A wave of cyberattacks on financial institutions is raising fresh worries about how exposed Indian banks are and how large the resulting losses could get. Insurers say they have seen more cyber incidents over the past three to four months.
AU Small Finance Bank is the latest lender in the spotlight. It has said it is looking into a possible data breach linked to a third-party software-as-a-service platform hosted by Salesforce. The platform holds information related to the bank’s auto loan customers.
How many customers were affected, and how much data was exposed, is yet to be established.
Insurance cover in place
The bank holds a ₹100 crore cyber insurance policy from New India Assurance, which could soften the financial hit. According to people familiar with the matter, the lender has not yet informed the insurer about the incident.
The episode follows cyberattacks involving Bank of Baroda and State Bank of India. Together, these point to rising risks across the banking sector.
Insurers say financial institutions and manufacturing companies have both been targeted in recent months. Forensic investigations into several of the hacks are still going on, so it is too early to judge how deep the breaches went or what claims may follow.
AI in the hands of hackers
An insurance industry executive said the pattern is worrying because attackers are increasingly using artificial intelligence to get past even sophisticated security systems. “Our concern is that the depth of penetration could be much higher, which could translate into significantly larger losses,” the executive said.
Ransomware and business interruption are still among the biggest risks. But banks and other financial firms also face potentially large liabilities if customer information gets exposed. This can include know-your-customer documents and financial records.
The costs can add up quickly. They could cover forensic investigations, legal advice, notifying customers, public relations and credit monitoring for those affected.
An executive at a state-owned insurer said the size of the liability would depend on the kind of information compromised, the number of customers affected and what the forensic investigations find.
What policies usually cover
Cyber insurance policies typically pay for forensic investigations, business interruption, legal costs and certain data-related liabilities. All of this is subject to the terms and exclusions of each policy.
Whether an institution’s cover is enough will depend on the scale of the breach and the liabilities that flow from it.
Pressure on premiums
The recent attacks could also push up the price of cyber cover. Premiums have stayed fairly subdued in recent years, at 0.75-1.5% of the sum assured, because claims were low. As the threat landscape becomes more complex, that may change.
For now, insurers are waiting for the forensic findings before they can gauge the likely claims from the attacks. Banks, meanwhile, face the task of working out how much customer data was exposed and whether their policies are large enough to absorb the costs.
Leave a Reply