5 insurers post 26.4% rise in cyber insurance premiums in H1

Package products account for 73% of market; mandatory coverage falls 5.7%

Korea Insurance Research Institute warns mandatory limits too low for real risks

[Getty Images Bank]
[Getty Images Bank]

A string of hacking incidents and personal data breaches is driving rapid growth in cyber insurance sales among South Korea's non-life insurers. Leading the expansion are "cyber package" products that bundle broader coverage — including data recovery and business interruption losses — beyond what mandatory policies require.

According to the General Insurance Association of Korea, five non-life insurers — Samsung Fire, Hyundai Marine & Fire Insurance, DB Insurance, KB Insurance and Meritz Fire & Marine Insurance — collected 31.3 billion won ($23.6 million) in cyber insurance premiums in the first half of this year, up 26.4 percent from 24.8 billion won in the same period last year. New contracts rose 7.8 percent, from 2,307 to 2,486. For all of last year, combined premiums reached 52.5 billion won, up 23.8 percent from 42.4 billion won the year before.

Cyber package products drove the growth. First-half premiums for these products reached 23 billion won, a 43.5 percent jump from a year earlier, and their share of total cyber premiums expanded from 64.6 percent to 73.3 percent. In addition to liability for personal and confidential data breaches, cyber packages cover data recovery costs, business interruption losses, cyber extortion payments to hackers and reputation management expenses.

Mandatory insurance, by contrast, lost ground. First-half premiums for electronic financial transaction liability insurance and personal data protection liability insurance (Types I and II) fell 5.7 percent to 8 billion won, from 8.5 billion won in the same period last year. Financial companies and electronic financial service providers are required to hold electronic financial transaction liability coverage, while personal data protection liability insurance is mandatory for companies with annual revenue of at least 1 billion won and an average daily user base of at least 10,000 people.

Experts say mandatory coverage alone is insufficient to handle large-scale incidents. "Cyber risk is highly volatile and difficult to measure, and the current mandatory limits are too small to cover its unpredictable dimensions," said Kim Su-bin, a researcher at the Korea Insurance Research Institute.

A lack of loss data for insurers to assess risk and design products is another constraint. "Because hacking methods all differ, you need an accumulation of cases — attack techniques, scale of damage — before they can be turned into usable data, and compared with other types of risk, that body of cases is still relatively small," Kim said.

Overseas, a trend is emerging in which cyber-specialist insurers are combining with large insurance groups. According to a Korea Insurance Research Institute report titled "Changes in Market Entry Paths for Cyber Insurance Specialists," Allianz Commercial announced in May that it would transfer its standalone commercial cyber insurance portfolio to specialist insurer Coalition. Munich Re signed a deal in August to acquire At-Bay at an enterprise value of $575 million. The industry expects the consolidation of cyber insurance underwriting capacity through the pairing of technology platforms with large capital to continue.

Researchers also see potential for a similar technology-and-capital model to emerge in South Korea, with security firms serving as technology platforms and existing insurers providing the capital. Kim said insurers must first build up their own cyber insurance capabilities to make that possible. "Some insurers, like Hanwha General Insurance, already have dedicated cyber insurance units," she said. "There needs to be institutional support — whether through setting up cyber insurance divisions, more actively selling related products, or helping them take root more broadly."


won@heraldcorp.com