Korean Firms Shun Cyber Insurance as Only 6% Buy Full Coverage

South Korean companies are buying only the bare minimum of cyber insurance even as hacking driven by artificial intelligence increases. Only 6% of policyholders bought comprehensive coverage that pays for incident response and recovery along with damages owed to victims.

Of 2,486 new cyber insurance policies written in the first half of this year by five property and casualty insurers — Samsung, DB, Hyundai, KB and Meritz — only 153, or 6.2%, were comprehensive cyber package policies, according to financial industry sources on the 11th. The remaining 2,333 were liability-only policies. Of all 2,486 new policies, 2,293, or 92.2%, were policies required by law.

Under the Personal Information Protection Act, a company must either buy insurance or set aside reserves to cover damages if its revenue in the year exceeded 1 billion won ( $720,000) and it holds personal data on an average of 10,000 or more people a day. The legal minimum coverage ranges from 50 million won to 1 billion won depending on revenue and the number of people whose data is held.

The problem is that companies are buying cyber insurance only to the extent needed to satisfy the legal requirement. Mandatory policies mainly cover statutory liability for damages from data breaches, and the coverage amounts are far too low relative to the scale of actual incidents. Coupang drew up a customer compensation plan worth 16.85 trillion won ( $12.1 billion) last year after a breach exposed data on 33.7 million accounts. Yet Coupang's liability insurance for personal data breaches covered only 1 billion won.

The scope of protection is also limited. Comprehensive cyber insurance covers not only liability for data breaches but also notifying victims, investigating the cause of an incident, restoring data and losses from business interruption. Mandatory policies are far narrower. An official in the financial industry said that 80% of companies with coverage buy only the minimum protection, adding that realistic measures against cyber threats are needed, such as raising the legal minimum coverage amount.

The pace of cyber insurance adoption is also slow. Total new policies at the five insurers rose just 2.1%, from 6,095 in 2024 to 6,220 last year. In the first half of this year, new policies came to 2,486, up 7.8% from 2,307 a year earlier. Even uptake of mandatory coverage is weak. Policies in force across the three types of mandatory insurance stood at 6,158 at the end of June, up 4.2% from 5,907 a year earlier. Compared with the 83,000 to 380,000 companies the Personal Information Protection Commission estimates are subject to the requirement, that works out to between 1.6% and 7.4%.

A senior financial industry official said that the spread of AI-powered cyberattacks is making the scale and scope of damage harder to predict, stressing that authorities should consider making cyber insurance mandatory in the way auto insurance is.