Abstract
The digitalisation drive in India has led to increased organisational dependence on IT infrastructure, cloud computing, and digital transactions. At the same time, cyber attacks like ransomware, phishing, and data breaches have also increased. These cyber attacks have substantial financial implications for organisations due to business disruption, recovery of data or assets, and regulatory fines.
The paper aims to study the financial implications of cyber attacks and cyber insurance as an emerging risk management mechanism. The study is based on descriptive analysis of secondary data from existing reports and studies. The paper also draws on the experience of interns who worked with brokers and underwriters to understand the cyber insurance market. The study covers the global/Indian cyber threat landscape, cyber insurance claims, sectors like BFSI, healthcare, and IT, and the growth of the cyber insurance market.
The study found that sectors dealing with sensitive data are at a higher risk of financial loss. At the same time, cyber insurance policies are increasingly linking their policies to the quality of cybersecurity measures adopted by organisations. The study also found that traditional risk management practices are not sufficient to address cyber attacks; hence, organisations need to adopt robust risk management practices, including cyber insurance.
1.0 INTRODUCTION
Today’s digital world is heavily dependent on IT, internet services, and cloud services for smooth business operations. This has led to increased vulnerability to various cyber attacks, including ransomware, phishing, data breaches, etc.
For example, a renowned international car manufacturing company was forced to shut down its production units due to a ransomware attack, resulting in billions of dollars in lost revenue. In another case, a renowned digital payment service provider in India was hit by a massive data breach, resulting in substantial costs for investigations and notifications.
This is a clear indication that even if an organisation has implemented various IT security measures, including firewalls and antivirus programs, it is still likely to face substantial financial consequences due to cyber attacks.
2.0 Financial Impact of Cyber Attacks
2.1 Cyber attacks result in various financial losses for organisations:
Business Interruption: System failure causes business interruption. The organisation is not able to perform any business activities. The machines are not operating, banks are not able to perform transactions, or hospitals are not able to provide services. Even for a few hours of business interruption, lakhs or crores are spent.
2.2 Data Recovery:
After a ransomware attack or data deletion, organisations seek experts’ advice for data recovery. Crores are spent by organisations for data recovery. The organisation needs to provide detailed reports to the insurance.
2.3 Regulatory, Reputational & Third Party Impact
Regulatory Penalties: The new Indian data regulations mandate RBI/IRDA notification within very tight timeframes. Non-compliance attracts hefty fines and legal costs of lawsuits filed by customers.
3.0 CYBER INSURANCE: COVERAGE AND RISK ASSESSMENT
3.1 Key Coverage Components
Reputation Damage: Data breaches destroy customer confidence. Fintech/Health Insurers losing 5-10 per cent of customers face permanent loss of revenue.
Third Party Liability: Data breaches of cloud providers/payment gateways make main organisations liable for supply chain failure lawsuits filed by customers.
Business interruption: Revenue losses due to system downtime caused by ransomware or network attacks.
Cyber extortion/Ransomware – Payment demands and negotiation expenses (although it is recommended that the payment is not made).
Regulatory fines and penalties – Fines for data protection regulations under RBI, IRDAI, or the upcoming DPDP Act regulations.
3.2 Underwriting Requirements
Customer notification expenses – Notifying customers as per regulations.
Legal defence expenses – Legal fees that may be required if customers or partners make claims against the company.
However, cyber insurance is not automatically provided. Before providing cyber insurance policies, a thorough analysis is done on the company’s cyber security measures.
This includes:
1. The implementation of multi-factor authentication for all systems
2. The regular update of all systems’ software
3. The regular backup of data
4. Employee cybersecurity training programs
5. Vendor and third-party risk management
6. Incident response planning and testing
7. Compliance with RBI cybersecurity framework or sector-wise regulations
From my experience during the internship program, I found that insurance companies decline policies or charge higher premiums for those who don’t have basic controls like MFA or backups. Companies that have better cybersecurity governance receive better terms for their policies or lower premiums. This shows that cyber insurance is best used with proper risk prevention measures.
Thus, we can see that the process of assessment proves that cyber insurance is not meant to replace cybersecurity practices but is actually a partner to them. The financial risk is only transferred to the insurance company, which can’t be mitigated by controls.
4.0 CYBER RISK LANDSCAPE IN INDIA
Figure 1: Distribution of Cyber Attack Types (% of Incidents)
The cyber threat landscape in India has become one of the most challenging in the world due to the rapid digital transformation that has taken place in all industries. With over 15 billion transactions per month via UPI, 500 million users for online banking, and massive customer data for e-commerce websites, the cyber threat landscape has increased manifold. According to the latest reports on the cyber threat landscape in India, the country has recorded hundreds of millions of malware detections in the last few years. Ransomware and phishing have dominated the cyber threat landscape in India.
4.1 Key Industries Experiencing the Highest Level of Exposures
Banking, Financial Services, and Insurance (BFSI): Phishing attacks, business email compromise, and fraudulent fund transfer remain the key cyber threats for the BFSI sector in India due to high-value transactions and customer data.
Healthcare: Ransomware attacks on patient data and hospital systems have become a major concern for the Indian healthcare sector.
IT Services and Technology: Insider threats, vulnerabilities in software applications, and intellectual property theft remain a major concern for India’s largest export industry.
Government and Public Services: Digital platforms are opening doors for nation-state players and hacktivists.
4.2 Regulatory Environment:
The RBI’s cyber security framework, IRDA’s data protection guidelines, and the upcoming Digital Personal Data Protection (DPDP) Act have made compliance a necessary requirement for organisations. Organizations are now under strict deadlines for breach notifications, as low as 6 hours in some cases, and are facing heavy fines for non-compliance. Data from CERT-In shows that cybercrime in India is growing exponentially, with financial sector attacks leading in both volume and severity.
Third-party and supply chain risks are a newly emerging concern in cyber security, especially for organisations in India, as many are relying on cloud services, payment gateways, SaaS, and vendors from other nations for their operations. During underwriting discussions in my internship, I learned that vendors’ security questionnaires are now a requirement for cyber policies by insurers.
Despite increasing awareness about cyber insurance, the adoption rate is still low. In India, only fewer than 1% of Indian firms are covered by cyber insurance policies, while in developed countries the rate is 10-15%. The key challenges to cyber insurance adoption are the lack of awareness about the coverage of cyber insurance policies, high premiums for cyber insurance policies, and the idea that “basic antivirus is enough.” However, with increasing regulatory penalties and sophistication of cyber attacks, the demand for cyber insurance policies is expected to grow exponentially in the coming years.
The increasing digital footprint of Indian businesses, coupled with the regulatory environment and the need for cyber insurance policies, presents challenges as well as opportunities for the insurance industry to develop specific cyber risk products.
5.0 Analysis of Cyber Insurance Claims
Figure 2: Percentage Share of Cyber Insurance Claims by Incident Type
Analysis of cyber insurance claims has shown that there are patterns that exist on the type of cyber incidents that result in the most financial losses. Ransomware cyber attacks are at the top of the list, representing almost 40% of all cyber insurance claims. When a company pays a ransom or has a cyber attack that results in a prolonged period of downtime, the financial losses quickly add up to crores of rupees. Manufacturing companies and the healthcare industry have the most costly ransomware cyber insurance claims due to operational dependencies.
Third-party vendor cyber incidents represent the second most costly cyber insurance claim. This type of cyber crime occurs when a company’s cloud provider, payment gateway, or a software company has a cyber breach rather than the company itself. A third-party vendor cyber breach can result in liability claims from a number of customers.
The cost of data breach notification is another cost element that tends to surprise organisations. Even when no financial data is compromised, organisations have to notify their customers, provide credit monitoring services, and handle call centre activities. Such costs are 20-25% of the overall claims incurred by an organisation.
Business email compromise (BEC) continues to be a threat for financial services organisations in India. In BEC attacks, cyber criminals pretend to be executives or vendors to authorise fraudulent fund transfer requests. Though each incident is for a lower amount, the high number of incidents results in BEC claims for insurers.
5.1 Sector-wise claim distribution:
BFSI – 45% of total claims (phishing, BEC, fund transfer fraud)
Healthcare – 20% (ransomware attacks, data breaches on patients)
IT services – 15% (intellectual property theft, vendor breaches)
Manufacturing – 10% (production downtime, supply chain breaches)
Retail/e-commerce – 10% (payment card breaches, customer data breaches)
Figure 3: Sector-wise Distribution of Cyber Insurance Claims (%)
During discussions on internships, market observations for the Indian market indicated that the severity of claims has increased 3x since 2023. Insurers are finding it challenging to balance premium growth against increasing claim severity. There are waiting periods for high-risk covers like ransomware.
The low claim settlement ratio also poses an awareness challenge. While organisations expect claim settlements for all losses, policy exclusions for “known vulnerabilities” and “poor security practices” mean that claims are only partially settled. The disparity between expected and actual claim settlements highlights the need for better policy wording and client awareness at the placement stage.
Key takeaway for Indian insurers: The claims data highlights that cyber risks are highly concentrated in digital-first industries. Product innovation in vendor risks, regulatory fines, and business interruptions will be key growth drivers for the market as awareness improves.
6.0 Recommendations for Effective Cyber Risk Management
For Organisations:
- Basic cybersecurity measures to be adopted immediately:
- Enable MFA for all systems and applications
- Schedule regular software updates for all systems
- Store critical data with daily backups at a secure offsite location
- Schedule quarterly cybersecurity training for all employees
- Risk assessment to be done
- Identify all third-party vendors and their cybersecurity practices to be done annually
- Test incident response plans every 6 months via tabletop exercises
- Vulnerability scans and penetration tests for critical systems
- Develop simple cybersecurity questionnaires that are accessible for SMEs
- Work with cybersecurity companies for cost-effective risk assessments
- Offer premium discounts for well-managed organizations
- Improve client education
- Host regular webinars on the value of cyber insurance and claims processes
- Share anonymized case studies of claims experiences to educate clients
6.1 Combined Approach for Maximum Protection:
The best approach is to take a combined approach that includes prevention + detection + response + insurance. Organizations should invest in prevention measures that minimize the risk of an attack occurring, but also have insurance in place to mitigate financial risk when attacks are inevitable. This is a win-win for both parties.
Regulatory compliance remains a non-negotiable. RBI, IRDAI, and the upcoming DPDP Act make reporting of regulatory breaches and data protection a necessity. The costs of non-compliance are far greater than the direct attack costs. Therefore, insurance for regulatory fines is a must.
In my experience during the internship program, it has been noted that organisations that take a proactive approach to regulatory compliance are rewarded with far more advantageous terms. This shows that cyber insurance is best implemented as part of a holistic approach to risk management.
7.0 Conclusion
The increasing dependency of organisations on technology has given rise to a critical financial and strategic concern for organisations. Cyber attacks such as ransomware, phishing, and data breaches have started affecting organisations in India in the form of business interruptions and financial losses. The study demonstrates that technical controls in organisations do not suffice in protecting against cyber attacks. Despite robust technical controls in organisations, losses can still be high. In such a scenario, the importance of cyber insurance in managing the financial impact of a cyber attack is critical. At the same time, there is a trend towards linking insurance policies and premiums to the quality of cybersecurity governance and compliance in organisations. BFSI, healthcare, IT services, and digital platforms that handle sensitive data face a high incidence rate of losses. Trends in claims suggest that ransomware attacks, breaches via vendors, and business email compromises are some of the key causes of losses.
Nevertheless, awareness and adoption of cyber insurance are still low among Indian businesses, owing to various misconceptions and the basic nature of IT infrastructures employed by these businesses. A dual approach is therefore required, where strong technical measures are employed alongside risk assessment, vendor management, employee training, and effective cyber insurance. This would go a long way in building the financial stability of Indian businesses against various emerging cyber attacks.
Authored by:
Charu Srivastava
PGDM – Insurance Business Management
Birla Institute of Management Technology, Greater Noida
