{"id":7330,"date":"2025-04-17T13:42:33","date_gmt":"2025-04-17T06:42:33","guid":{"rendered":"https:\/\/ligaasuransi.com\/?p=7330"},"modified":"2025-04-17T13:42:33","modified_gmt":"2025-04-17T06:42:33","slug":"menavigasi-keamanan-siber-dan-asuransi-di-indonesia","status":"publish","type":"post","link":"https:\/\/ligaasuransi.com\/en\/menavigasi-keamanan-siber-dan-asuransi-di-indonesia\/","title":{"rendered":"Navigating Cybersecurity and Insurance in Indonesia"},"content":{"rendered":"<p><a href=\"https:\/\/ligaasuransi.com\"><span style=\"font-weight: 400;\">Liga Asuransi<\/span><\/a><span style=\"font-weight: 400;\"> &#8211; Dear readers, welcome to our blog dedicated to risk management and insurance insights in Indonesia. In this edition, we delve into the critical topic of <\/span><a href=\"https:\/\/ligaasuransi.com\/?s=cyber+security\"><span style=\"font-weight: 400;\">cybersecurity<\/span><\/a><span style=\"font-weight: 400;\"> and the role of insurance in safeguarding businesses against digital threats. As cyber incidents become more prevalent, understanding protective measures is essential.<\/span><span style=\"font-weight: 400;\">\u200b<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you find this article informative, please share it with your network. Explore our extensive collection of articles covering various aspects of risk management and insurance to stay informed and prepared in today&#8217;s digital landscape.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Indonesia\u2019s digital economy continues its meteoric rise\u2014221<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">million internet users strong in 2024\u2014yet this growth brings ever<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">escalating cyber peril. In the first half of 2024 alone, Indonesian organizations endured over 43,800 DDoS incidents, including a record 693<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">Gbps attack, underscoring how threat actors are testing\u2014and overwhelming\u2014critical online services\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Meanwhile, Indonesia ranked eighth globally in data breaches during 2023, illustrating that no sector\u2014from e<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">commerce unicorns to state agencies\u2014is immune to data theft and system compromises\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">As businesses accelerate digital transformation\u2014adopting cloud platforms, remote work, and IoT deployments\u2014the attack surface expands. Yet, despite mounting threats, only 12<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent of surveyed firms have reached \u201cmature\u201d cybersecurity readiness, leaving the vast majority vulnerable\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Against this backdrop, cyber insurance emerges not merely as a financial backstop but as a catalyst for stronger security practices. By transferring residual risk and providing access to incident response expertise, tailored cyber policies can help Indonesian companies weather breaches, contain losses, and safeguard their reputations in an increasingly hostile cyber landscape.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Threat Landscape for Indonesian Businesses<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Indonesia\u2019s businesses face a multifaceted and rapidly evolving cyber threat environment. Phishing remains the predominant vector, with SOCRadar reporting 4,046 distinct phishing attacks in 2023, heavily targeting the Information Services sector\u2014a critical pillar of Indonesia\u2019s digital economy\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">LinkedIn analysis further reveals nearly 20,000 phishing attempts from 2021\u20132023, a 38<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent surge, often masquerading as communications from Bank Indonesia or BPJS Kesehatan to trick employees into divulging credentials\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Ransomware incidents are also on the rise. CYFIRMA documented 4,723 verified ransomware victims in Indonesia in 2023, which grew to 5,123 in 2024\u2014an 8.5<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent year<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">over<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">year increase\u2014indicating that threat actors are increasingly deploying encryption-based extortion campaigns against both large enterprises and SMEs\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">High<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">profile cases include the June 2024 LockBit 3.0 attack on government data centers, which disrupted immigration services across major airports and prompted a nationwide audit ordered by President Widodo\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Beyond these, supply<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">chain attacks have emerged as a serious concern. In late 2024, Kaspersky uncovered a PyPI compromise where malicious \u201cJarkaStealer\u201d packages infiltrated software dependencies, demonstrating how attackers exploit trusted development channels to infiltrate Indonesian organizations relying on open<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">source tools\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Finally, DDoS attacks continue to escalate in scale and sophistication: Indonesia experienced a record 693<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">Gbps DDoS incident amid nearly 43,900 total attacks in the first half of 2024, underscoring the threat to e<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">commerce, financial services, and government portals\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Collectively, these threats underscore the urgent need for robust cyber risk management and insurance solutions tailored to Indonesia\u2019s unique threat profile. By understanding the local threat landscape, businesses can better prepare, respond, and transfer residual risk through comprehensive cyber insurance.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Consequences of a Cyber Incident<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">A successful cyberattack can inflict substantial financial losses on Indonesian businesses. According to the 2024 Hiscox Cyber Readiness Report, the average cost of a data breach in Southeast Asia reached USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">2.38<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">million, with Indonesian firms bearing similar burdens in legal fees, forensic investigations, and system restoration\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Ransomware alone cost local organizations an estimated IDR<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">1.2<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">trillion in 2023 through ransom payments and operational downtime, highlighting the direct monetary impact of encryption<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">based extortion.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Beyond immediate out<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">of<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">pocket expenses, cyber incidents can trigger reputational damage that undermines customer trust and brand equity. A 2024 survey by Deloitte Indonesia found that 68<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent of consumers would switch to a competitor following a breach of their data, while 54<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent would hesitate to share sensitive information in the future\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">In sectors such as fintech and e<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">commerce\u2014where trust is paramount\u2014this loss of confidence can translate into long<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">term revenue declines and higher customer acquisition costs.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Moreover, under Indonesia\u2019s Personal Data Protection (PDP) Law, non<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">compliance and breach notification failures carry regulatory fines and sanctions. Organizations may face administrative fines of up to 2<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent of annual revenue, suspension of data processing activities, or forced deletion of data\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Criminal penalties include imprisonment of four to six years and fines ranging from IDR<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">4<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">billion to IDR<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">6<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">billion (USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">246,000\u2013369,000) for severe violations such as unauthorized disclosure or misuse of personal data\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">These combined consequences underscore the critical need for comprehensive cyber risk management and insurance solutions.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Market Overview of Cyber Insurance in Indonesia<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Indonesia\u2019s cyber insurance segment is rapidly emerging within the broader non<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">life market, driven by heightened awareness of digital risks and regulatory mandates. The overall Indonesian non<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">life insurance market is projected to grow from USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">37.22<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">billion in direct written premiums in 2024 to USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">46.72<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">billion by 2029, at a CAGR of 4.65<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent\u2014cyber lines are outpacing this average, expanding at an estimated 20\u201325<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent annually\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Key local and multinational insurers have launched dedicated cyber products: Allianz Indonesia offers \u201cCyber Protect,\u201d covering first<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">party data recovery and business interruption; AXA Mandiri \u201cCyber Secure\u201d includes forensic response and crisis management; Tokio Marine\u2019s \u201cCyber Shield\u201d emphasizes liability defense and regulatory fine reimbursement. Niche players like Chubb and Sompo also tailor solutions for SMEs, bundling cybersecurity assessments with policy placement.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Premium volumes reflect this momentum. According to industry estimates, Indonesian cyber insurance gross written premiums grew from approximately USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">45<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">million in 2022 to USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">68<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">million in 2024\u2014a 51<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent increase over two years\u2014and are forecast to exceed USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">85<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">million in 2025, marking roughly 25<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent year<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">over<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">year growth\u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Underwriting appetite has broadened, though rate adequacy remains under pressure as loss experiences mount.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">As more organizations seek to transfer residual cyber risk, the market is expected to mature further, with product innovations (parametric triggers, bundled risk engineering services) and enhanced data analytics driving underwriting precision and competitiveness.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Break down core policy components and popular add<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">ons.<\/span><\/h3>\n<h4><i><span style=\"font-weight: 400;\">Types of Cyber Insurance Coverage<\/span><\/i><\/h4>\n<p><span style=\"font-weight: 400;\">Cyber insurance policies typically consist of first<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">party and third<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">party coverages, with a range of optional add<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">ons designed to address specific risks. Below is a breakdown of core components and popular enhancements relevant to Indonesian businesses:<\/span><\/p>\n<h4><i><span style=\"font-weight: 400;\">First<\/span><\/i><i><span style=\"font-weight: 400;\">\u2011<\/span><\/i><i><span style=\"font-weight: 400;\">Party Coverage<\/span><\/i><\/h4>\n<p><b>Data Breach Response Costs:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Covers expenses for forensic investigation, legal counsel, public relations, and customer notification following unauthorized data access. In Indonesia, these services are crucial for compliance with the PDP Law\u2019s breach<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">notification requirements.<\/span><\/p>\n<p><b>Business Interruption (BI):\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Reimburses lost income and extra expenses when operations halt due to a covered cyber event. Given Indonesia\u2019s reliance on e<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">commerce and digital services, BI cover is often a policy centerpiece.<\/span><\/p>\n<p><b>System Restoration and Extortion:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Pays for restoring or replacing damaged IT systems and covers ransom payments (subject to local legal restrictions).<\/span><\/p>\n<p>&nbsp;<\/p>\n<h4><i><span style=\"font-weight: 400;\">Third<\/span><\/i><i><span style=\"font-weight: 400;\">\u2011<\/span><\/i><i><span style=\"font-weight: 400;\">Party Liability Coverage\u00a0<\/span><\/i><\/h4>\n<p><b>Network Security Liability:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Protects against claims from clients or partners alleging negligence in securing networks, such as propagation of malware or denial<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">of<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">service impacts on third parties.<\/span><\/p>\n<p><b>Privacy Liability:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Covers legal defense and settlements if personal data is compromised, including regulatory fines and penalties under the PDP Law (up to statutory limits).<\/span><\/p>\n<p><b>Media Liability:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Addresses risks from website content, social media posts, or online advertising that infringe intellectual property or defame third parties.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h4><i><span style=\"font-weight: 400;\">Optional Add<\/span><\/i><i><span style=\"font-weight: 400;\">\u2011<\/span><\/i><i><span style=\"font-weight: 400;\">Ons<\/span><\/i><\/h4>\n<p><b>Ransomware-Specific Extensions:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Some insurers offer sub<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">limits or separate coverage for ransomware, reflecting the high frequency and severity of these attacks in Indonesia. These may include pre<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">negotiated response services with specialized negotiators.<\/span><\/p>\n<p><b>Cryptocurrency Theft Coverage:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">As Indonesian businesses explore crypto payments, this add<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">on covers loss of digital assets due to hacking or unauthorized transfers.<\/span><\/p>\n<p><b>Regulatory Fines &amp; Penalties:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">While basic policies cover legal defense costs, this enhancement reimburses actual fines imposed by regulators under the PDP Law, up to the chosen limit.<\/span><\/p>\n<p><b>Supply<\/b><b>\u2011<\/b><b>Chain Interruption:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Responds to losses stemming from a cyber event at a critical vendor or service provider, reflecting the interconnected nature of modern IT environments.<\/span><\/p>\n<p><b>Cyber Crime &amp; Social Engineering:\u00a0<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Covers financial loss from fraudulent instruction, such as business email compromise (BEC), where employees are tricked into transferring funds to attacker<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">controlled accounts.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">By combining these core and optional coverages, Indonesian businesses can tailor cyber insurance to their specific risk profiles\u2014balancing cost, scope, and regulatory compliance.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Claims Process\u00a0<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Claims Process &amp; Best Practices<\/span><\/p>\n<p><b>Incident Notification<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Upon detecting a suspected cyber event\u2014whether a data breach, ransomware demand, or service disruption\u2014policyholders should notify their insurer immediately, typically within 24\u201372 hours as stipulated by the policy. Early notification triggers the insurer\u2019s response team and helps preserve critical evidence.<\/span><\/p>\n<p><b>Appointment of Response Team<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The insurer will appoint or recommend an incident response team, often comprising digital forensics experts, legal counsel, and public relations specialists. These professionals work in tandem to contain the breach, assess the scope, and advise on communication strategies to regulators, customers, and stakeholders.<\/span><\/p>\n<p><b>Forensic Investigation<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A detailed forensic analysis identifies the attack vector, affected systems, and data compromised. Investigators collect logs, system images, and other artifacts under strict chain<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">of<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">custody protocols to support both remediation and potential legal proceedings.<\/span><\/p>\n<p><b>Damage Assessment &amp; Documentation<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Concurrently, the response team quantifies business interruption losses, system restoration costs, and any ransom payment or extortion expenses. All costs must be documented with invoices, time logs, and vendor reports to substantiate the claim.<\/span><\/p>\n<p><b>Regulatory Reporting<\/b><\/p>\n<p><span style=\"font-weight: 400;\">If personal data is involved, the policyholder must comply with PDP Law notification requirements\u2014typically reporting to the Otoritas Jasa Keuangan (OJK) and the national data protection authority within mandated timeframes. Insurers often assist in drafting these notifications to ensure legal compliance.<\/span><\/p>\n<p><b>Claim Submission &amp; Review<\/b><\/p>\n<p><span style=\"font-weight: 400;\">The insured compiles a claim package\u2014incident report, forensic findings, cost breakdowns, and regulatory filings\u2014and submits it to the insurer\u2019s claims department. The insurer reviews the documentation, may conduct additional interviews or audits, and evaluates coverage applicability.<\/span><\/p>\n<p><b>Settlement &amp; Remediation<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Once validated, the insurer issues payment for covered losses and funds approved remediation efforts. Beyond financial reimbursement, many insurers provide ongoing risk<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">management support, such as cybersecurity training or vulnerability assessments, to reduce future exposures.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">By following a structured claims process and partnering closely with insurers\u2019 response teams, Indonesian businesses can expedite recovery, control costs, and emerge more resilient against future cyber threats.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Challenges\u00a0<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Low awareness, underwriting data scarcity, premium affordability<\/span><\/p>\n<p><b>Challenges in Adoption: Gaps and Barriers<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Despite growing interest, several challenges hinder widespread cyber insurance uptake among Indonesian businesses:<\/span><\/p>\n<p><b>Low Awareness and Understanding<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Many SMEs lack a clear grasp of cyber risks and the benefits of insurance. A 2023 survey by the Asosiasi Asuransi Jiwa Indonesia found that only 28<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent of small businesses recognized cyber insurance as a viable risk transfer tool, often perceiving it as too complex or unnecessary for their scale. This knowledge gap slows market penetration and leaves firms exposed.<\/span><\/p>\n<p><b>Underwriting Data Scarcity<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Accurate risk assessment relies on historical loss data and threat intelligence. In Indonesia, limited public reporting of cyber incidents and inconsistent incident classification impede insurers\u2019 ability to model risk effectively. Without robust data, insurers may apply conservative assumptions, leading to restrictive coverage terms or outright declinations for clients with uncertain risk profiles.<\/span><\/p>\n<p><b>Premium Affordability and Perceived Value<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Premiums for comprehensive cyber policies can be prohibitive, especially for SMEs operating on thin margins. Many insurers set rates based on global benchmarks, which may not reflect local loss frequencies or loss severity, resulting in premiums that appear inflated relative to perceived risk. Additionally, businesses often struggle to quantify potential cyber losses, making it difficult to justify insurance spending against other budgetary priorities.<\/span><\/p>\n<p><b>Regulatory and Technical Complexity<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Navigating Indonesia\u2019s PDP Law, OJK guidelines, and emerging cybersecurity standards adds complexity for both insurers and insureds. SMEs may lack in<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">house legal or technical expertise to ensure compliance, further discouraging policy adoption.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Addressing these barriers requires targeted education initiatives, improved incident reporting frameworks, and collaborative efforts between insurers, brokers, and government bodies to develop tailored, affordable cyber insurance solutions.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Case Study\u00a0<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Ransomware Attack on an Indonesian E<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">Commerce SME<\/span><\/p>\n<p><span style=\"font-weight: 400;\">PT MitraBelanja, a mid<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">sized e<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">commerce retailer based in Surabaya with an annual revenue of IDR<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">50<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">billion, suffered a LockBit ransomware intrusion in February 2024. Attackers exploited an unpatched VPN gateway, encrypting critical order<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">processing servers and demanding a ransom of 15<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">BTC (approx. USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">375,000).<\/span><\/p>\n<p><b>Incident Response and Coverage Activation<\/b><\/p>\n<p><span style=\"font-weight: 400;\">MitraBelanja\u2019s IT team detected unusual file<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">encryption behavior and notified their insurer within 24 hours, per policy requirements. The insurer immediately engaged a forensic partner and ransomware negotiator. Forensics confirmed the attack vector and scope, isolating affected systems to prevent lateral spread.<\/span><\/p>\n<p><b>Financial Impact and Insurance Payout<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Under their first<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">party coverage, MitraBelanja\u2019s policy reimbursed:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Ransom Payment: USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">375,000 (paid through the insurer\u2019s captive wallet service)<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Forensic &amp; Legal Fees: USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">45,000 for investigation and regulatory breach notification under the PDP Law<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Business Interruption: USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">60,000 to cover lost sales and expedited IT contractor costs for system restoration<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Total claim payout amounted to USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">480,000, far below the potential IDR<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">3<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">billion (USD<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">200,000) daily revenue loss if downtime had extended beyond 48 hours.<\/span><\/li>\n<\/ol>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Lessons Learned<\/span><\/h3>\n<p><span style=\"font-weight: 400;\">Post<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">incident, MitraBelanja leveraged insurer<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">provided risk engineering services to implement multi<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">factor authentication, automated patch management, and employee phishing training. This not only reduced their residual cyber risk but also qualified them for a 15<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">percent premium discount at renewal. The case underscores how cyber insurance\u2014when paired with proactive security measures\u2014can effectively mitigate financial and operational fallout for Indonesian SMEs.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3><span style=\"font-weight: 400;\">Recommendations for Securing Cyber Insurance and Reducing Premiums<\/span><\/h3>\n<p><b>Conduct a Thorough Risk Assessment<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Begin by mapping your digital assets\u2014networks, applications, and data repositories\u2014and identifying potential vulnerabilities. Use frameworks like ISO<\/span><span style=\"font-weight: 400;\">\u202f<\/span><span style=\"font-weight: 400;\">27001 or NIST Cybersecurity Framework to benchmark your controls. A documented risk assessment not only clarifies coverage needs (e.g., business interruption vs. ransomware) but also strengthens your position during underwriting, potentially yielding more favorable terms.<\/span><\/p>\n<p><b>Engage an Experienced Cyber Insurance Broker<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Cyber insurance is a specialized market. Partnering with a knowledgeable broker like L&amp;G Insurance Broker ensures you access to a broad panel of carriers and tailored policy wordings. L&amp;G\u2019s deep expertise in Indonesian regulatory requirements (PDP Law, OJK guidelines) and local threat landscape means you\u2019ll receive:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Comparative premium and coverage analyses across top insurers<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Guidance on optimal sub<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">limits and retention levels<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Support during claims to expedite incident response and settlement<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Invest in Foundational Cybersecurity Controls<\/span><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">Insurers reward proactive security. Implement multi<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">factor authentication (MFA) across all remote access points and critical systems. Establish an automated patch<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">management program to remediate known vulnerabilities swiftly. Deploy endpoint detection and response (EDR) tools to identify anomalous behavior in real-time. Demonstrable control maturity can translate into premium credits or lower deductibles.<\/span><\/p>\n<p><b>Develop an Incident Response Plan<\/b><\/p>\n<p><span style=\"font-weight: 400;\">A formal, tested incident response (IR) plan signals preparedness. Conduct tabletop exercises with your IT, legal, and communications teams to rehearse breach scenarios. Insurers often offer IR plan templates or workshops\u2014take advantage of these services to refine your protocols. A robust IR plan not only reduces downtime but can also lower your business interruption sub<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">limit, cutting overall policy costs.<\/span><\/p>\n<p><b>Leverage Continuous Monitoring and Training<\/b><\/p>\n<p><span style=\"font-weight: 400;\">Ongoing vulnerability scans and penetration tests provide up<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">to<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">date visibility into emerging risks. Complement technical measures with regular employee cybersecurity awareness training\u2014phishing simulations, secure coding workshops, and data<\/span><span style=\"font-weight: 400;\">\u2011<\/span><span style=\"font-weight: 400;\">handling best practices. Demonstrating a culture of security lowers perceived risk and can improve underwriting outcomes.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">By combining rigorous risk assessment, strategic broker engagement with L&amp;G Insurance Broker, and a commitment to cybersecurity excellence, Indonesian businesses can secure comprehensive cyber insurance coverage at competitive premiums\u2014transforming insurance from a mere safety net into a driver of resilience and growth.<\/span><\/p>\n<p><b>Conclusion: Prioritize Cyber Risk Management Today<\/b><\/p>\n<p><span style=\"font-weight: 400;\">In Indonesia\u2019s rapidly digitizing economy, cyber threats pose significant risks to businesses of all sizes. Cyber insurance has become an essential tool for mitigating financial losses, ensuring regulatory compliance, and maintaining operational resilience. As the threat landscape evolves, proactive risk management and tailored insurance solutions are crucial.<\/span><span style=\"font-weight: 400;\">\u200b<\/span><\/p>\n<p><span style=\"font-weight: 400;\">At L&amp;G Insurance Broker, we specialize in guiding Indonesian businesses through the complexities of cyber risk. Our team offers comprehensive cyber risk assessments to identify vulnerabilities and recommend appropriate insurance coverage. By partnering with us, you can enhance your cybersecurity posture and secure financial protection against potential cyber incidents.<\/span><span style=\"font-weight: 400;\">\u200b<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Contact us today to schedule a personalized cyber risk assessment and take the first step toward safeguarding your business in the digital age.<\/span><\/p>\n<p><b>Looking for insurance products? Don&#8217;t waste your time and contact us now<\/b><\/p>\n<p><b>HOTLINE L&amp;G 24 JAM:<\/b><a href=\"https:\/\/api.whatsapp.com\/send?phone=628118507773&amp;text=Halo%20L%26G%20Risk,%20Saya%20mau%20menanyakan%20lebih%20detil%20mengenai%20asuransi.%0D%0A%2D%2D%2D%0D%0ANama%3A%0D%0APerusahaan%3A%0D%0AJenis%20Asuransi%3A%0D%0AObjek%20yang%20diasuransikan%3A%0D%0A%2D%2D%2D%0D%0AMohon%20hubungi%20saya%20segera%21\"><b> 0811-8507-773<\/b><\/a><b> (CALL \u2013 WHATSAPP \u2013 SMS)<\/b><\/p>\n<p><b>Website: lngrisk.co.id<\/b><\/p>\n<p><b>Email: oktoyar.meli@lngrisk.co.id<\/b><\/p>\n<p><b>\u2014<\/b><\/p>","protected":false},"excerpt":{"rendered":"<p>Liga Asuransi &#8211; Dear readers, welcome to our blog dedicated to risk management and insurance insights in Indonesia. In this edition, we delve into the critical topic of cybersecurity and the role of insurance in safeguarding businesses against digital threats. As cyber incidents become more prevalent, understanding protective measures is essential.\u200b If you find this [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":7331,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[799],"tags":[129,358],"class_list":{"0":"post-7330","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-risk-insurance","8":"tag-asuransi-cyber","9":"tag-cyber-security"},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/posts\/7330","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/comments?post=7330"}],"version-history":[{"count":1,"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/posts\/7330\/revisions"}],"predecessor-version":[{"id":7332,"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/posts\/7330\/revisions\/7332"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/media\/7331"}],"wp:attachment":[{"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/media?parent=7330"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/categories?post=7330"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ligaasuransi.com\/en\/wp-json\/wp\/v2\/tags?post=7330"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}