Under attack, banks bolster cyber covers, opt for higher sum assured to protect against hits

Mumbai: Large financial services companies are seeking to expand their cyber insurance cover amid rising frequency of cyberattacks and increasing cost of business disruption, even as competition among insurers keeps premiums under pressure.

A large non-bank financial company plans to buy a cyber insurance policy of ₹2,000 crore next month, up from ₹1,400 crore last year, according to an insurance industry executive familiar with the placement. The increase reflects concerns that even a temporary disruption to technology systems could result in a substantial financial loss.

Also read | Bond yields muddy the books as banks prepare for new accounting rules


"We are seeing increasing interest in higher cyber insurance limits, particularly among large banks, NBFCs and financial institutions," said Najm Bilgrami, head of Casualty and Financial Lines Product at Tata AIG.

Growing digital dependence and interconnected systems are prompting companies to reassess their covers, he said. "Cyber risk is now viewed as a board-level risk, resulting in greater focus on balance sheet protection against severe cyber events," said Amarnath Saxena, chief technical officer, commercial, at Bajaj General Insurance.

Business Interruption

For large financial institutions, the biggest impact often is the loss arising from systems remaining unavailable after an attack, rather than the immediate cost of the breach.

Besides business interruption, ransomware, data theft, cyber extortion and third-party liabilities are among the key risks.

Ambiguity in Wordings

In one of the largest cyber insurance claims, amounting to about ₹700 crore, forensic and legal expenses accounted for nearly 30% of total cost, Tata AIG's Bilgrami said. For institutions handling large transaction volumes, even a brief disruption can lead to significant losses and costs related to system restoration, forensic investigations, technology consultants, customer communication and the replacement of compromised debit cards.

Also read | India to launch new cheque book rules from January 1, 2027? RBI clarifies

"Ransomware attacks, bricking, privacy and data breaches, as well as direct theft of money through cyberattacks, are the major drivers for NBFCs to seek increased cover," Saxena said.

Recent cyber incidents involving Bank of Baroda, State Bank of India, Central Bank of India and AU Small Finance Bank have brought the vulnerability of financial institutions into focus. Insurers have reported several attacks on financial services and manufacturing companies over the past three to four months. Investigations into some incidents are ongoing.

Insurers are increasingly concerned about hackers using AI to identify vulnerabilities and breach IT systems. A deeper breach could expose customer KYC documents and financial records, increasing liabilities as well as cost of notifying affected customers and monitoring compromised data.

Little Change in Policy Terms

Despite the growing use of AI in cyberattacks, insurance policy wordings have not changed significantly. Policies generally cover the financial consequences of an incident, irrespective of whether it involves AI, a rogue employee or compromised data, subject to policy terms and exclusions. "Only a handful of insurers are currently asking specific questions and evaluating clients' AI exposure," Bilgrami said, adding that underwriting discipline will be important as new risks emerge. Policy wording itself remains a concern, with gaps between different sections of cover potentially complicating claims.

While the Digital Personal Data Protection Act, expected to be implemented in May 2027, could increase the financial consequences of data breaches, it has not yet triggered a significant rise in cyber insurance purchases, an industry executive said.

Competition Keeps Premiums in Check

Despite rising threats and demand for higher limits, cyber insurance premiums remain unchanged at 0.75%-1.5% of the sum assured. A firm buying a ₹2,000 crore cyber insurance cover would likely pay annual premium of about ₹15-30 crore, depending on its risk profile, claims history and cybersecurity controls.