Bank cyberattacks raise insurance claim fears

Mumbai: Recent cyberattacks on financial institutions, including AU Small Finance Bank, are heightening worries about banks' increasing susceptibility and the potential magnitude of losses. Insurers have noted a surge in cyber incidents over the past few months. AU Small Finance Bank is probing a possible data breach involving a third-party Salesforce platform holding auto loan customer data.

The bank holds ₹100 crore cyber insurance from New India Assurance, which might mitigate financial repercussions. However, the lender has not yet notified the insurer, according to sources. The scope of potential data exposure and the number of affected customers remain unclear.

This follows cyberattacks on Bank of Baroda and State Bank of India, signaling heightened risks across the banking sector. Insurers have observed a wave of attacks on financial institutions and manufacturing firms in recent months. Forensic investigations into several hacks are ongoing, making it premature to ascertain the extent of breaches and potential claims.

The recent attacks are troubling because hackers are leveraging artificial intelligence to breach even fortified security systems. An insurance executive expressed concern that the depth of penetration could be greater, leading to substantial losses.

Ransomware and business interruption pose significant risks, but financial institutions face potentially hefty liabilities from customer information exposure, including know-your-customer documents and financial records. The costs could encompass forensic investigations, legal advice, customer notifications, public relations, and credit monitoring for affected customers.

The liability's scale hinges on the compromised information's nature, the number of affected customers, and forensic investigation findings. Cyber insurance policies generally cover forensic investigation expenses, business interruption, legal costs, and certain data-related liabilities, contingent on policy terms and exclusions. The adequacy of an institution's coverage depends on the breach's scale and resulting liabilities.

The recent raids might also exert pressure on cyber insurance premiums, which have remained modest at 0.75-1.5% of the sum assured in recent years due to low claims. As the threat landscape becomes more intricate, insurers may reassess coverage adequacy.