Hacks engulf Korean finance, yet cyber cover keeps getting cheaper

Noise in the attribution, signal in the price

The Korea Times reported on 28 October that regulators had detected more than 4.4 million scanning attempts from 03:00 on 21 October, attributing most of the IP ranges to North Korea. That 4.4 million figure carried the headlines. In the same 28 October report, however, the Financial Security Institute said that an IP address alone does not prove an attacker's identity. According to Kyunghyang on 4 October, servers linked to the Shinhan attack bore traces of ARTEX, an AI penetration-testing tool posted to GitHub on 26 July 2026. The attacking IP addresses are spread across 8 countries, and the China link rests solely on the tool's origin.

The signal lies in pricing. Marsh's Q3 2026 index shows cyber insurance prices in Asia down 6%, with the steepest fall, 13%, in Korea, Hong Kong, Malaysia and Singapore. The quarter closed on 30 September, the day the Shinhan breach was disclosed. Nocutnews reported on 5 November that from that date until 3 November, 40 breaches were reported at 37 financial institutions. Leaked records reached about 473,000 and reported cash losses about 1 billion won. Those affected comprised 4 banks, 5 brokerages, 3 insurers, 5 savings banks, 4 crowdfunding platforms and 3 crypto firms.

Mandatory cover exists on paper

Korea's personal data law requires firms with turnover above 1 billion won that hold data on an average of 10,000 people a day to buy insurance or set aside reserves. The Seoul Economic Daily reported on 11 October that the Personal Information Protection Commission estimates between 83,000 and 380,000 firms are covered by the rule. At the end of June 2026, the five largest insurers had 6,158 policies across the 3 mandatory lines, equal to between 1.6% and 7.4% of obligated firms. A commentary in the same paper on 26 October noted that the Commission has so far issued 0 penalties under the rule.

The cap is also narrow. The statutory minimum cover ranges from 50 million to 1 billion won, depending on turnover and data volume. One industry official says 80% of firms with a policy buy only the minimum. The 2025 Coupang breach showed the gap: 33.7 million accounts were affected and the company announced a compensation plan of 16.85 trillion won, while its policy paid out 1 billion won.

Demand is shifting towards optional cover. Herald Business reported on 25 October that the five insurers' first-half 2026 cyber premiums rose 26.4% to 31.3 billion won. Package premiums grew 43.5% to 23 billion won, lifting their share from 64.6% to 73.3%. Mandatory cover premiums fell 5.7% to 8 billion won. Coupang's single compensation plan is roughly 538 times the five insurers' half-year cyber premiums; the calculation is Talay's own.

Capital sets the price, attribution sets the cover

The same Marsh index says Asia remained a buyer's market in Q3, but that accumulation concerns and AI-assisted attacks are shaping risk selection. Japan is the first case in point: after falling 3% in the previous quarter, cyber prices there rose 3% in Q3 amid the wave of leaks before October. As of 10 November, it could not be verified when prices in Korea will make the same turn.

The North Korea narrative carries weight for insurance. Lloyd's market bulletin Y5381 has required standalone cyber policies to exclude state-backed attacks since 31 March 2023. If the victim state makes no attribution, the insurer may rely on an objectively reasonable inference. The exclusion applies only if an attack causes major damage to the functioning of a state; a leak of 473,000 records looks unlikely to reach that threshold. As of 10 November, it could not be verified whether Korea's domestic insurers carry a similar clause in their policy wordings.

The regulatory burden falls on companies, not insurers. On 5 November the Commission launched a review covering some 580 institutions: registered systems will be examined by 30 November, and unregistered systems, together with oversight by the CEO and chief information security officer, by 30 December. Any service found to have a critical vulnerability will be suspended immediately. According to Newstomato on 5 November, the current penalty ceiling is 5 billion won; a bill allowing fines of up to 3% of turnover has been stalled in the National Assembly for months.

Three thresholds to watch

The first threshold is whether Korean cyber pricing in Marsh's Q4 2026 index swings from a 13% fall back above zero. The second is whether the bill allowing fines of up to 3% of turnover becomes law; that would push boards to seek limits above the 1 billion won minimum. The third is whether the number of reported breaches keeps climbing above 40 after the 30 December review. If all three materialise, the first price increase for Korean financial institutions would be on the table at the January 2027 renewals; as of 10 November, it could not be verified that any insurer had issued such guidance.