Cyber Insurance in Singapore: What Does It Cover When a Business Is Hacked?

A business discovers that its order system has stopped working. Staff cannot access customer records, deliveries are delayed and someone is demanding payment to unlock the files. Before the business knows how much revenue it has lost, it needs people who can investigate the attack and help it recover.

Singapore recorded 165 ransomware incidents reported to the Cyber Security Agency in 2025. That figure covers reported ransomware cases, rather than every cyberattack or insurance claim. Smaller businesses were among those most affected.

Cyber insurance can help pay for the response and certain resulting losses. What it pays depends on the cover purchased, the cause of the incident and the conditions attached to each part of the policy.

Who helps during the first hours of an attack?

One useful part of a cyber policy can be access to an incident response team. Insurers offering this service provide a route to specialists when the business needs help urgently, including outside normal working hours.

Depending on the policy, covered response expenses may include computer forensic investigations, legal advice, customer notification and public relations support. These services address different problems: identifying what happened, assessing obligations and communicating with people whose information may be affected.

Contact the insurer through the reporting channel specified in the policy. Ask who will coordinate the response and which appointments or expenses need approval. Hiring a consultant independently does not establish that the insurer will pay the invoice.

Keep the policy details and emergency contacts somewhere accessible if company email is unavailable. Identify who can authorise urgent work and who will keep a record of decisions, invoices and communications.

For a business without its own incident response team, knowing whom to call can be as useful as knowing the insurance limit. That arrangement should be understood before an attack happens.

Will the policy pay to restore data and computers?

Data restoration cover can pay qualifying costs of recovering or recreating information damaged, deleted or encrypted in a covered incident. Software recovery may also fall within the protection purchased.

The distinction between restoring operations and improving them matters. A business may decide that an attack is the right time to replace its entire IT system. The insurer may accept eligible recovery expenses while declining improvements beyond the cover agreed.

Some policies offer specific protection for equipment rendered unusable by malicious changes to software or firmware. This is sometimes called "bricking" cover. Others provide allowances for certain improvements. Neither should be assumed from a general promise to cover data restoration.

Ask the broker to explain three separate items: recovering information, replacing affected equipment and upgrading security. Establish which are covered and what approval is required.

Prepare separate estimates for immediate recovery and longer-term improvements. That helps management understand how much cash the business needs, even when part of the recovery is insured.

What happens when the business cannot trade?

Cyber business interruption insurance can respond to qualifying losses when a covered event disrupts operations. The financial calculation depends on the policy's definition of income loss and the period it covers.

Lost turnover is not automatically the amount payable. The assessment may consider the profit the business would have earned, operating expenses that necessarily continued and costs saved during the interruption. Orders completed later may also affect whether revenue was permanently lost.

Extra expenses incurred to reduce the interruption can be covered under the relevant terms. Keep evidence of the additional spending and why it was needed, alongside sales records, cancelled orders and the recovery timeline.

Check whether a waiting period is a threshold for cover or whether it also removes the initial hours from the loss calculation. Establish when the insured recovery period ends.

An outage at a cloud or other service provider raises a further question. Dependent business interruption cover can address certain supplier-related disruptions, but the provider and the cause must meet the policy's definitions. Cover for an attack on the business's own systems does not establish cover for every supplier outage.

List the external services that would stop trading if unavailable, then test them against the proposed wording.

Does cyber insurance pay a ransom?

Some policies include cyber extortion protection. Depending on the wording, this may cover specialist assistance and certain payments made in response to an insured threat. Payment cover is subject to applicable law, policy conditions and any required insurer consent.

The Singapore Police Force strongly discourages paying ransom. Payment does not guarantee that files will be decrypted or that stolen information will remain unpublished. It can also expose the business to further demands.

An extortion clause should therefore never be treated as permission to pay whoever contacts the company. Involve the incident response team, insurer and legal advisers, and report the attack to the authorities. Legal restrictions, including applicable sanctions, need to be assessed before any payment is considered.

Restoring from usable backups may address encrypted files, but it does not resolve the separate problem of information already stolen. The business still needs to establish what was accessed and what obligations follow.

Ask how any ransomware-specific limit, deductible or percentage contribution would affect the recovery costs as well as the extortion claim.

What if the attacker steals money?

A fraudulent transfer needs its own coverage check.

Consider an employee who receives a convincing message asking for a supplier payment to be sent to a new bank account. The employee approves the transfer, believing the request is genuine. That differs from an attacker directly manipulating a system to steal funds.

Cyber products available in Singapore can offer protection for social engineering, invoice manipulation, computer fraud or funds transfer fraud. These categories have their own definitions and may be optional. An insurer's willingness to pay for investigating a compromised mailbox does not establish that it will reimburse the missing money.

Ask for an answer using the company's actual payment process. Would cover apply if an authorised employee approved the payment? What if the request came from a supplier's compromised email account? Does a separate crime policy respond?

Check the relevant limit and any payment-verification conditions. A large overall cyber limit is little help if the particular fraud has a much smaller allowance or falls outside the cover purchased.

The finance team should understand these distinctions before relying on the policy when approving payments.

Are customer claims and regulatory penalties covered?

The business's own recovery expenses are often described as first-party losses. Claims made against it by customers or other outside parties fall under third-party liability cover.

A covered privacy or network security claim may bring legal defence costs and compensation within the policy. Regulatory proceedings may have separate protection. The precise allegations, policy trigger and exclusions still determine whether cover responds.

Read any promise to cover fines or penalties carefully. Singapore insurance product descriptions qualify this protection by whether the penalty is insurable under applicable law. That wording does not guarantee reimbursement of every regulatory penalty.

Ask how legal fees affect the available limit. If defence costs reduce the same limit used for compensation, a lengthy dispute can leave less money for a settlement.

Businesses serving customers overseas should also check the insured entities, territorial scope and jurisdictions covered. A Singapore policy should be reviewed against where the company operates and where a claim could arise.

Does insurance change the duty to report a data breach?

The business remains responsible for assessing and meeting its reporting obligations.

Under Singapore's Personal Data Protection Act, a breach is generally notifiable to the Personal Data Protection Commission if it causes, or is likely to cause, significant harm to affected individuals, or affects a significant scale of individuals. The prescribed scale threshold is 500 or more people.

Once the organisation assesses a breach as notifiable, it must notify the PDPC as soon as practicable, and no later than three calendar days after the day of that assessment. This is not a blanket deadline of 72 hours from discovering any cyber incident. Begin the assessment promptly; the notification window is no reason to postpone it.

Notification to affected individuals generally applies where the significant-harm test is met, subject to the statutory exceptions. A breach meeting only the scale threshold does not automatically require the same individual notifications.

Legal advisers provided through a policy can help with this assessment. Notification to the insurer, however, does not replace notification to the PDPC. The business should not wait for an insurance coverage decision before meeting a legal deadline.

Assign responsibility for these decisions in advance, with legal support available when needed.

A simple example: how much would the insurer pay?

Imagine a fictional Singapore wholesaler with a covered cyber incident. Its policy has S$250,000 of remaining insurer payment capacity and one S$10,000 deductible for this incident.

For this example, assume the insurer has approved the response costs, all applicable conditions are met, and no additional sub-limits or percentage contributions apply. The business interruption figure below already reflects the policy's waiting-period rules, saved expenses and other required adjustments.

The insurer pays S$90,000: S$100,000 of eligible loss less the S$10,000 deductible. This is within the remaining payment limit.

The business bears S$25,000 of the items shown: its deductible plus the excluded upgrade. Any other uninsured losses would be additional.

These are invented figures and terms, not typical claim costs or a quotation. A real policy could apply different deductibles or limits to different sections. The example shows why the total incident cost, the eligible loss and the insurer's payment need to be calculated separately.

Which conditions can change the result?

Read the schedule and endorsements alongside the main wording. Endorsements amend the contract and can change how a particular event is treated.

Some policy forms use specific provisions for ransomware, widespread attacks or exploitation of neglected software. These may alter limits, the amount retained by the business or the percentage of loss each party bears. Their effect cannot be judged from the overall insured amount.

The information supplied when applying for cover also matters. Insurers may ask about multi-factor authentication, protected backups, endpoint protection and previous incidents. The answers should describe what is actually in place across the systems being insured.

Have the people responsible for IT verify those answers. If an important control exists only for some users or systems, explain the limitation. Inaccurate material information can put coverage at risk; the consequences depend on the circumstances and applicable terms.

Ask the broker to identify relevant exclusions, reporting requirements and any continuing security obligations. Keep the completed application with the policy so management can review what was declared.

What should a business check before buying or renewing?

Use a realistic incident from the company's operations to review the proposed cover:

• Response: Who can be contacted immediately, and which specialists or expenses require approval?
• Recovery: What data, software and equipment costs are included?
• Downtime: What triggers cover, how does the waiting period work and how is loss calculated?
• Suppliers: Which outsourced services and causes of disruption qualify?
• Fraud: Is money transferred after an impersonation scam covered?
• Liability: What protection applies to customer claims and regulatory proceedings?
• Limits: Which deductibles, sub-limits and shared limits could affect the same incident?
• Responsibilities: Who will notify the insurer, assess legal obligations and document the claim?

Then consider the cash the business would need while recovering. Ask how approved expenses are funded and when claim payments can be made. Even a substantial limit does not tell management whether payroll, suppliers and urgent recovery bills can be paid on time.

For an investor or prospective buyer, the same exercise is useful during due diligence. Request the actual policy and application, then compare them with the business's systems, suppliers and recovery plan.

Cyber insurance can fund essential help and absorb part of the financial loss after a hack. Its value depends on whether the purchased protection matches the incident the business could face, and whether management knows how to use it when operations stop.

To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.

To pick up a draggable item, press the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in its new position, or press escape to cancel.