Millions hit by data breach in Japan: How cyber insurance can protect you against such risks — check costs, coverage

Japan last week declared a “state of emergency in cyber space” as a growing wave of cyberattacks hits major companies, hospitals and government facilities, raising concerns that tens of millions of customer records may have been exposed, according to a report by the Financial Times.

This growing cyber security threat prompted Japan’s financial regulator to warn banks against accepting driving licences as proof of identity when opening new accounts, the news report stated.

But, this is not a country-specific issue. In India, citizens lost ₹22,495 crore to cyber frauds in 2025, as compared to ₹22,845 crore in 2024, according to data sourced from Ministry of Home Affairs. Despite the slight decline in the amount lost, the number of cyber fraud cases increased, the data showed.

These incidents highlight the risks individuals face from data breaches, identity theft and online fraud, raising questions about how cyber insurance can help cover financial losses arising from such incidents.

How does a cyber insurance policy work?

If your personal information is stolen or misused shopping online or carrying other other digital transactions, a personal cyber insurance policy can cover eligible financial losses. It covers incidents such as identity theft, phishing, online banking fraud or unauthorised transactions, depending on the coverage.

Some insurance policies may also cover expenses related to data restoration, legal assistance and responding to privacy breaches, according to Ankit Gupta, CTO, Policybazaar for Business.

However, he added, cyber insurance policies also come with certain exclusions. Incidents that occur before the policy is purchased, deliberate or fraudulent acts by the insured, and certain business-related or investment losses may not be covered. “Some policies may also exclude specific types of cybercrime or impose limits on the amount payable for particular incidents,” he said.

How much does cyber insurance cost in India?

Gupta said that the premium of a basic individual cyber insurance plan starts at ₹325 per year for a sum insured of ₹1 lakh. It typically covering two risks: identity theft and theft of funds. The final premium, however, depends on how comprehensive the policy is, and is mainly determined by three factors.

• Sum insured: The higher the sum insured, the higher the premium. Individuals should choose a sum insured that reflects their level of online activity and the amount of money they typically transact digitally.
• Coverages and add-ons: Beyond the base cover, policyholders can opt for additional protection such as malware attacks, cyber extortion, vishing, phishing, social media liability, cyberbullying and stalking, loss of reputation, online shopping and online sales fraud, data restoration, network security liability, and privacy and data breach liability, including breaches by third parties. Some plans also cover legal and forensic expenses, smart home devices or loss of professional income.
• Number of persons covered: Cyber insurance is available as individual or family plans. A family plan generally covers the policyholder, their spouse and up to two children, while a few insurers also allow more family members to be added. Adding family members to the policy raises the premium.

“Thus, rather than simply choosing the cheapest plan, individuals should compare the sum insured, covers included, sub-limits and exclusions to find a policy that matches their digital usage and risk exposure,” he advised.

⁠How can someone file a claim after a cyberattack?

Gupta said policyholders should inform their insurer as soon as possible after discovering a cyber incident, explain what happened and follow the prescribed claims procedure. Prompt reporting is important, as policies may specify deadlines for notifying the insurer, he warned.

“The insurer may ask for the following documents, depending on the nature of the incident like to fill up a claim form and identity/KYC documents, copy of the police complaint or cybercrime complaint/FIR, where required. Evidence of the incident, such as screenshots, suspicious emails or messages and bank statements and transaction details if financial fraud is involved,” he said.

Once the documents are submitted, the insurer assesses the claim and may seek additional information or investigate the incident before deciding on settlement. The exact requirements and timelines may vary across insurers.