As every risk manager knows, the world is as fraught with risk as ever. This becomes even more apparent as natural disasters, cyberattacks, corporate malfeasance and political and economic uncertainty make headlines and create new business concerns. The following review of some of the notable risk events of 2018 can both remind us where we have been and provide insight into the challenges and opportunities we could face in the years to come.
New York City Sues Oil Companies Over Climate Change
January 10
New York City filed suit against BP, Chevron, ConocoPhillips, ExxonMobil and Royal Dutch Shell in an effort to hold them financially responsible for contributing to climate change and the damages it will cause to the city. In July, however, a federal judge dismissed the case, suggesting that climate change issues would be more appropriately handled by federal legislation. In June, courts also reached a similar decision in dismissing climate change lawsuits filed by San Francisco and Oakland last year. New York renewed its fight against ExxonMobil in October but changed its tactics, suing the company this time for engaging in a “long-standing fraudulent scheme” to deceive shareholders by downplaying the risk climate change posed to its business.
Cape Town Faces Water Shortage
January 18
Due to a three-year drought, officials in Cape Town, South Africa, projected that the city would run out of water in mid-April, becoming the first major city to exhaust its water supply. In preparation for this “Day Zero,” officials advised the city’s four million residents to limit water use and implemented tariffs to help finance water and sanitation services and drive down demand. Residents were warned that if the water level of the dams supplying the city dropped to a certain point, the city planned to shut off the municipal water supply to all but essential services and only allow residents a daily ration of 25-liters (6.6 gallons) that they would have to collect from designated water stations. The measures had the intended effect and, with water levels rising, Day Zero was postponed indefinitely on June 28.
Winter Storms Wreak Havoc
January 18
Winter storm Friederike hit Western and Central Europe with heavy rains and hurricane-force winds that killed 13 and caused more than $2 billion in damages in Germany, the Netherlands, Belgium, France and the United Kingdom. Meanwhile, on the other side of the Atlantic Ocean, North Americans experienced a “bomb cyclone” as a massive blizzard in the first week of January dumped heavy amounts of snow and ice along the Atlantic coast from Florida to New Brunswick, killing 22 and causing $1 billion in damages.
Fitness App Reveals Military Secrets
January 28
Researchers discovered that a fitness tracking app called Strava that allows users to record and share their workouts may have also inadvertently revealed the location of military bases and personnel around the world. The app’s publicly-available heat maps use GPS data to highlight popular running routes, but could be cross-referenced with the locations of known military installations to track personnel movements and patrol routes, determine the configuration of bases, gain insight into shift schedules, and target individuals. In response, Strava reconfigured the app to allow only registered users to access to certain information, while the U.S. Department of Defense issued a new policy prohibiting personnel from using location tracking features in areas where military operations are being conducted.
Emotional Support Peacock Sparks Airline Policy Change
February 1
After United Airlines made headlines for refusing to allow a passenger’s “emotional support peacock” to board a flight, the airline updated its policy regarding support animals. Beginning March 1, United’s policy requires that passengers wishing to fly with an emotional support animal provide documentation from a medical professional verifying the need for such assistance as well veterinary confirmation that the animal is healthy and properly vaccinated and that it has received the appropriate behavioral training. Other carriers issued similar policy updates as well.
World Bank Issues Record Cat Bond
February 7
The World Bank issued a $1.36 billion catastrophe bond that will provide coverage for earthquake risk in Chile, Colombia, Mexico and Peru. The bond is the largest sovereign risk transaction and the second-largest catastrophe bond in history, after a $1.5 billion Everglades Re hurricane bond issued to Florida Citizens in 2014. Based on specific parametric triggers, the bond will allocate varying amounts of insurance to the covered nations in the event of an earthquake of a certain magnitude—$500 million to Chile, $400 million to Colombia, $260 million to Mexico and $200 million to Peru.
Seventeen Killed in Parkland School Shooting
February 14
A gunman opened fire on students and teachers at Marjory Stoneman Douglas High School in Parkland, Florida, killing 17 people and wounding 17 others. It was the deadliest school shooting in the United States since 26 were killed at Sandy Hook Elementary School in 2012. In the wake of the massacre, public pressure led many companies to discontinue business relationships with the National Rifle Association, and Walmart and several other retailers announced that they would no longer sell guns to anyone under 21. The tragedy also prompted Florida to pass a law encompassing a number of gun control and public safety measures, including age restrictions, waiting periods, a prohibition on gun possession by violent or mentally ill individuals, and funding to arm school personnel and hire school police. Tragically, this was not the only high-profile school shooting in 2018—on January 23, a student killed two and injured 18 at Marshall County High School in Kentucky, while on May 18, another shooter killed 10 and injured 13 at Santa Fe High School in Texas.
U.S. Issues Wide-Ranging Import Tariffs
March 8
In keeping with its “America First” policy, the Trump administration imposed import tariffs of 10% on aluminum and 25% on steel, following levies on solar panels and washing machines. In response, U.S. trading partners including Canada, Mexico and the European Union issued retaliatory tariffs on a many American goods. Meanwhile, citing concerns about unfair trade practices and intellectual property theft by China, the Trump administration also imposed a series of tariffs on Chinese exports covering hundreds of billions of dollars’ worth of goods, sparking an ongoing a trade war as China answered in kind. The resulting uncertainty impacted stock markets throughout the year. While President Trump believes that tariffs will protect U.S. economic and national security interests, many economists and trade associations have opposed the policies, warning that tariffs will result in job losses and higher costs for manufacturing and consumer goods.
Russian Hackers Target U.S. Utilities
March 15
The U.S. Department of Homeland Security and the FBI issued an alert that hackers sponsored by the Russian government have been targeting U.S. government entities and critical infrastructure facilities in the energy, nuclear, water, aviation and critical manufacturing sectors. In response to the campaign and other malicious activity by Russian operatives, the U.S. Treasury Department announced sanctions against five entities and 19 individuals involved in the cyberattacks.
Facebook/Cambridge Analytica Scandal Sparks Data Privacy Outrage
March 17
Whistleblowers revealed that political consulting firm Cambridge Analytica obtained the personal data of 87 million Facebook users without their consent, which it then used to influence voter sentiment. The data privacy violations sparked public outcry and led to significant drops in both companies’ market value. Facebook’s stock price would eventually rebound, but Cambridge Analytica was unable to weather the storm and shut down operations in May. In October, U.K. authorities fined Facebook £500,000 for its role in the scandal. Facebook’s data security practices continued to come into question in September when, in an unrelated incident, it announced that a data breach had exposed the personal information of up to 50 million users.
Atlanta Suffers Ransomware Attack
March 22
The city of Atlanta was hit by a ransomware attack that shut down municipal services and destroyed legal records, causing disruption that lasted for months. After refusing to pay a ransom of about $50,000 in bitcoin, the city ended up shelling out $2.7 million to cybersecurity firms to fight the attack. In June, Atlanta officials calculated that they would need to spend an additional $9.5 million on recovery efforts. The SamSam ransomware behind the incident was responsible for at least 67 other attacks this year, including one on Colorado’s Department of Transportation in February that cost up to $1.5 million to remediate.
Romaine Lettuce Spreads E. coli Outbreak
April 10
The Centers for Disease Control and Prevention announced that romaine lettuce harvested and consumed in March was the culprit behind the largest multi-state E. coli outbreak in over a decade. By the time the outbreak was declared over on June 28, 210 people had been sickened across 36 states, leading to 96 hospitalizations and five deaths. The source of the contamination was traced back to the Yuma, Arizona, growing region. This was not the only major food-borne illness outbreak this year—also in April, Rose Acre Farms recalled more than 200 million eggs due to possible Salmonella contamination after at least 35 people were sickened across nine states.
Wells Fargo Hit With $1 Billion Fine
April 20
The problems at Wells Fargo continued this year as the U.S. Consumer Financial Protection Bureau and the Office of the Comptroller of the Currency fined the company $1 billion for unfair practices in its auto loan and mortgage businesses. The penalty came after the bank charged customers for auto insurance they did not need, causing up to 20,000 people to default on their auto loans. Wells Fargo also improperly charged fees to mortgage customers to lock in preferential interest rates. In addition to the fine, the bank was ordered to make restitution to customers, develop and implement an effective enterprise-wide compliance risk management program, and allow the OCC to approve senior executive officer or board appointments. In May, the bank also agreed to pay $480 million for a class action settlement related to its fake account scandal.
Hawaii’s Kilauea Volcano Erupts
May 3
The Kilauea volcano on Hawaii’s Big Island erupted, resulting in months of dangerous volcanic activity as at least 24 fissures opened spewing lava, toxic gases and ash. Thousands of people were forced to evacuate as more than 700 homes were destroyed and infrastructure and highways were damaged by widespread lava flows that covered almost 14 square miles. Big Island farmers alone reported that the volcano cost them almost $28 million in damaged from destroyed farmland, crops, buildings and inventory. Overall, state officials estimated that recovery efforts could total as much as $800 million.GDPR Goes into Effect
May 25
After years of preparation, the EU’s General Data Protection Regulation (GDPR) was finally implemented. The law applies to EU companies as well as any company that does business with EU residents, regardless of where the business is located. The GDPR establishes data breach notification requirements and gives consumers new rights with regard to their data, including the “right to be forgotten,” which allows consumers to order a company to erase their personal data. Businesses must also adopt “privacy by design” standards, which specify that data protection safeguards be built into any product or service offerings at the outset. Violations of the GDPR can result in fines of up to €20 million, or 4% of a company’s global turnover, whichever is greater.
U.S. Repeals Net Neutrality Laws
June 11
The Federal Communications Commission repealed Obama-era net neutrality regulations that required internet service providers like AT&T, Verizon and Comcast to treat all internet traffic equally. FCC Chair Ajit Pai argued that the regulations discouraged investment and innovation by broadband companies. Supporters of net neutrality—including the vast majority of consumers and major content providers like Facebook, Netflix and Amazon—fear the repeal will allow service providers to block, throttle or prioritize access to specific websites and content, increase fees for internet access, and prevent new companies from developing an internet presence. Following the repeal, net neutrality advocates and 22 state attorneys general sued the FCC to reverse the decision. In September, California passed its own net neutrality law but faces legal challenges from the Justice Department and internet service providers.
California Passes Strict Data Privacy Law
June 28
California passed a new data privacy law that grants consumers more control over how companies collect and use their personal data. The California Consumer Privacy Act of 2018 requires companies to disclose what data they are collecting, how they are using it, and with whom they are sharing it. Consumers can also bar companies from selling their information and request that they delete their data entirely. In addition, businesses must implement reasonable security measures to protect information and cannot discriminate against those who elect to keep their information private by refusing to provide goods and services, charging different prices, or providing a lower level of quality or service. The law takes effect in January 2020.
Japan Endures Deadly Floods and Heat Wave
June 28
Heavy rains that continued through July led to widespread floods and mudslides throughout Japan, killing at least 225 people, forcing millions to evacuate and causing billions of dollars in damage to houses, infrastructure and agricultural operations. Throughout the month of July, the country also faced an intense heat wave with weeks of sustained temperatures over 35°C (95°F). On July 23, temperatures even set a new national record when a reading of 41.1°C (106°F) was recorded in Kumagaya. Between April 30 and Aug. 5, 138 people died and more than 70,000 were hospitalized for heat-related conditions.Starbucks to Phase Out Plastic Straws
July 9
Starbucks announced that it plans to eliminate plastic straws from all of its 28,000 stores worldwide by 2020. The company joined a growing list of businesses that are banning single-use plastic straws and utensils amid concerns over the environmental impact of plastic waste. The corporate bans on plastic mirror initiatives taken by various countries and municipalities including Seattle and Vancouver, which initiated bans this year, to curb the proliferation of single-use plastic bags, bottles, straws and utensils because of rising pollution and disposal costs.
Johnson & Johnson Hit with $4.7 Billion Talcum Powder Verdict
July 12
A jury ordered Johnson & Johnson to pay $4.69 billion to 22 women who claimed that they developed ovarian cancer after using asbestos-contaminated talcum powder products. To date, about 9,000 talcum powder lawsuits have been filed against Johnson & Johnson, which has repeatedly denied that its products cause cancer or that they contain asbestos. The company also faces similar lawsuits alleging that its talcum powder is responsible for instances of mesothelioma. In April, for example, Johnson & Johnson and talc company Imerys were ordered to pay $117 million to a plaintiff who contracted the disease after using the powder.
Google Fined $5 Billion for Antitrust Violations
July 18
Google was fined a record €4.34 billion (about $5 billion) by European Union regulators for violating antitrust laws. According to the European Commission, Google took advantage of its dominant market position by requiring mobile device makers to pre-install Google Search and the Chrome browser apps as a condition for licensing its Google Play app store. It also paid manufacturers to only pre-install Google Search, and blocked them from selling devices that run rival versions of the Android system. Last year, Google was fined €2.42 billion ($2.8 billion) by the European Commission for illegally manipulating search results to promote its own services.
Monsanto Faces Widespread Weedkiller Liability
August 10
A San Francisco jury ordered Monsanto to pay $289 million to a school groundskeeper who contracted terminal non-Hodgkin’s lymphoma after using the company’s Roundup weedkiller. The penalty was ultimately reduced to $78 million. The verdict opens the door to additional liability for Bayer (which bought Monsanto for $63 billion earlier this year) as it faces some 8,000 similar suits brought by plaintiffs who also claim their cancer was caused by Monsanto herbicides.
Monsoon Floods Devastate India
August 15
The state of Kerala in southern India endured some of the most severe flooding to hit the region in almost a century. Unusually heavy monsoon rains overwhelmed dams and triggered landslides, killing more than 480 people and forcing at least one million to take refuge in government relief camps. Damages from the disaster were estimated to be as high as 40,000 crore rupees (about $5.5 billion). In addition, affected areas had to combat water-borne diseases, including an leptospirosis outbreak of that killed at least 60 people by September.
Puerto Rico Raises Hurricane Maria Death Toll
August 28
The Puerto Rican government significantly increased its official Hurricane Maria death toll from 64 to 2,975 after a commissioned study by George Washington University revealed the broader extent of the storm’s damage. In addition to the people directly killed from structural collapses, flying debris, floods and drownings, the new tally includes the number of additional storm-related deaths caused by disease and lack of access to clean water and electricity in the six months after Maria between September 2017 and February 2018.
DHS Unveils National Risk Management Center
September 1
The U.S. Department of Homeland Security announced the formation of the National Risk Management Center, an initiative focused on defending critical infrastructure from cyberattacks. The center will work with industry experts to identify, assess and prioritize risks to critical functions, collaborate on risk management strategies to address these threats, and coordinate integrated cross-sector risk management activities. Initially, these efforts will be focused on the financial services, telecommunications and energy sectors.
Nike Generates Controversy with Kaepernick Ad
September 3
Nike drew strong reactions after unveiling an ad campaign featuring NFL quarterback Colin Kaepernick, who gained attention for kneeling during the national anthem in protest of racial injustice and police brutality in the United States. Critics, however, have condemned his protest as unpatriotic and disrespectful to the military. The ad quickly sparked a negative response, with many on social media calling for boycotts of Nike products and filming themselves burning their Nike apparel in protest. However, the spot drew even more positive attention, with many others praising the company’s stance as Nike’s online sales spiked 31% and its market value reportedly increased by $6 billion following the release of the ad.
Indonesian Earthquake and Tsunami Kill 2,000
September 28
A magnitude 7.5 earthquake and subsequent tsunami devastated the Indonesian province of Sulawesi, killing more than 2,000 people, primarily in the city of Palu. The tsunami also triggered mudslides that engulfed neighborhoods and villages and destroyed more than 70,000 homes, forcing thousands of survivors to live in tents and makeshift shelters. Total economic damages are expected to reach up to $1 billion. This was the most severe earthquake to strike Indonesia in an active year that saw at least 10 other earthquakes that resulted in deaths or injuries. In early August, a magnitude 6.9 quake that struck the island of Lombok killed almost 600 people and destroyed thousands of houses and buildings, including 80% of the structures in certain areas.
Elon Musk and Tesla Settle SEC Fraud Charges
September 29
Tesla and its then-chairman and CEO Elon Musk agreed to pay separate $20 million penalties and make governance changes to settle securities fraud charges brought by the SEC. The charges stemmed from misleading tweets in which Musk said that he was considering taking Tesla private and had already secured funding for the move when, in fact, no such deal was in place. Although he will remain CEO, as part of the settlement, Musk agreed to step down as chairman and will be unable to assume that role again for three years. Tesla was also required to appoint two new independent directors to its board and put additional controls and procedures in place to monitor Musk’s public communications. Robyn Denholm was named as the new chairwoman in November.
UN Issues Warning About Global Warming
October 8
If global warming continues at its current pace, the average global temperature could reach the crucial threshold of 1.5°C above pre-industrial levels as soon as 2030, significantly increasing the risk of extreme weather, flooding, drought, food shortages, health problems, and animal and plant species loss, according to a report by the United Nations’ Intergovernmental Panel on Climate Change (IPCC). With global temperatures already up about 1°C, global net emissions of carbon dioxide would need to be reduced by about 45% by 2030 and reach “net zero” by 2050 to limit further increases. But researchers warned this would require “rapid and far-reaching” transitions in energy, land, infrastructure, transportation and industrial system use that many may be unable or unwilling to undertake.
Hurricane Michael Hits the Southeast U.S.
October 10
A Category 4 storm with winds reaching up to 155 miles per hour, Hurricane Michael became the strongest hurricane to strike the continental United States since Hurricane Andrew in 1992. Heavy winds and storm surge ravaged the Florida Panhandle, Georgia, the Carolinas and Virginia, killing at least 45 and causing more than $15 billion in damage. It was the second major hurricane of the 2018 Atlantic storm season after Hurricane Florence struck North Carolina in September, causing widespread flooding, more than 50 deaths and over $10 billion in economic damages.Super Typhoon Yutu Becomes Strongest Storm of 2018
October 25
After making landfall in the Northern Mariana Islands and the Philippines with sustained wind speeds of 180 miles per hour, Super Typhoon Yutu became the strongest storm of the year, surpassing Super Typhoon Mangkhut, which struck the same area in September. Yutu was also the second-strongest storm to ever strike any part of the United States (the Northern Mariana Islands are a U.S. territory), only exceeded by a 185-mile-per-hour hurricane that hit the Florida Keys in 1935. By early November, seven super typhoons—a designation given to storms with wind speeds over 150 miles per hour—had formed during the 2018 Pacific typhoon season, resulting in hundreds of fatalities and billions of dollars in damages.
Gunman Kills 11 in Synagogue Shooting
October 27
Eleven people were killed and seven were injured when a gunman opened fire at the Tree of Life synagogue in Pittsburgh in what was the deadliest anti-Semitic attack in U.S. history. One week later another attacker took the lives of 12 people and injured at least 10 others at a country-western bar in Thousand Oaks, California. According to the nonprofit Gun Violence Archive, as of Nov. 15, there were 312 mass shootings in the United States—defined as incidents with four or more shot or killed—in 2018.
Democrats Retake the House in U.S. Midterm Elections
November 6
In what many considered a referendum on Donald Trump’s presidency, the 2018 midterm elections proved to be a mixed bag for both Republicans and Democrats. While the Democrats did win a majority in the House of Representatives, flipping control of the chamber, Republicans retained control of the Senate, gaining two seats in the process. Nevertheless, working with a now-divided Congress will present a new challenge for the Trump administration, particularly as it grapples with important questions about immigration, trade, health care and national security.
Wildfire Rages in California
November 8
As part of yet another active wildfire season, the Camp fire broke out in Northern California and quickly became the most destructive in state history. On November 25, the blaze was declared 100% contained after destroying nearly 19,000 structures, including virtually the entire town of Paradise, which was home to 27,000 people. The fire was also California’s deadliest, killing at least 88 people, while hundreds were still missing. President Trump blamed the disaster on poor forest management and threatened to withhold future federal funding, but firefighters and other experts disagreed, pointing to the unusually dry weather conditions. Earlier in the year, California also saw the largest wildfire in its history when the Mendocino Complex fire burned 459,123 acres—almost 200,000 acres more than the previous record.