Cyber insurance

What cyber insurance is

A policy for the day your business is hacked, locked out of its own systems or finds customer data has leaked. It pays the people you need in the first hours: an IT forensics team to find and close the breach, lawyers to work out what the PDPA requires you to do, and the cost of telling the customers affected. It restores your data and systems, replaces the income you lose while you cannot trade, and handles a ransom demand through negotiators who do this for a living. If customers or partners whose data was exposed claim against you, or the regulator investigates, it pays your defence and the damages you owe.

The prices above

Three insurers on our panel publish an SME cyber premium table on their proposal forms, and the prices above are read straight from them: Allied World's Cyber Liability Insurance (its June 2025 form), Sompo's SME Data & Cyber Security Insurance (October 2024) and Great American's Cyber Insurance for Small & Medium Enterprises (December 2024). Give your revenue over the last twelve months and the limit you want, and each card is that insurer's premium a year, GST included, for the revenue band you fall in. Allied World and Sompo price a Standard Plan with a S$1,000 excess and sell a Premier Plan at 50% more, which adds hacker theft, loss adjustor, emergency and loss mitigation costs at S$50,000 each; an unlimited retroactive date costs 20% more and is not priced here. Great American prices three limits with a S$5,000 deductible and a 12-hour business interruption wait. All three sell through intermediaries: you apply on the insurer's proposal form, which asks about your business, the data you hold, your security controls and your loss history, and the insurer confirms the premium. The tables are for a business based in Singapore with revenue up to S$20 million and a clean loss history; payment processors, online trading and e-commerce platforms taking payments, data aggregators, gambling, digital currency and financial institutions are outside them (Sompo also leaves out law firms, clinics, insurance brokers and recruiters), and a bigger or excluded business is quoted on enquiry. AIG, Chubb, MSIG, QBE, Tokio Marine, Liberty and Zurich also write cyber cover in Singapore without a published table; ask us and we get their quotes too.

What we need to quote

• What the business does, its annual turnover and headcount
• The personal data you hold: customers, patients, employees, roughly how many records, and whether you keep card details
• How you run: the cloud software and payment systems you use, and whether anyone can sign in from outside the office
• The security you have today: backups kept separately, multi-factor sign-in, antivirus or endpoint protection, software updates
• Cyber incidents, ransomware or data breaches in the last three years, and any claims
• The limit you want, from S$250,000 for a small firm to S$5 million or more for a business with many records or a contract that sets the figure

Before you choose

• The PDPA makes a breach expensive even without a claim. Since 2021 a data breach that is likely to cause significant harm, or that affects 500 or more people, must be reported to the Personal Data Protection Commission within three calendar days of your assessing it as notifiable, and the people affected told. The Commission can fine a business up to 10% of its annual Singapore turnover if that is above S$10 million, and up to S$1 million otherwise. Incident response cover pays for the assessment, the notifications and the lawyers.
• First-party cover is what most small firms use. Claims from others are rarer than ransomware, a mailbox takeover or a payment diverted by a forged invoice. Check that the policy pays your own costs, including business interruption and data restoration, not only your liability.
• Insurers ask about the basics, and may insist on them. Multi-factor sign-in on email and remote access, backups kept off the network, and software kept up to date are the questions on every proposal form. Without them, a quote may come with a higher excess, a lower limit or an exclusion for ransomware.
• Social engineering and funds transfer fraud are often optional. A staff member tricked into paying a fake supplier is one of the most common losses. Make sure that cover is included, and at a limit that matches the payments you make.
• It sits beside, not instead of, your other policies. A business package covers your equipment against fire and theft, not the data on it; professional indemnity covers advice, not a hack. Cyber fills the gap between them.