While COVID-19 dominated news cycles and redefined the risk landscape throughout the year, 2020 also saw more than its fair share of non-pandemic risk events. The following is a review of some of the year’s most notable, underscoring the dynamic and challenging landscape risk professionals have had to navigate, and the events that may shape current and future threats to organizations around the world.
For more on the most important risk events related to the pandemic in 2020, read the COVID-19 Pandemic Timeline.
CCPA Goes into Effect
January 1
The California Consumer Privacy Act (CCPA) became the first wide-reaching digital privacy legislation implemented in the United States. The CCPA imposes stringent consent and disclosure obligations for certain companies that collect the personal information of Californians, whether the company is based in California or not. Noncompliance can result in civil penalties of up to $7,500 per violation. It also allows consumers to opt out of data collection and to request that companies delete their personal information. On November 3, voters passed the California Privacy Rights Act, an expansion of the CCPA, which will go into effect on January 1, 2023.
Flash Floods, Record Rainfall Batter Asia
January 2
Flash floods caused by record-breaking rainfall in the Indonesian capital of Jakarta killed more than 40 people and left some 400,000 people homeless. The city is particularly vulnerable to flooding because extracting groundwater for years has caused it to sink. In July, China faced heavy floods that killed 158 people, destroyed 41,000 homes and damaged another 368,000. And in India, October downpours caused flooding in the city of Hyderabad, killing 16 and severely damaging crops. In all three countries, the rain was the heaviest recorded in decades, a pattern likely to continue as climate change continues to grow more severe.
Earthquake Swarm Strikes Puerto Rico
January 7
A magnitude 6.4 earthquake shook the southwestern part of Puerto Rico, leaving thousands homeless and living in makeshift tent cities, and causing an estimated $3.1 billion in economic damages. It was the largest and most destructive in a series of hundreds of significant earthquakes—also known as an earthquake swarm—that struck the region from late December 2019 to January 2020.
Brushfires Rage in Australia
January 15
Massive brushfires burned across Australia from July 2019 to March 2020, peaking in January. The fires were exacerbated by record-breaking heat and drought conditions that many experts believe were due to climate change. The fires burned more than 46 million acres and destroyed some 3,000 homes, killing 34 people directly and 445 more with smoke inhalation-related respiratory problems. An estimated 1.25 billion animals were also killed. According to the insurance data firm PERILS, insured losses totaled AUS$1.8 billion ($1.3 billion).
Brexit Becomes Official
January 31
Following years of debate and negotiation after residents voted for Brexit in June 2016, the United Kingdom officially departed the European Union. The U.K. now faces a December 31 deadline to negotiate and ratify a new trade agreement, and customs and cross-border work arrangements, among other economic considerations. If they do not meet the deadline, the separation will proceed without a trade agreement, which could seriously disrupt the local economy as the EU market constitutes 43% of U.K. exports and the United Kingdom imports 26% of its food supply from the EU. Beyond the EU, the departure also requires renegotiating trade agreements with other countries, including the United States, and may complicate cross-border business operations for companies with branches in the U.K.
Tornadoes Rip Through Tennessee
March 3
Multiple tornadoes hit central Tennessee, killing 25 people and causing widespread destruction, including partially or totally collapsing almost 50 buildings in Nashville and cutting power to at least 78,000 people across the region. According to the National Oceanic and Atmospheric Administration, the tornadoes caused an estimated $1.6 billion in property damages and approximately $825,000 in crop damage.
Chipotle to Pay Record Fine for Food Safety Violations
April 21
Chipotle Mexican Grill admitted to unsafe food-handling practices that sickened more than 1,100 customers and employees across the United States between 2015 and 2018. The company also agreed to pay $25 million for violating the Food, Drug and Cosmetic Act—the highest food safety fine on record. To resolve the charges, the company will institute an updated food safety program that will include food safety audits and employee training to address the issues that led to the chain’s food-borne illness outbreaks.
Murder Hornets Found in North America
May 4
Asian giant hornets, also called “murder hornets,” were first spotted in December 2019 in Washington and British Columbia. By May, beekeepers reported finding piles of decapitated honeybees, which the hornets destroy in large numbers to feed their young, taking over and inhabiting honeybee hives. If humans are stung multiple times, the hornets can be lethal, but they usually do not kill more than 40 people per year in Asia. The larger threat, experts say, is to honeybee colonies, which are already in danger of population collapse. Falling pollinator populations pose a catastrophic risk to global crops, and the hornets risk escalating this already ongoing crisis.
George Floyd Killing Sparks Mass Protests
May 25
After police in Minneapolis killed George Floyd by kneeling on his neck for over eight minutes, protests against police brutality and systemic racism erupted across the United States and around the world. Despite the dangers of COVID-19, huge numbers of protesters took to the streets and, in many cities, they met with fierce law enforcement reprisal. City governments also instituted curfews and other measures attempting to control demonstrations. While the vast majority of protests were peaceful, riots and looting caused more than $1 billion in insured losses—the most for any civil unrest in recent U.S. history.
Supreme Court Rules on LGBTQ+ Worker Discrimination
June 15
In a 6-3 decision, the U.S. Supreme Court ruled that Title VII of the Civil Rights Act of 1964 applies to LGBTQ+ people, meaning individuals cannot legally be fired for their sexual orientation or gender identity. In the majority opinion, Justice Neil Gorsuch wrote, “An employer who fires an individual for being homosexual or transgender fires that person for traits or actions it would not have questioned in members of a different sex. Sex plays a necessary and undisguisable role in the decision, exactly what Title VII forbids.”
Bayer Reaches $11 Billion Weedkiller Settlement
June 24
Bayer AG said it would pay nearly $11 billion to settle more than 100,000 lawsuits that allege that the company’s Roundup weedkiller causes cancer. As part of the deal, Bayer agreed to pay up to $9.6 billion to settle existing claims and set aside $1.25 billion to settle future claims. In November, the company disclosed that future claims may cost at least and additional $750 million. Since 2018, Bayer has lost three separate Roundup lawsuits totaling more than $130 million in judgment awards. The company inherited the cases when it purchased Monsanto for $63 billion in 2018.
Twitter Hacked in Bitcoin Scam
July 15
Hackers used a phone spearphishing attack against Twitter employees to gain access to 130 Twitter accounts of high-profile individuals such as Barack Obama, Elon Musk, Jeff Bezos and Kanye West, as well as corporate accounts including Apple, Wendy’s and Uber. After gaining control, hackers sent out tweets asking people to send bitcoin to a specific address, promising double the amount in return. The scam netted more than $118,000 worth of bitcoin. The hackers were arrested and charged with various crimes including wire fraud and money laundering. The incident underscored the dangers of cyberattacks leveraging employee access.
Facebook Fined for Facial Recognition Data Violations
July 23
Facebook agreed to pay $650 million to settle a 2015 lawsuit alleging that the company violated Illinois’s Biometric Information Privacy Act (BIPA) by storing facial data to automatically tag users in pictures. The company initially tried to settle the case in January for $550 million, but the offer was deemed too low. Enacted in 2008, the BIPA prescribes a $1,000 fine for any violation, which can increase to $5,000 per violation if a company willfully neglected the law. Instagram, which is owned by Facebook, was hit with a class action lawsuit in August for similar BIPA facial recognition violations that could be worth as much as $500 billion.
Beirut Blast Causes Massive Damages
August 4
A massive explosion at Beirut’s port killed more than 200 people, injured 7,500 and left some 300,000 homeless. While the explosion caused up to $15 billion in damages, the Association of Insurance Companies in Lebanon estimated only $1.5 billion of that was insured. The blast originated in a warehouse where 2,750 tons of ammonium nitrate had reportedly been stored for years without proper safety measures after government officials confiscated the explosive material from an abandoned cargo ship. Public pressure and protests in the wake of the disaster eventually forced Prime Minister Hassan Diab and his entire cabinet to resign.
President Trump Orders TikTok, WeChat Bans
August 6
Citing national security concerns, President Donald Trump issued two executive orders effectively banning Chinese-owned social networking apps TikTok and WeChat in the United States. The orders established deadlines after which U.S. users would not be able to download the apps from mobile app stores and U.S. companies would be barred from doing business with the apps’ parent companies, unless they were sold to U.S.-based operators. However, the bans were temporarily blocked by a federal judge, pending appeal. TikTok and WeChat have 100 million and 19 million U.S. users, respectively. In June, after a border clash between India and China, the Indian government also banned TikTok, WeChat and other Chinese apps, reportedly due to national security and data privacy concerns.
States Sue Over USPS Changes
August 25
New York led a group of 21 states filing lawsuits against the U.S. Postal Service and Postmaster General Louis DeJoy over cost-cutting changes that caused major delays in mail delivery. This was particularly notable given the upcoming U.S. presidential election, which was expected to heavily hinge on mail-in ballots amid the pandemic. In response, DeJoy paused some of the changes until after the election, but many had already been implemented, including the retirement of mail sorting equipment across the country. The changes had already resulted in significant disruption to postal operations, and brought renewed attention to the critical role of USPS in operations for many businesses both receiving and shipping goods, and for those in remote areas.
Russian Hackers Charged for Major Cyberattacks
October 15
U.S. federal prosecutors charged six Russian hackers for perpetrating some of the most notorious cyberattacks in recent years, including the NotPetya malware campaign, the attack on Ukraine’s electric power grid, and the Olympic Destroyer malware attack on the 2018 PyeongChang Winter Olympics. The hackers, all of whom were officers in Russia’s GRU military intelligence agency, are also thought be responsible for spearphishing, malware and hack-and-leak operations designed to disrupt the 2017 French election, a 2018 U.K. nerve agent poisoning investigation, and government and media targets in Georgia. The defendants were charged with conspiracy, computer hacking, wire fraud, aggravated identity theft and false registration of a domain name.
Purdue Pharma Settles Opioid Lawsuits for $8 Billion
October 21
Opioid manufacturer Purdue Pharma pleaded guilty to three felonies and agreed to a settlement worth $8.34 billion to resolve federal charges related to its distribution and marketing of the painkiller OxyContin. The company will also transform itself into a “public benefit company” that will be run by a trust for the purpose of benefiting public interest through drug treatment and other health programs. In November, opioid manufacturer Johnson & Johnson and distributors McKesson, Cardinal Health and AmerisourceBergen also announced a tentative $26 billion deal to settle state and local charges related to the opioid crisis.
Tech Giants Face Antitrust Charges
October 20
Major tech companies continue to face increased pressure from governments around the world for alleged anticompetitive practices. In the United States, the Justice Department and 11 state attorneys general sued Google for violating antitrust laws through monopolistic practices in its search engine and advertising business. The Federal Trade Commission also said it was considering its own antitrust lawsuit against Facebook. In November, the European Union brought antitrust charges against Amazon, accusing the company of illegally using its dominant market position and data access capabilities to gain an unfair advantage over smaller merchants that use its platform. Amazon faces a possible fine of 10% of its annual worldwide revenue, which could be as high as $28 billion based on 2019 figures. The EU has already fined Google more than $9 billion for violating antitrust laws in three separate cases since 2017.
U.S. Government Issues Ransomware Warning to U.S. Hospitals
October 28
The U.S. Cybersecurity and Infrastructure Security Agency, FBI, and Department of Health and Human Services issued a warning about a critical, credible cyberthreat to health care organizations. In October alone, attackers used Ryuk ransomware against dozens of hospitals, demanding payment to either restore operations or sensitive data like research and patient records. According to the FBI, cybercriminals using Ryuk have netted more than $61 million from victims in the United States since 2018. Around the world, hospitals and other health care enterprises have suffered an increasing number of ransomware attacks this year, posing a significant threat amid surging cases of COVID-19.
Earthquake Kills 118 in Turkey and Greece
October 30
A magnitude 7.0 earthquake struck the eastern part of the Aegean Sea, causing millions of dollars in damage in Turkey and Greece. The quake was the deadliest of the year, leaving at least 116 people dead and over 1,000 injured in Turkey, while two were killed and 19 injured in Greece. Turkey experienced a number of significant earthquakes in 2020, including quakes that caused notable damage in January, February and June.
Typhoon Goni Strikes the Philippines
November 1
At least 25 people were killed when Typhoon Goni made landfall in the Philippines. With peak winds of 195 miles per hour, the typhoon was the world’s strongest storm in 2020 and one of the most intense on record. Goni damaged buildings, roads, bridges and farmland, and caused widespread power outages, flash flooding and a mud and debris flow (known as “lahar”) from the Mayon Volcano. The nation was still reeling from Typhoon Molave, which struck just days earlier. That storm was ultimately responsible for at least 70 deaths in the Philippines and Vietnam. Combined, the two storms caused more than $1 billion in damages in the region.
California Passes Measures on Gig Economy, Executive Pay
November 3
California voters passed the state-wide ballot measure Proposition 22, allowing app-based transportation and delivery companies like Uber, Lyft and DoorDash to continue classifying their drivers as independent contractors, rather than employees who would then be entitled to minimum wage, overtime pay and health care. Meanwhile, San Francisco voters approved Proposition L, also known as the “Overpaid Executive Tax.” Companies that do business in the city and have a top executive earning 100 times more than “typical worker pay” will see their taxes increase by 0.1% to 0.6%, depending on the magnitude of the pay gap. The tax is the nation’s first institutionalized measure to address pay disparities between executives and average employees, a social justice and corporate governance issue that has drawn increased attention in recent years, particularly among tech companies based in the region.
Joe Biden Elected U.S. President
November 7
After a prolonged waiting period as states counted a record number of mail-in ballots, Joe Biden was named the winner of the U.S presidential election. His running mate, Kamala Harris, became the country’s first female, Black and South Asian vice president. However, incumbent President Donald Trump refused to concede, launching legal challenges in multiple states and undermining faith in the nation’s democracy with false claims of voter fraud. Nonpartisan experts have lauded the election as the most secure to date, particularly noting cybersecurity improvements since the 2016 election. In January, the Biden administration will have to navigate a sharp partisan divide in both the government and general population while addressing the massive public health and economic issues facing the nation.
2020 Hurricane Season Becomes Most Active Ever
November 10
With the formation of Tropical Storm Theta, the 2020 Atlantic hurricane season officially surpassed 2005 to become the most active on record. Days later, the year’s only Category 5 storm, Hurricane Iota, became the 30th named storm of the season, including 13 hurricanes. Of the six major hurricanes, Laura was the most destructive, causing more than $14 billion in damages along the Gulf Coast, while Eta was the deadliest, killing more than 150 people across Central America. As of November 18, the hurricane season caused over $40 billion in damages and more than 350 deaths.
Wildfires Ravage U.S. West Coast
November 12
The August Complex fire burned more than one million acres before finally being contained, becoming the largest wildfire in California history. As of mid-November wildfires had destroyed more than eight million acres in the Western United States in 2020. Sparked by dry weather, lightning storms and a “gender reveal” gone wrong, fires caused substantial damage and contaminated the air with dangerous amounts of smoke from California to Washington State. Accuweather founder and CEO Dr. Joel N. Myers called 2020 “the worst fire season in history,” estimating that the damages and economic losses would total up to $150 billion.