Banks Increase Cyber Insurance Cover Amid Rising Threats
Two large Indian banks—HDFC Bank and SBI—recently disclosed that they have cyber insurance cover nearly Rs 750 crore.
Indian banks and financial services companies are boosting their cyber insurance cover at a time when businesses have become increasingly reliant on digital technologies. The Covid-19 crisis, which has forced companies to work from home, has increased the already elevated risk of cyber attacks.
Two large Indian banks recently disclosed that they have cyber insurance cover of $100 million or nearly Rs 750 crore. HDFC Bank Ltd. made the disclosure at its annual general meeting last week. State Bank of India disclosed that it has a $100 million cyber risk cover in its recently released annual report.
This, according to industry executives that BloombergQuint spoke to, is significantly higher than the average cyber insurance cover of Rs 150-200 crore taken by Indian lenders in the past.
Annual reports of other large banks did not disclose the extent of cyber insurance cover.
Enhanced Covers and New Clients
Insurance executives that spoke with BloombergQuint say that since the onset of pandemic in the country, enquiries for cyber insurance has increased by 60-70% and sales of cyber insurance policies have increased by 20% during the same period.
The cyber insurance market is growing by 40% year-on-year, said Sanjay Datta, chief of underwriting, claims and reinsurance at ICICI Lombard General Insurance Co. Ltd. Datta said clients are asking for slightly higher limit this year compared to previous years, as organisations are adapting to a work from home model in the post-pandemic world. This increases the risk of organisations being hit by cyber attacks as employees are working on unsecure home networks.
Within the financial sector, cyber insurance requests from cooperative banks have increased as the Reserve Bank of India has mandated tougher cyber security standard.
“We’re seeing a lot of inquiries from cooperative banks and it has gone up by 50%, while companies with existing covers are asking for an enhancement of their cover on an average by around 30-35% due to the increased risk-perception,” said TA Ramalingam, chief technical officer, Bajaj Allianz General Insurance Co. Ltd.
Cooperative banks currently fall behind private lenders in the preparedness against cyber risks, said Ramalingam. “But the awareness is growing and in the next six months we will see more of them buy this policy cover.”
Demand for such cover extends beyond the financial sector as well.
“The Indian cyber market has seen a big upswing in the last 24 months. The insurance limits are going up due to increase threat perception in WFH scenarios,” said Sanjay Kedia, country head and chief executive officer, Marsh India Insurance Brokers Pvt. Ltd. “Overall, the cyber threat landscape will continue to evolve and we have already seen shifts in ransomware attack behaviours.”
Kedia said a lot of manufacturing firms are also seeking cyber insurance policies while Indian firms with global operations are driving cyber insurance purchases due to data leakage threats and large fines imposed by regulators in the European Union, for instance.
Startups, especially those with large technology operations and customer data, are buying cyber insurance policy covers worth around $1-2 million, while established fintech firms, such as payment companies, typically opt for a cover of at least $5-10 million, the executives cited earlier said.
Pricing The Policy
To price and underwrite a cyber insurance policy, insurers need to conduct a thorough review of a bank or companies’ cyber-security policies and capabilities, governance framework and calculate a risk-based ‘expected loss’ analysis.
Once this due-diligence is done, if the cover is small, the insurer will issue the policy. However, in the case of a larger policy cover, a re-insurer also needs to be roped in as part of the underwriting process.
Milind V Kolhe, chief underwriting and reinsurance officer at Bharti AXA General Insurance, explained the larger insurance players in India have strong capacity to provide the cover and in most cases don’t need a re-insurer. But when the policy is very large and if the insurance company doesn’t have the capacity, then re-insurance is required.
Covid-19 Risks and Insurance
BloombergQuint reported on June 24, there has been a rise in cyber attacks since the onset of the pandemic, with Indian cooperative banks, the Department of Refinance within the National Bank for Agriculture and Rural Development and IDBI Bank Ltd. bearing the brunt.
In the wake of the pandemic, the IT arm of the Reserve Bank of India, the Reserve Bank Information Technology Pvt., said in its May newsletter that it’s necessary to relook at the current cyber insurance coverage and scope, given the rise in cyber attacks against companies and consumers.
“In the pre-Covid-19 world, most banks didn’t have facilities that supported remote working. However, Covid-19 pandemic necessitated them to move fast and enable remote working for their employees,” said Himanshu Dubey, director of Quick Heal Security Labs. “The move opened up new avenues for cyber attackers and there will be a growth in cyber attacks amid the Covid-19 pandemic.”
According to Sanjay Kaushik, managing director, Netrika Consulting India Pvt., a security and risk management consultancy, there have been 60% increase in cyber claims as compared to pre-lockdown or pre Covid-19 period.
“Cyber insurance still has not seen mainstream adoption for organisations exploring it as a secondary risk transfer tool. But, with the current crisis, data theft, malicious external attacks and ransomware are expected increase multi-fold,” he said. “As a result, we expect to see more liabilities, filing of claims and settlements.”