Cyberattacks rise as Korea's insurance against them lags

Korea’s cyberinsurance market remains tiny despite mounting attacks, leaving many businesses exposed to potentially crippling losses.

A string of cyberattacks on Korean companies, including financial firms, has increased the need for insurance that covers response costs and losses from business disruptions, but the market remains small.

U.S. broadcasting giant Sinclair Broadcast Group, which owns more than 180 local television stations, suffered a ransomware attack in 2021 that disrupted broadcasts and exposed data. The attack caused $70 million in losses, but cyberinsurance covered roughly $30 million of the damage.

U.S. media at the time pointed to the rapid growth of the cyberinsurance market as companies faced a growing wave of hacking incidents.

Chinese AI tool linked to Korean bank hacks halts public updates as suspect denies involvement

Chinese AI tool linked to Korean bank hacks halts public updates as suspect denies involvement

Police add personnel to team investigating cyberattacks against financial institutions

Police add personnel to team investigating cyberattacks against financial institutions

Banks promise full compensation after hacks, but many may get left out

Banks promise full compensation after hacks, but many may get left out

Korea has recently suffered a string of AI-based cyberattacks in major commercial banks such as KB Kookmin and Hana and even churches.

Korea’s cyberinsurance market, however, remains far smaller than those of other major economies, which has raised concerns that companies have little financial protection against cyberrisks.

The global cyberinsurance market more than doubled from $5.9 billion in 2019 to $14.1 billion in 2023, according to a report released Friday by the Korea Insurance Research Institute. The market is projected to reach $29 billion by 2027.

Korea’s cyberinsurance market, by contrast, was worth just $3 million in 2023. Japan’s, at $196 million, was 65 times larger, and Australia’s, at $476 million, 159 times larger.

Cyberinsurance also accounted for just 0.004 percent of Korea’s overall non-life insurance market.

A total of 7,683 cyberinsurance policies were in force last year, according to the General Insurance Association of Korea. That was up from the roughly 5,000 policies recorded annually from 2021 through 2024, but the market remains at an early stage.

Low awareness among companies is another obstacle.

Only 16.1 percent of the 6,500 companies surveyed by the Ministry of Science and ICT in 2023 said they were aware of cyberinsurance, and only 7.4 percent had purchased it.

“Interest in cyberinsurance has increased among large companies since the SK Telecom SIM card hacking incident in April last year,” an insurance industry source said. “But many small and midsize companies are still unfamiliar with the insurance itself, and premiums can also be a burden, so actual take-up remains limited.”

Regulatory factors have also slowed the market’s growth.

Korea’s Personal Information Protection Act requires companies above a certain size to prepare for liability arising from personal data leaks and similar incidents. Companies, however, are allowed to set aside their own reserves instead of purchasing insurance, which weakens the incentive to buy coverage.

Some companies also prefer to absorb cyberrisks themselves rather than disclose incidents outside the company, which has further held back demand for cyberinsurance.

BY PARK HYUN-JU [[email protected]]

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.