Mumbai: The spate of cyberattacks targeting financial institutions, including the one involving AU Small Finance Bank, is raising concerns about the growing vulnerability of banks and the potential scale of losses, with insurers reporting an increase in cyber incidents over the past three to four months.
AU Small Finance Bank said it's investigating a potential data breach involving a third-party software-as-a-service platform hosted by Salesforce that holds information related to auto loan customers. The bank has a ₹100 crore cyber insurance cover from New India Assurance, which could help cushion the financial impact. However, the lender has not yet intimated the insurer, according to people familiar with the matter. The extent of the potential data exposure and the number of customers affected are yet to be established.
Also read: PB Fintech's UAE insurance business grows 19-fold as it looks beyond motor cover
This follows cyberattacks involving Bank of Baroda and State Bank of India, pointing to growing risks across the banking sector.
Insurers said they had witnessed a spate of attacks on financial institutions and manufacturing companies in recent months. Forensic investigations into several hacks are still underway, making it too early to determine the extent of the breaches and the potential claims.
"The spate of attacks we are witnessing is worrying because hackers are increasingly using artificial intelligence to breach even sophisticated security systems," an insurance industry executive said. "Our concern is that the depth of penetration could be much higher, which could translate into significantly larger losses."
Insurers Look around for Cover as Number of Cyberattacks Rises
While ransomware and business interruption remain major risks, financial institutions face potentially significant liabilities from the exposure of customer information, including know-your-customer documents and financial records. The costs could extend to forensic investigations, legal advice, customer notifications, public relations and credit monitoring for affected customers.
"The scale of the liability will depend on the nature of the information compromised, the number of customers affected and the findings of forensic investigations," said an executive at a state-owned insurer.
Cyber insurance policies typically cover expenses related to forensic investigations, business interruption, legal costs and certain data-related liabilities, subject to policy terms and exclusions. The adequacy of an institution's cover will depend on the scale of the breach and the liabilities arising from it.
The recent raids could also put pressure on cyber insurance premiums, which have remained relatively subdued at 0.75-1.5% of the sum assured in recent years amid low claims, as the threat landscape becomes more complex.
