A series of hacking incidents targeting South Korean financial institutions has pushed cybersecurity back into the headlines, and with it a long-running policy question: why so few companies carry insurance against digital breaches. According to 농민신문, the recent wave of attacks — several of them carried out with artificial intelligence tools — has raised alarm across the sector even as demand for cyber coverage stays weak.
The numbers behind that concern are stark. A report published in February by the Korea Internet & Security Agency (KISA), covering cyber threat trends in the second half of 2025 and forecasts for 2026, found that private-sector cyber intrusions in South Korea climbed from 1,277 cases in 2023 to 2,383 last year — a rise of roughly 87 percent over two years, 농민신문 reports.
Why it matters
The gap between the growing threat and the thin uptake of insurance is the crux of the story. Cyber insurance is designed to cover the costs of cleaning up after a breach — legal fees, notification expenses, recovery work — but most South Korean companies have not bought it.
A survey of 300 security managers conducted by the Korea Fire Insurance Association, cited by 농민신문, found that only 6.9 percent said their organization had signed up for comprehensive cyber insurance. The most common obstacle respondents identified was a simple lack of understanding about how the products work.
That leaves a large share of the economy exposed at a moment when attacks are becoming more frequent and, according to multiple outlets, more sophisticated.
Attack attempts on state-run banks keep climbing
Data submitted to the National Assembly illustrate the pressure on the financial sector specifically. 강민국, a lawmaker from the ruling People Power Party who represents a district in Jinju, Gyeongsangnam-do, obtained figures from the Bank of Korea, the Export-Import Bank of Korea, the Korea Development Bank and the Industrial Bank of Korea, according to 농민신문.
Those four institutions recorded 358,800 hacking attempts in 2020. By last year the figure had reached 934,858. In the first nine months of this year alone, 1,024,478 attempts were logged.
No personal data breaches resulted from those attempts, 농민신문 reports — a detail that matters both for the banks' security posture and for how the insurance debate is framed. The attacks were repelled, but the volume tells its own story about persistence.
Regulation offers little incentive to buy coverage
Part of the explanation for low uptake lies in the law itself. South Korea's Personal Information Protection Act requires companies above a certain size to prepare for liability stemming from data leaks. Firms can meet that obligation either by purchasing cyber insurance or by setting aside reserves.
The reserve option, however, is cheap enough to undercut the case for a policy. Even a company holding data on more than one million individuals is only required to accumulate up to 1 billion won, according to 농민신문 — a ceiling that reduces the incentive to take out insurance instead.
Kwon Soon-il, a research fellow at the Korea Insurance Research Institute, told 농민신문 that government support is needed to change that calculus. He called for tax benefits and premium subsidies as policy incentives, and said insurers should develop more sophisticated models for assessing cyber risk so that pricing is both reasonable and credible.
A wider debate about how government responds
The insurance discussion is unfolding alongside broader criticism of South Korea's cyber defenses. Separate reporting from IT조선 argues that hackers move freely across industry boundaries while government response remains siloed by agency. YTN 사이언스 reported that an AI tool called Artex, which had been abused in the financial-sector attacks, has been pulled from public release. An editorial in 전자신문 called for security and response systems to evolve in step with AI-enabled attacks.
Together, those threads point to a problem that insurance alone cannot solve. Coverage transfers financial risk after an incident; it does not prevent one. But proponents argue that a functioning cyber insurance market would push companies toward better security practices, because insurers typically assess defenses before issuing policies — and price them accordingly.
For now, the market remains small. The KISA figures show attacks rising sharply, the bank data show attempts accelerating, and the survey data show fewer than one in ten organizations insured. Whether tax incentives, premium support or revised reserve rules can close that gap is the question policymakers now face.
Watch for whether the government proposes concrete incentives for cyber insurance uptake — and whether insurers respond with the risk models that Kwon says are needed to make the products trustworthy.
