Hello, friendInsurance LeagueWelcome back to our trusted education platform for insurance and risk management. This time, we’ll discuss an increasingly crucial issue in 2025: cyberattacks and their relevance to the importance of cyber insurance. In today’s digital world, a single click can cripple your business — unless you’re prepared for it.
Today’s business world is inseparable from digital technology. From small and medium-sized enterprises to large corporations, all business activities are now directly connected to internet networks, applications, and cloud-based data storage. While this convenience increases efficiency, it also opens the door to new risks:increasingly sophisticated and detrimental digital domain attacks.
The year 2025 will be a critical point in the digital security landscape. The emergence of technologies such asArtificial Intelligence (AI), deepfake, and automated phishingCyber threats are evolving far faster than most companies are prepared to deal with them. In fact, cybercriminals now don’t need advanced technical skills—because services are available.Ransomware as a Service (RaaS)can now be purchased freely on the dark web.
In Indonesia, several major incidents have begun to open the eyes of many business players. E-commerce customer data leaks, attacks on financial systems, and threats to vital infrastructure like hospitals and ports have demonstrated that digital risks know no industry boundaries.
The question now is no longer “Will my business be attacked?”but”When will my business be attacked, and how prepared am I for it?”
In this situation, technical protection measures alone are not enough.Businesses also need strategic protection in the form of digital security insurance., which can provide financial, legal, and reputational support when an attack occurs.
In this article, we’ll explore why cyber insurance will be so important in 2025, what the risks are, and how companies can begin developing a modern, comprehensive cyber risk protection strategy.
Cyber Attacks Are Becoming More Sophisticated and Affordable
A few years ago, cyberattacks were synonymous with bespectacled hackers in dark rooms infiltrating systems through technical loopholes. But now, the threat map has changed completely. In 2025, attacks will not only be more clever, but also much cheaper and easy to do— even by individuals without special skills.
- AI-Powered Phishing & Deepfake: Top Target Executives
One of the most dangerous trends today is the use of AI to fake the voices and faces of company leaders. This mode is known asBusiness Email b. Compromise (BEC)or more specifically: CEO Fraud The perpetrators used AI to impersonate the CEO’s voice and then contacted the finance department, ordering an urgent transfer of funds to an offshore account. If they weren’t careful, internal staff could be fooled by the voice sounding completely authentic.
Deepfakes are also increasingly being used to deceive investors, vendors, or even regulatorsThis is no longer a future issue — it’s happening in Asia, Europe, and even Indonesia.
- Ransomware-as-a-Service (RaaS): Pay a Subscription, Attack Anyone
Now anyone can become a digital criminal. With just USD 100–300 per month, someone can hire a service.Ransomware-as-a-Service (RaaS)to attack target companies. This platform is similar to SaaS (Software as a Service), complete with a dashboard, support, and even helpdesk for the perpetrator.
What does it mean? Threats no longer come only from elite international hacker groups, but can be carried out by business competitors, former employees, or anonymous individuals.
- Supply Chain Attack: The Domino Effect of a Single Vendor
Companies that think their systems are secure often forget:threats can also come from vendors or technology partnersIf your ERP system provider is attacked, all client companies could be affected. This is known as supply chain attack, and the impact can be massive.
For example, an attack on an international logistics management software provider paralyzed hundreds of ports for days. Some of its clients even lost access to data and control of their shipments for weeks. Often, the attackers do not attack you directly, but target weaker third parties.
Recent Cyber Incidents in Indonesia & Globally (2025)
- January 2025 – Local e-commerce under attack: The data of 1.2 million customers was leaked, including names, addresses, and shopping histories. The Ministry of Communication and Information Technology (Kominfo) fined them, and a consumer lawsuit was filed in court.
- April 2025 – Ransomware attack on a private hospital in Jakarta: The digital medical records system was inaccessible. Patient surgeries were postponed. Management had to pay billions to restore the system and its reputation.
- May 2025 – National logistics company falls victim to supply chain breach: The shipping app crashed for three days. A major client threatened to terminate the contract. A forensic audit identified the IT vendor as the source of the incident.
The realization, digital world attacks are now increasingly sophisticated, widespread, and easily mobilizedAll companies—large, small, public, and private—are vulnerable to attack. Even companies that don’t store consumer data can be operationally impacted.
At this point, businesses need to ask:
“If I were attacked tomorrow morning, how long could my company survive?”
That is why protection strategies must not only be technical, but also strategic and financial.
What are the Impacts of Digital Attacks on Companies?
Many companies still view attacks on digital components as purely a technical issue. However, the impact doesn’t stop at the IT department. In fact, when an attack occurs, the first to be hit is operational, financial, reputational, and market confidence.
Here are some serious impacts that business decision makers need to understand:
- Operational Disruption: Systems Down, Business Stops
One of the direct consequences of a cyber attack is operational system paralysisRansomware, for example, encrypts all data and locks access to internal systems.
In some cases:
- ERP system is unusable → warehouse & shipping stops.
- Cashier application is offline → the shop cannot serve customers.
- Server down → e-commerce website is down, customers cannot make transactions.
Losses due to this downtime can reach hundreds of millions to billions of rupiah per hour, depending on the scale of the business. Worse still, if a company doesn’t have backups and a recovery plan, recovery times can be very long.
- Reputational Loss: Loss of Customer & Investor Trust
Of the digital era,reputation is a very fragile asset. A single data breach incident can destroy years of customer trust.
- Consumers may stop making transactions because they feel unsafe.
- Investors and business partners considered the company to be managerially incompetent.
- Social media and negative news worsen public perception.
In fact, surveys show more than60% of Indonesian consumers will not return to using services from companies that experience data breaches.—regardless of whether they are compensated or not.
- Huge Hidden Costs
In addition to the direct losses from business disruption, technology attacks also causeinvisible costswhich are often more expensive than the initial damage. Some of them are:
- Digital forensic investigation to trace the source of the attack
- Lawyer services to face a lawsuit
- PR and crisis communications team to reduce negative news
- Compensation costs for customers or vendors who are harmed
- System recovery & reinvestment in IT security
And it should be noted: all these fees must be paid in cash and immediately.If a company does not have cash reserves or insurance support, this can significantly disrupt cash flow.
- Regulatory & Legal Risks: Sanctions & Lawsuits Increase
Our country and many other countries are now organizing personal data protection and reporting obligationsIn Indonesia, the Personal Data Protection (PDP) Law has been actively enforced since 2024.
It means:
- Companies that neglect to safeguard data can be subject to fines.administrative sanctions, fine, even criminal.
- If an incident occurs and is not reported within the specified time, the legal risks are multiplied.
- Consumers can sue companies collectively.
At this point, many managers are just realizing that online attacks are not just a matter of data loss, but it can also lead the company into litigation, asset seizure, and even bankruptcy.
From a business perspective, cyber attacks are a total crisis. It hits from many directions—not only digital, but also financial and reputational.
The solution is not just add antivirus or change password. Companies need a more strategic approach:comprehensive protection that includes technical, managerial, and financial protection such as cyber insurance.
Why Is Cyber Insurance a Strategic Need?
To address cyber risks, most companies have taken technical measures: strengthening firewalls, using encryption, setting up restricted access, and training IT teams. But modern cyberattacks not only rely on technological gaps—but also on human gaps and weaknesses in business processes.
Therefore, protection strategies should not stop at technical security.Companies need to build a “last line of defense” that can save operations, finances, and reputation when all other systems fail.This is the reason why cyber insurance is increasingly being considered as strategic risk mitigation tools.
- Cyber Insurance Provides Financial Protection During a Crisis
When a digital attack occurs, companies not only lose data or time, but also have to spend a large amount of money suddenly. By having a cybersecurity insurance policy, businesses can gain coverage for the following costs:
- Data and system recovery encrypted or damaged by ransomware
- Digital forensic expert services to investigate the source and impact of the incident
- Legal fees & legal aid if the company is sued by customers, regulators, or partners
- Communication crisis management, including PR services to restore reputation
- Compensation for third party losses, such as affected customers or vendors
- Lost income because the system cannot operate (business interruption)
It’s not just about “compensation”, but about speed of business recovery after a crisis.
- Helping Management Make Quick Decisions During Incidents
In the first 48 hours after an attack, companies are under immense pressure: customers panic, the media is asking questions, IT teams are overwhelmed, and management has to make quick decisions. In these circumstances,support from insurance providers and broker partners is vital.
Cyber insurance policies usually also involve quick access to a team of incident experts, including:
- Incident response team
- Digital forensics consultant
- Cyber security negotiator(for ransomware cases)
- Legal advisor
In other words, Cyber insurance doesn’t just provide money, but also a team of digital firefighters ready to step in.
- As a “Trust Signal” in the Digital Economy Era
Many companies in the B2B, export-import, and digital sectors are now requiring their partners to have cyber insurance. This is part of vendor compliance, especially for companies that manage customer data or critical systems.
Having cyber insurance shows that:
- Your company is serious about operational security & sustainability
- There is a commitment to protect third parties from shared risks.
- The company is ready to face audits or due diligence from major partners.
Even in some international tenders,cyber insurance becomes a mandatory requirement to be able to pass verification.
- Complementary to Existing IT Security Systems
Some IT managers feel they don’t need insurance because their systems are already secure. But keep in mind:no system is 100% impenetrable.
- Insurance does not replace a firewall or SOC (Security Operation Center), but protect if the system fails.
- Just as firefighters don’t prevent fires, they help minimize the impact when a fire occurs.
Within the framework of risk management,insurance is the last safety net— and that’s what makes the difference between companies that can rise, and those that collapse.
Who Needs Cyber Insurance?
There’s still a perception out there that only large tech companies need cyber protection. In reality,Any type of business that uses digital systems, stores data, or relies on online operations — is at risk.
Even MSMEs can now become targets, especially with the increasing number of random attacks using automated software.
Here are someBusiness profiles that are highly recommended to have cyber protection:
- Financial & Fintech Companies
- Stores large amounts of customer data
- Process transactions in real-time
- Must comply with data security regulations from OJK & Bank Indonesia
- The risk of financial data leaks is very high
Examples: Digital banks, payment gateways, application-based savings and loan cooperatives
- Hospitals & Healthcare Facilities
- Storing highly sensitive digital medical records
- High dependence on hospital information systems (SIMRS)
- Attacks can lead to failure of patient care
Examples: Private hospitals, large-scale clinics, medical lab & test service providers
- E-Commerce and Digital Enterprise
- Transactions are conducted entirely online
- Stores user personal data: address, card number, shopping history
- Often a target for phishing or consumer data theft
Examples: Marketplace, digital startup, food or service ordering application
- Logistics, Forwarders, and Supply Chain Operators
- Rely on shipping management & tracking software
- The big risk of supply chain attacks
- Downtime causes logistics delays & contract cancellations
Examples: shipping companies, trucking, air cargo & ports
- Manufacturing & Energy Industry
- Digital system connected production automation (Industrial IoT)
- An attack could halt production processes for days.
- Frequently targeted by ransomware attacks to “hold down factories”
Examples: textile factories, automotive, mining, food & beverage factories
- IEducational Institutions & Public Institutions
- Store student, employee, and important academic document data
- Often have weak and out-of-date IT systems
- Vulnerable to being a target due to low protection
Examples: universities, international schools, certification bodies
- All Businesses That Store Third Party Data
Even if your company is not in the technology sector, as long as it keeps:
- Customer data
- Data vendor
- Digital contract & transaction information
Examples: legal consultants, travel agencies, HR agencies, outsourcing companies
Basically, Cybersecurity insurance is relevant for all businesses that are connected to digital systems.By 2025, this will mean nearly every sector—from app-based bakeries to multinational corporations. And the need will only become more pressing in the future.
Conclusion and Recommendations
In this era, the business world has changed fundamentally. Almost all activities—from internal communications, transaction recording, customer management, to marketing—are carried out online.This transformation is accelerating growth, but it also opens many doors to cyber risks.
And here’s the reality:Digital World attacks do not select victims based on company size.In fact, the perpetrators often target MSMEs or medium-sized businesses, which they consider “weakly defended.” They know that small to medium-sized companies often lack the necessary infrastructure.m dedicated IT, cybersecurity budget, or adequate data recovery systems.
On the other hand, large companies face pressure from regulators, shareholders, and market reputation. They may have sophisticated IT systems, but they are still vulnerable to human error (human error), phishing attacks, or third-party threats in their digital supply chain. In other words, all businesses are vulnerable.
In this condition,Cybersecurity insurance can no longer be considered an additional expense that can be postponed.It is an integral part of modern risk management — a financial, reputational, and operational safeguard when the worst happens.
This insurance also helps companies recover more quickly from attacks, maintain customer trust, and meet increasingly stringent legal and regulatory obligations — such as Indonesia’s Personal Data Protection Law (PDP Law).
L&G Insurance Broker is here to provide a trusted solution, helping you design appropriate, effective, and efficient coverage. Don’t wait until problems arise. Protect your business today and ensure every customer vehicle entrusted to you is fully protected.
📞 Contact L&G Insurance Broker now at 0811 850 7773
