Cyber insurance helps a Singapore SME pay for the fallout of a hack, ransomware attack or data leak: incident response and forensics, restoring data, lost income while systems are down, notifying affected people, and defending claims and regulatory investigations that follow. It does not stop the company being legally responsible. Without cover, every one of those costs comes out of the company’s own cash, usually in the same weeks that it cannot trade normally. Policies also carry exclusions, sub-limits and conditions, such as patching and multi-factor authentication, which decide whether a claim is actually paid.
What does cyber insurance actually cover?
Most SME cyber policies have two halves. First-party sections pay the company’s own costs and losses; third-party sections respond when someone else claims against the company. Wordings differ between insurers, so treat this table as a map of the usual building blocks, not a promise of what any policy says.
| Section | What it typically pays | Points to check in your wording |
|---|---|---|
| Incident response | A breach hotline, IT forensic investigators, legal advisers to manage the response, and sometimes public relations support | Whether you must use the insurer’s panel firms, and whether costs incurred before you notify the insurer are covered |
| Data and system restoration | Rebuilding servers, restoring data from backups, recreating lost data where possible | Betterment exclusions: upgrading to better systems than you had is often not covered |
| Business interruption | Loss of net profit and extra costs while systems are down | The waiting period (often a number of hours before cover starts), the indemnity period and whether outages at your IT or cloud provider are included |
| Cyber extortion | Specialist negotiators and, where lawful and agreed with the insurer, a ransom payment | Insurer consent before any payment, sanctions restrictions and sub-limits |
| Notification and support | Notifying affected individuals, call centres, credit or identity monitoring | Whether voluntary notification (not strictly required by law) is covered |
| Privacy and network security liability | Defence costs and damages if customers, employees or business partners claim the company failed to protect their data or passed on malware | Contractual liability exclusions for indemnities you agreed to beyond what the law would impose |
| Regulatory defence | Legal costs of responding to a regulator such as the Personal Data Protection Commission (PDPC), and penalties only where insurable by law | Many policies say “where insurable”; whether a regulatory penalty can be paid by insurance is a legal question, not just a policy one |
| Payment card liability | Contractual assessments and forensic costs after a card data breach | Often a separate sub-limit |
Money stolen through a fake invoice may need a separate crime or social engineering extension, and claims that your professional service was negligent usually belong under professional indemnity insurance.
What does an uninsured SME have to pay for itself?
A serious incident creates several bills at once. Without insurance, the company typically carries all of them:
- Forensic and IT recovery work to find out how the attacker got in, remove them and rebuild systems.
- Lost trading while orders, invoicing, payroll or bookings cannot run.
- Legal advice on whether the breach must be notified under the PDPA, explained in our guide to mandatory data breach notification, and on contractual notice clauses.
- A PDPC investigation and possible financial penalty. For breaches on or after 1 October 2022, the maximum is S$1 million or, for organisations with annual Singapore turnover above S$10 million, 10% of that turnover. Our article on what PDPC penalties look like in real cases sets out actual amounts.
- Claims by customers or business partners whose data was exposed or whose operations were disrupted by your incident.
- Management time and reputation, which policies generally touch only through public relations costs.
For a small company the real danger is cash flow: forensic firms and lawyers need paying while revenue has stopped.
Which exclusions and conditions catch SMEs out?
Disputes over cyber claims usually turn on the small print. Read these closely:
- Known or prior incidents. Policies usually exclude incidents that began, or that you knew about, before the policy started or before a retroactive date.
- Minimum security conditions. Some wordings make cover conditional on maintaining measures declared in the proposal form, such as multi-factor authentication or regular backups. If the proposal form said these were in place and they were not, the insurer may dispute the claim.
- Unpatched systems. Some policies restrict cover where a known vulnerability was left unpatched for a stated period.
- War and state-backed attacks. Since 31 March 2023, Lloyd’s has required standalone cyber policies written in its market to exclude losses from certain state-backed cyber attacks, in addition to war exclusions. Other insurers use their own versions.
- Contractual liability. Liability you take on under a contract beyond what the law would impose, such as an uncapped indemnity, may not be covered.
- Notification and consent conditions. Most policies require prompt notice to the insurer and forbid admitting liability, settling or paying a ransom without the insurer’s written consent.
- Claims-made trigger. Liability sections usually respond to claims first made, and notified, during the policy period. Letting a policy lapse can leave later claims about earlier incidents uninsured.
If an insurer later declines a claim, our guide to disputing a rejected insurance claim in Singapore explains the options.
What will an insurer ask before offering cover?
Expect detailed questions on these controls, and answer accurately, because an inaccurate answer can undermine a later claim:
- Multi-factor authentication on email, remote access (VPN) and administrator accounts.
- Offline or immutable backups, and when restoration was last tested.
- How quickly security patches are applied, especially on firewalls and internet-facing systems.
- Endpoint detection software and who monitors its alerts.
- Staff phishing awareness training.
- A written incident response plan with named decision-makers.
- Payment verification procedures for changes to supplier bank details.
- How many personal data records you hold and whether sensitive data is encrypted.
The Cyber Security Agency of Singapore (CSA) runs two certification marks. Cyber Essentials is aimed at SMEs and covers baseline measures; Cyber Trust is a risk-based mark for larger or more digitalised organisations. CSA’s own pages state that certified organisations are eligible for discounted rates from a list of participating cyber insurance providers. Certification funding for a first Cyber Essentials or Cyber Trust certification, and co-funding for CISO-as-a-Service, are covered in our guide to cybersecurity grants for Singapore SMEs.
How should an SME decide how much cover it needs?
- List what would stop you trading. Accounting, ordering, booking and payroll systems, and which ones are hosted by a vendor.
- Estimate downtime. How long would it take to rebuild from backups, and what gross profit would be lost each week?
- Count the personal data. Number of customers, employees and job applicants, and the sensitivity of what you hold. Breaches affecting 500 or more individuals, or likely to cause significant harm, must be notified to the PDPC.
- Read your contracts. Customer contracts and tenders may require specific cyber or professional indemnity limits and may contain indemnities.
- Check existing policies. Some package or professional indemnity policies include cyber extensions with low sub-limits.
- Compare wordings, not just limits. Waiting periods, sub-limits for extortion and social engineering, panel firm requirements and the definition of “computer system” (does it include your cloud provider?) matter as much as the headline sum insured.
Cover itself should be arranged through an insurer or insurance broker licensed by the Monetary Authority of Singapore. Raffles Corporate Services does not sell or advise on insurance.
Example: an 18-person logistics company
Example: A Singapore freight forwarder with 18 staff runs bookings, invoicing and payroll on a single server managed by an outsourced IT vendor. A staff member’s VPN password is stolen and ransomware encrypts the server on a Monday morning. The company cannot issue invoices or track shipments for nine days.
With a cyber policy that includes business interruption, the company calls the insurer’s hotline, panel forensic investigators are appointed, and restoration costs and lost profit after the waiting period are claimed, subject to the deductible and limits. If forensics show the VPN had no multi-factor authentication although the proposal form said it did, the insurer may dispute the claim. Without any policy, the company pays the forensic firm, the IT vendor’s emergency rates and legal advice itself, while carrying nine days of lost billing and the risk of a PDPC investigation.
The first 72 hours of a case like this are covered step by step in our guide to responding to a ransomware attack on your company.
Cases from the news: when cyber cover was disputed or missing
Merck and the NotPetya war exclusion. The 2017 NotPetya malware attack disrupted thousands of computers at the pharmaceutical group Merck. Its property insurers relied on a war exclusion, arguing the attack was a hostile act linked to Russia. As reported by Insurance Journal and other outlets, a New Jersey appellate court ruled in May 2023 that the insurers had not shown the exclusion applied, and in January 2024 Merck and its insurers settled on undisclosed terms shortly before the case was due to be argued in the New Jersey Supreme Court. Reports put the disputed coverage at around US$700 million.
Mondelez and Zurich. The food company Mondelez sued its insurer Zurich after a NotPetya claim of around US$100 million was declined under a war exclusion. As reported by The Register and other outlets in November 2022, the parties settled on undisclosed terms during the trial. The lesson for SMEs: exclusion wording, and how an attack is attributed, can decide whether a claim is paid, and disputes can take years.
Ezynetic, Singapore. In its published decision of 2025, the PDPC found that Ezynetic Pte. Ltd., a software provider to licensed moneylenders, suffered a ransomware incident in June 2024 in which personal data of 190,589 individuals was exfiltrated and offered for sale on the dark web. The PDPC imposed a financial penalty of S$17,500 and directed the company to obtain CSA’s Cyber Trust certification for its new network. The PDPC refused to reduce the penalty because of the company’s heavy remediation spending and operational losses. Those recovery costs and lost income are the first-party losses a cyber policy is designed to pay, where its terms are met.
Is cyber insurance compulsory in Singapore?
There is no general law requiring Singapore companies to buy cyber insurance. In practice, cover is often required by customers, tenders and outsourcing contracts. The Government’s inter-agency Counter Ransomware Task Force, in its report published by CSA in November 2022, recommended exploring ways to increase take-up of cyber insurance among SMEs, noting that business income loss and incident response expenses can be claimed where the policy criteria are met, and that underwriting requirements can push organisations to adopt better security.
Insurance also does not replace the company’s legal duties. The PDPA’s protection obligation requires reasonable security arrangements whether or not the company is insured, and directors remain responsible for overseeing cyber risk, which we discuss in our article on directors’ personal exposure for cyber risk.
Frequently asked questions
Will cyber insurance pay a ransom?
Some policies include extortion cover, usually only with the insurer’s prior written consent and where payment is lawful. The Singapore Government strongly discourages paying ransoms, and paying does not guarantee that data will be decrypted or not published. Treat ransom cover as a last resort, not a plan.
Can a cyber policy pay a PDPC financial penalty?
Policies that mention regulatory penalties usually limit cover to penalties insurable under the applicable law, which is a legal question. Legal costs of responding to the PDPC are more commonly covered. Plan on the basis that the penalty itself may not be recoverable; our guide to a PDPC investigation explains the process.
Our IT vendor has insurance. Is that enough?
No. The vendor’s policy protects the vendor, and its contract may cap its liability to you. Under the PDPA, your company generally remains responsible for personal data processed on its behalf. Our article on who is liable when an IT vendor is hacked explains the allocation.
Will a policy cover an attack that started before we bought it?
Generally not if you knew about it, and often not if the intrusion began before the policy’s retroactive date. Attackers can sit inside a network for weeks before striking, so disclose any suspicious activity on the proposal form.
Do we need Cyber Essentials before an insurer will cover us?
It is not a legal requirement, and insurers set their own underwriting criteria. CSA states that certified organisations are eligible for discounted rates with participating cyber insurance providers, and certification gives you documented evidence of the controls a proposal form asks about.
Official sources: CSA, Cyber Essentials mark; CSA, Counter Ransomware Task Force report; PDPC decision, Ezynetic Pte. Ltd. [2025] SGPDPCS 2; Personal Data Protection Act 2012; Singapore Police Force, ransomware advisory.
Cyber insurance itself should be arranged through a licensed insurer or insurance broker.
Need help with a cyber incident or a claim after a data breach?
If your company, or you as a director or shareholder, is dealing with a cyber incident, a data breach investigation or a claim from a customer after a hack, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, for example if a claim is made against your company or you are sued, we will refer you to a firm on our panel of Singapore law firms that regularly handles data protection, technology and insurance disputes. Raffles Corporate Services is a corporate services provider, not a law firm or insurer, and this article is general information, not legal or insurance advice.
The Raffles Corporate Services Editorial Team, Raffles Corporate Services