Does cyber insurance cover ransomware payments in Singapore?

Most SG cyber wordings include a cyber-extortion cover that can respond to ransomware, usually with its own sub-limit and a requirement to obtain the insurer’s consent before any payment. Cover is subject to sanctions screening and the policy conditions. The exact sub-limit and conditions vary by insurer — use our clause search to read the actual extortion clause in each wording.

Does cyber insurance cover PDPA fines in Singapore?

Cyber policies commonly cover the cost of defending or responding to a PDPC investigation, and — where insurable under Singapore law — the resulting financial penalty, subject to a sub-limit. Penalties that the law treats as uninsurable cannot be covered. Whether a specific penalty is insurable is a legal question; the policy wording and Singapore law govern.

Does cyber insurance cover social engineering or CEO fraud?

Some wordings include social-engineering / funds-transfer-fraud cover, often as an endorsement or a lower sub-limit, and often with conditions such as call-back verification of payment instructions. It is one of the most variable cover heads between insurers, so it is worth comparing the specific clause.

What is not covered by cyber insurance?

Common exclusions include incidents or circumstances known before the policy started, war and state-sponsored attacks (widely tightened in wordings since 2023), bodily injury and physical property damage, the cost of upgrading systems beyond their pre-incident state (betterment), and fines or penalties that are uninsurable under Singapore law. Some wordings also condition cover on controls such as encryption of portable devices.

What Does Cyber Insurance Cover in Singapore?

Q: What does cyber insurance cover in Singapore?

A Singapore cyber policy typically covers two sides. First-party losses to your own business: incident response and forensics, cyber extortion and ransomware, business interruption from system downtime, data and systems restoration, breach-notification costs, and cybercrime such as social engineering fraud. Third-party liability: claims brought against you for a privacy or data breach (including the cost of responding to a PDPC investigation and insurable penalties), network security failures, and media liability in your digital content. Every cover head has a limit or sub-limit — the exact scope is set by each insurer’s wording.

Last reviewed: 2026-07-09. Educational overview — the cover you actually receive is set by the insurer's policy wording.

A Singapore cyber-insurance policy covers two different things: the losses your own business suffers after an attack (first-party cover), and the claims other people bring against you because of a breach (third-party liability). Below is what each cover head means in practice — and, because scope varies so much between insurers, a live lookup into the actual wordings so you can read the real clause, not the brochure.

First-party cover — losses to your own business

Incident response & digital forensics. The cost of the specialists who investigate and contain an incident — forensic IT, legal breach counsel, and the insurer's incident-response panel. This is usually the first cover to engage after you notify.
Cyber extortion & ransomware. Responds to extortion demands, typically with its own sub-limit, a requirement to get the insurer's consent before paying, and sanctions screening.
Business interruption. Your lost income and increased cost of working while systems are down. Watch the waiting period (often 6–24 hours) and whether contingent business interruption — an outage at a supplier or cloud vendor — is included.
Data & systems restoration. The cost of restoring or recreating data and software damaged by a covered event.
Breach notification & monitoring. The cost of notifying affected individuals and the PDPC, plus credit or identity monitoring where offered.
Cybercrime / social engineering. Loss from fraudulently induced payments (e.g. a spoofed supplier or “CEO fraud”). Frequently an endorsement or a lower sub-limit, often with a call-back verification condition.

Third-party cover — claims against you

Privacy & data liability. Defence and damages if individuals or organisations claim you failed to protect their data — including the cost of responding to a PDPC investigation and, where insurable under Singapore law, the resulting penalty (subject to a sub-limit).
Network security liability. Claims arising from a security failure on your systems — for example transmitting malware to a third party, or your systems being used in an attack.
Media liability. Defamation, or infringement of copyright or trademark, in your digital content.

Read the real cover clause in each insurer's wording

Live results from our semantic search across the verbatim wordings of Singapore cyber policies — insurer, section and source shown for each clause. Not the marketing summary, the actual contract language.

Powered by clause search — semantic lookup over the verbatim SG cyber wordings. Verbatim text is reproduced for comparison and identification; each insurer's policy document is the authoritative source.

What cyber insurance does not cover

Every wording carries exclusions. The ones that most often surprise buyers:

Prior known incidents. Anything you were aware of before the policy started is excluded.
War & state-sponsored attacks. These clauses were widely tightened across the market from 2023 onward; the exact carve-back varies.
Bodily injury & physical property damage. Cyber policies cover digital and financial loss, not physical harm — that sits with other lines.
Betterment. Upgrading systems beyond their pre-incident state is generally your cost, not the insurer's.
Uninsurable fines. Penalties that Singapore law treats as uninsurable cannot be covered, regardless of the wording.
Condition breaches. Some wordings condition cover on controls — for example encryption of portable devices, or MFA on remote access. Failing the condition can reduce or void a claim.

Check the exclusions in the actual wordings

Cover heads at a glance

Cover	Type	Watch for
Incident response	First-party	Panel vs free choice of vendor
Ransomware / extortion	First-party	Sub-limit; insurer consent; sanctions
Business interruption	First-party	Waiting period; contingent BI
Social engineering	First-party	Often endorsement / low sub-limit
PDPA / privacy liability	Third-party	Insurable-penalty sub-limit
Network security liability	Third-party	Definition of “security failure”

Want to know exactly what your policy would cover? Submit our quote form — five minutes, and a licensed Singapore broker returns real quotes with the cover heads and sub-limits spelled out, within two business days. No obligation.

Related guides

Sources

PDPC enforcement decisions — what triggers investigations and penalties in Singapore
Cyber Security Agency of Singapore (CSA) — national incident trends