More companies seeking cyber insurance following high-profile data breaches

More companies in Japan have been taking out cybersecurity insurance policies in the wake of several high-profile data breaches, including last week’s attack on GMO Internet Group, with such cases highlighting just how big a financial risk such hacks pose to businesses.

Cybersecurity insurance normally covers compensation for costs arising from data breaches such as hacking, internally caused cyber leaks and, in some cases, IT security assessments to prevent similar data compromises from happening in the future.

It also covers costs for conducting digital forensic analysis to identify cyberattackers and where vulnerabilities lie in a company’s IT systems, as well as the loss of business opportunities caused by data leaks.

But any ransom paid to an attacker is not covered by such insurance.

“We have seen a threefold increase in inquiries to our Sompo risk management division compared to September figures,” said a Sompo Japan spokesperson.

Sales of cybersecurity insurance have been increasing for the past few years.

In fiscal 2025, which ended in March this year, a total of 344,930 contracts were held by nine companies that sell cyber insurance, up from 74,852 contracts in fiscal 2020, according to the General Insurance Association of Japan, an industry group of non-life insurance firms.

Tokio Marine & Nichido Fire Insurance has seen the uptake for its cybersecurity insurance go up 1.6 times in 2025 in comparison with 2020, parent company Tokyo Marine Holdings said.

Aioi Nissay Dowa Insurance has also been seeing more inquiries for its cybersecurity insurance, both from major companies as well as small and medium-size enterprises, a spokesperson said.

Sompo Japan is starting a new free diagnostic service from next month to help its policyholders determine their cybersecurity vulnerabilities.

The service aims to combat vulnerabilities that have emerged with the growth of remote working and greater use of cloud services in recent years.

“By integrating security countermeasures solutions into cyber insurance, we will reduce the barriers to implementation and support companies in strengthening their security more effectively,” it stated.

According to the National Police Agency’s most recent report, there were 123 ransomware attacks in the first half of 2026 — the highest number since 2020. | Johan Brooks

Another key feature of cybersecurity insurance is coverage for legal costs, which have become more of a concern for companies following reports in October of a planned class action lawsuit against Times Car following a data breach in September that saw the personal information of more than a million of its users being leaked.

Park24, the parent of Times Car operator Times Mobility, said last month that it plans to report a one-time special loss of ¥5.5 billion ($35 million) for the business year through October over the incident.

Among the insurers, Tokio Marine & Nichido Fire Insurance and Mitsui Sumitomo Insurance cover up to ¥1 billion per claim for compensation that businesses need to pay customers who sue them for damages.

As part of revised guidelines on cybersecurity released in September, the government has also been urging companies to hedge their financial risks through the use of cybersecurity insurance policies.

According to the National Police Agency’s most recent report, a total of 123 ransomware attacks occurred in the first half of 2026 — the highest number in a six-month period since 2020.