurance for Aransas County for an annual premium of $14,490. The insurance package would have provided $5 million in coverage for costs incurred due to hack attacks, ransom or data breach, and system failures.
Commissioner Charles Smith made the motion to table the insurance purchase. Commissioner Wendy Laubach seconded it. Commissioner Bubba Casterline joined Smith and Laubach in favor of tabling the matter. Judge Mills and Commissioner Jack Chaney opposed the measure.
County IT Director Collin Jackson noted the county backs up its data every two hours, but this type of insurance is needed to protect the county from financial liability if its system is hacked, or is a victim of a ransomware attack.
“This is liability insurance,” said GSM Insurors Travis McDavid. “Everybody this day and age has this liability (data breach or ransomware attack).
Commissioner Charles Smith asked McDavid if he knew of any counties being “held ransom” after such an attack.
McDavid said he did not know of any offhand.
Additional questions centered on whether the insurance would pay based on claim or occurrence.
McDavid couldn’t give a definitive answer.
Smith then suggested tabling the matter until additional information about the coverage is known.
No commissioner believed the county did not need the insurance. The expense is not in this year’s budget.
“Sometimes all it takes is someone opening a bad email with malware or ransomware,” said McDavid. “It can just sit there and not do anything right away, but it’s infecting your back ups.”
He also noted the insurance covers wire transfer fraud.
Judge Mills said Jackson has told him the county’s computer system has been attacked a number of times.
“When (the system) was attacked back when Bill Adams was judge, how did we pay?” asked Commissioner Bubba Casterline.
Jackson noted the primary cost was employee time.
Commissioners are expected to address this issue again in the near future after additional information is received.