Cyber Insurance Singapore: The Complete SME Guide

I got a call from a logistics company owner at 11pm on a Tuesday. His operations manager had clicked a link in what looked like a DBS notification email. By the time anyone realised what had happened, ransomware had encrypted every server in the office. No backups. The ransom demand: S$200,000 in Bitcoin. With cyber insurance, his out-of-pocket cost would have been S$15,000 (the policy excess). Without it, the total bill — ransom payment, forensics, system restoration, three weeks of business interruption — exceeded S$400,000.

That phone call changed how I talk to every SME client about risk management.

TL;DR: Singapore SMEs face growing cyber threats — ransomware, phishing, and PDPA breaches. Cyber insurance costs S$1,500-S$8,000/year for S$500K-S$2M coverage. It covers breach response costs, legal fees, business interruption, ransom payments, and PDPA regulatory defence. Top providers include Chubb, AIG, Zurich, and MSIG. Every SME handling personal data should have a policy.

A single data breach costs Singapore businesses an average of S$3.8 million according to IBM's 2025 report. For SMEs, even a fraction of that is potentially fatal — 60% of small businesses that suffer a major cyber attack close within six months. Cyber insurance is no longer a luxury for large enterprises.

Why Singapore SMEs Need Cyber Insurance

The Threat Landscape

Singapore is among the most targeted countries in Asia-Pacific:

• Ransomware attacks on SMEs up 67% year-over-year (CSA Cyber Landscape report)
• Average ransom demand: S$150,000-S$500,000 for SMEs
• Phishing remains the #1 entry point: 78% of breaches start with a phishing email
• Business email compromise: Average loss of S$45,000 per incident
• Mean detection time: 197 days — most SMEs have no idea they have been breached

The PDPA Factor

Beyond the direct attack costs, the PDPA adds a significant compliance layer:

• Financial penalties up to S$1 million (or 10% of turnover for larger companies)
• Mandatory breach notification within 3 days
• Legal costs for PDPC investigations typically run S$50,000-S$200,000 before any fine
• Growing class action risk for data breaches

Without cyber insurance, every dollar comes from your operating capital.

Three Real Cases

Logistics SME (2025): Ransomware encrypted all servers. Paid S$180,000 ransom plus S$120,000 for incident response and restoration. Three weeks of business interruption. Total: S$400,000+.

E-commerce retailer (2025): Employee phished, 50,000 customer records exposed. PDPC investigation costs S$80,000. Fine: S$120,000. Customer notification and monitoring: S$60,000. Total direct cost: S$260,000.

Professional services (2024): Business email compromise tricked the finance team into transferring S$230,000 to a fraudulent account. Funds unrecoverable. No insurance. Total loss absorbed by the firm.

What Cyber Insurance Covers

First-Party Coverage (Your Direct Losses)

Incident response: Forensic investigation, IT containment, customer notification, credit monitoring, crisis PR. Typical coverage: S$100,000-S$500,000.

Business interruption: Lost income during downtime, extra expenses to maintain operations. Waiting period typically 8-12 hours. Coverage period: 60-180 days. Typical: S$200,000-S$1,000,000.

Data restoration: Recovering or recreating lost/corrupted data. Typical: S$50,000-S$200,000.

Cyber extortion / Ransomware: Ransom payments (where legal), negotiation costs, related forensics. Typical: S$100,000-S$500,000. Most insurers require approval before any ransom payment.

Third-Party Coverage (Claims Against You)

Privacy liability: Defence costs and damages from lawsuits for failing to protect data. Typical: S$500,000-S$2,000,000.

Regulatory defence and fines: Legal costs for PDPC investigations, coverage for PDPA fines (where insurable). Typical: S$250,000-S$1,000,000.

Network security liability: Claims from third parties whose systems were compromised through yours. Critical for IT service providers and software companies.

How Much Does It Cost?

Micro-business (1-10 employees, <S$1M revenue): S$800-S$2,000/year for S$250K-S$500K coverage.

Small business (10-50 employees, S$1M-S$10M revenue): S$2,000-S$5,000/year for S$500K-S$2M coverage.

Medium business (50-200 employees, S$10M-S$50M revenue): S$5,000-S$15,000/year for S$2M-S$5M coverage.

What Moves Your Premium

Increases it: Large data volumes, high-risk industries (healthcare, fintech), previous incidents, weak security (no MFA, no backups), payment card processing.

Decreases it: Strong security controls (MFA, EDR, patching), employee training, penetration testing, ISO 27001 or SOC 2 certification, documented and tested incident response plan.

Top Providers in Singapore

Chubb: Best for mid-size to large SMEs. Broad coverage, 24/7 incident response with Singapore coordinator. Mid-to-premium pricing.

AIG CyberMate: Best for SMEs wanting simplicity. Pre-built packages, free cyber risk assessment included. Competitive pricing, simplified online application for coverage under S$2M.

Zurich: Best for manufacturing and supply chain. Strong OT coverage, supply chain extensions. Mid-range.

MSIG: Best for budget-conscious smaller SMEs. Affordable from S$800/year. Simple online application. Local presence.

QBE: Best for professional services and tech companies. Strong E&O integration, worldwide coverage including US. Mid-range.

How to Choose the Right Policy

Step 1: Know Your Risk

Before shopping, understand your exposure. How much personal data do you hold? What would a 2-week system outage cost? Are you PDPA-compliant? (Non-compliance increases both risk and premiums.)

Step 2: Size Your Coverage

Starting points: minimum 2x your estimated maximum breach loss. Business interruption at least 3 months of gross revenue. Regulatory defence at least S$250,000. Incident response at least S$100,000.

Step 3: Check the Fine Print

Retroactive date: Does it cover breaches that occurred before the policy but are discovered during it? (Most breaches go undetected for months.)

Waiting period: 8 hours is standard for business interruption. Some policies have 24-48 hours.

Sub-limits: Some coverage areas have lower limits than the headline amount. Check ransomware, regulatory fines, and PR specifically.

War exclusion: Standard but increasingly relevant. Check if the definition covers state-sponsored attacks.

Known vulnerabilities: Many policies exclude incidents caused by vulnerabilities you knew about but did not patch.

Step 4: Improve Security to Lower Premiums

These controls can cut premiums 10-30%:

1. MFA on all critical systems and email (5-10% reduction alone)
2. Endpoint detection and response on all devices
3. Regular backups with offline copies tested monthly
4. Employee security training at least quarterly
5. Documented and tested incident response plan
6. Vulnerability scanning and patching within 30 days for critical CVEs

PDPA Breach Costs: With vs Without Insurance

Without Insurance

Forensics: S$30,000-S$100,000. Legal: S$40,000-S$150,000. PDPA fine: S$10,000-S$1,000,000. Customer notification: S$5,000-S$50,000. Credit monitoring: S$10,000-S$100,000. Crisis PR: S$20,000-S$80,000. Business interruption: S$50,000-S$500,000. Total potential exposure: S$165,000-S$1,980,000.

With Insurance (S$1M policy, ~S$3,000/year)

All of the above covered up to policy limits. Pre-vetted incident response vendors. Legal team experienced with PDPC. Claims team guiding you through the process. Your out-of-pocket: S$5,000-S$25,000 policy excess.

The maths is simple: S$3,000/year to protect against S$165,000 to S$2,000,000 in exposure.

Common Exclusions

Know these before you buy: prior known incidents, intentional criminal acts, unencrypted lost devices (some policies reduce or exclude), failure to maintain represented security controls, war and terrorism (check definition breadth), infrastructure outages not caused by cyber attack, contractual penalties, and cryptocurrency losses.

Your Action Plan

This week: Basic cyber risk assessment. Enable MFA on all email and critical apps. Test your backup with an actual restore.

This month: Get 3 insurance quotes through a specialist broker. Review your PDPA compliance status. Start employee security awareness training.

Ongoing: Maintain your policy with annual review. Test your incident response plan annually. Keep systems patched and monitored.

Sources

1. CSA — Cyber Security Agency of Singapore
2. PDPC — Personal Data Protection Commission
3. Cybersecurity Act — Singapore Statutes Online

Need help with PDPA compliance before applying for cyber insurance? Read our guides on 10 PDPA Obligations Every Singapore Business Must Follow and Best PDPA Compliance Software for Singapore SMEs. A strong compliance posture will lower your cyber insurance premiums.