Asia saw a significant increase in cyber attacks, particularly ransomware, over 2024 which drove a 14% increase in cyber insurance claims, according to law firm RPC.
Cyber attacks involving data breaches, cloud outages, and critical infrastructure failures rose significantly in 2024 according to RPC, which said there was an average of 2,510 weekly attacks per organisation in Q2 2024 – a 23% increase from the same period in 2023.
Asian entities were particularly exposed to ransomware attacks, which surged by 38%, accounting for 16% of all global attacks.
A large number of high profile public and private organisations in Asia were hit by data attacks last year, such as Union Hospital in Hong Kong fell victim to a malicious cyberattack that resulted in a US$10m ransom demand.
Hong Kong business park Cyberport, as well as the SAR’s Consumer Council and the local arm of NGO Oxfam were targeted with ransomware attacks, resulting in personal data leakages, and RPC said the combined impact of these events was to increase cyber insurance claims.
“The financial sector was also heavily targeted. The surge in cyberattacks likely explained the 14% rise in large cyber claims in Asia during the first half of 2024.
Demand for cyber insurance in Asia remained high, prompted by the need for robust cybersecurity, rate reductions and expanded coverage in the region,” RPC said.
Data protection laws
A number of Asian countries are looking to manage the growing cyber threat by beefing up their data protection laws and imposing stricter data processing and breach notification requirements, with Japan, South Korea and Singapore, all tightening regulations in 2024.
“The frequency and severity of cyberattacks are escalating as financial services become increasingly digitalised.
Cybercriminals now leverage AI deepfake technology and social engineering tactics to create highly realistic videos and phishing attacks for malicious purposes such as identity theft and fraud,” RPC said.
The law firm said that as a result of these trends the Asian cyber insurance market is projected to triple in size by 2025, supported by an increased regulatory focus on the area.
RPC said that both the Hong Kong Securities and Futures Commission (SFC) in Hong Kong and the Monetary Authority of Singapore (MAS), are stepping up their efforts to combat cyber threats and related financial crimes.
The SFC has issued a circular outlining expectations for licensed entities to mitigate AI-related risks, while the MAS has established the Cyber and Technology Resilience Experts Panel in November to advise on emerging cyber risks in the financial sector.
“Demand for cyber insurance is therefore anticipated to grow as businesses seek more robust cybersecurity measures and cover,” RPC said.
Cyber ILS expands
Just as 2024 saw a rise in Asian cyber incidents it also witnessed a rapid expansion of the nascent global cyber insurance linked securities (ILS) market which is rapidly emerging as an alternative capital source for the sector.
“With over US$750 million invested in underwritten 144A catastrophe bonds and growing recognition among ILS investors, Cyber ILS is becoming an essential tool for underwriters aiming to manage systemic risks and increase capacity,” broker Gallagher Securities, said in a January report.
The cyber ILS expanded in 2023, with the Cairney I, II, and III transactions sponsored by Beazley and placed by Gallagher Re. These issues introduced scalable cyber cat bond lite structures to institutional investors.
The market continued to expand in 2024 with the issuance of underwritten Rule 144A catastrophe bonds such as PoleStar Re, Long Walk Reinsurance, and Matterhorn Re.
“Most recently, PoleStar 2024–3 became the largest cyber cat bond to date, securing $210 million and highlighting the strong ILS investor appetite for cyber risk.
These bonds, largely targeting remote cyber risks, integrated cyber risk into mainstream capital markets,” Gallagher Securities said.
Falling “innovation premium“
Gallagher Securities said that as a result of these securities being issued the “innovation premium” demanded by investors to take on cyber risk is reducing as the insurance sector gains experience and understanding of the risk.
“Over time, the accumulation of empirical data and the development of more robust risk models have, and will continue to, alleviate these concerns, enabling more precise assessments of cyber exposures,” Gallagher Securities said.
“As confidence grows in the ability to model and price cyber risks accurately, both the innovation and uncertainty premiums are expected to reduce, fostering more efficient capital deployment and sustainable market growth,” the firm added.
