Korea's $3 million cyberinsurance market is a tenth of one US ransomware payout

Sinclair Broadcast Group, the owner of more than 180 US local television stations, lost about $70 million to a ransomware attack in 2021, and cyberinsurance covered roughly $30 million of it ^[9]. That one recovery was ten times the size of Korea's entire cyberinsurance market two years later ^[11]. Korea's $3 million was also about two hundredths of one percent of the $14.1 billion global market that year ^[15].

The Korean figure gets smaller still when divided by the number of policies. The General Insurance Association of Korea recorded roughly 5,000 policies a year from 2021 through 2024 ^[5]. If the $3 million is annual premium, the average Korean cyber policy in 2023 cost about $600 ^[19].

Part of the gap comes from the privacy law. A company that uses the Personal Information Protection Act's reserve option ^[8] holds its own cash against a data-leak liability it could have paid an insurer to carry. That keeps the whole loss with the company. It also means the money goes into a balance-sheet provision and none of it goes to buying cover. For a large bank with capital to spare, a reserve may well cost less than a policy bought in a market of 7,683 contracts ^[5].

The survey points to awareness as the bigger problem. In the Ministry of Science and ICT's 2023 survey of 6,500 companies ^[6], the 7.4% that had bought cover equal about 46% of the 16.1% that knew it existed, on the assumption that every buyer was among those aware of it ^[13]. An unnamed insurance industry source quoted by Korea JoongAng Daily said: "But many small and midsize companies are still unfamiliar with the insurance itself, and premiums can also be a burden, so actual take-up remains limited" ^[10]. The same source said, "Interest in cyberinsurance has increased among large companies since the SK Telecom SIM card hacking incident in April last year" ^[7]. Policies in force rose about 54% above the 2021-2024 level ^[14].

There are three ways the uninsured picture could be wrong. The reserves large firms hold under the privacy law could be big enough to count as self-insurance in all but name. The 54% rise in policies could be the start of large-company buying that the 2023 survey came too early to catch. And the bank attacks ^[18] could turn out to be cheap. The report did not give a cost for any of them or say whether insurance paid for any of it.

We think most Korean companies are paying for cyber incidents themselves, since 92.6% of the firms surveyed had no policy ^[16]. The counter-case is that a big bank can absorb a breach from its own capital more cheaply than it could insure it. A disclosed reserve balance, or a bank saying its attack losses were covered, would show that the protection gap is smaller than the $3 million suggests.