Cyberattacks rise as Korea’s insurance against them lags

A string of cyberattacks on Korean companies, including financial firms, has increased the need for insurance that covers response costs and losses from business disruptions, but the market remains small.

U.S. broadcasting giant Sinclair Broadcast Group, which owns more than 180 local television stations, suffered a ransomware attack in 2021 that disrupted broadcasts and exposed data. The attack caused about $70 million in losses, but cyber insurance covered roughly $30 million of the damage.

U.S. media at the time pointed to the rapid growth of the cyber insurance market as companies faced a growing wave of hacking incidents.

Korea has recently suffered a string of AI-based cyberattacks in major commercial banks such as KB Kookmin and Hana and even churches.

Korea’s cyber insurance market, however, remains far smaller than those of other major economies, which has raised concerns that companies have little financial protection against cyber risks.

The global cyber insurance market more than doubled from $5.9 billion in 2019 to $14.1 billion in 2023, according to a report released Friday by the Korea Insurance Research Institute. The market is projected to reach $29 billion by 2027.

Korea’s cyber insurance market, by contrast, was worth just $3 million in 2023. Japan’s, at $196 million, was about 65 times larger, and Australia’s, at $476 million, about 159 times larger.

Cyber insurance also accounted for just 0.004 percent of Korea’s overall non-life insurance market.

A total of 7,683 cyber insurance policies were in force last year, according to the General Insurance Association of Korea. That was up from the roughly 5,000 policies recorded annually from 2021 through 2024, but the market remains at an early stage.

Low awareness among companies is another obstacle.

Only 16.1 percent of the 6,500 companies surveyed by the Ministry of Science and ICT in 2023 said they were aware of cyber insurance, and only 7.4 percent had purchased it.

“Interest in cyber insurance has increased among large companies since the SK Telecom SIM card hacking incident in April last year,” an insurance industry source said. “But many small and midsize companies are still unfamiliar with the insurance itself, and premiums can also be a burden, so actual take-up remains limited.”

Regulatory factors have also slowed the market’s growth.

Korea’s Personal Information Protection Act requires companies above a certain size to prepare for liability arising from personal data leaks and similar incidents. Companies, however, are allowed to set aside their own reserves instead of purchasing insurance, which weakens the incentive to buy coverage.

Some companies also prefer to absorb cyber risks themselves rather than disclose incidents outside the company, which has further held back demand for cyber insurance.

BY PARK HYUN-JU [[email protected]]