Bank cyber insurance claims pass Rs 150 crore in FY27; premiums soft

Cyber insurance claims made by Indian banks are estimated to have crossed Rs 150 crore so far in the 2026-27 financial year, which began on 1 April, according to industry experts cited in a report on Sunday, 1 November 2026. The claims follow cyber incidents at several lenders this year that have caused losses for insurers covering banking, financial services and insurance firms. Despite the rise, premium rates for cyber cover remain soft, the experts said, because insurers and reinsurers, including foreign players entering India, have added capacity.

Cyber insurance pays a company for losses after a cyberattack or data breach, such as the cost of investigating the breach, restoring systems, notifying customers, and some legal claims. For banks, which hold large amounts of customer data and money, it has become a standard part of managing risk. Rising claims show that attacks are not just a technology problem; they now have a clear cost on the balance sheets of both banks and insurers.

The soft pricing is unusual. Normally, when claims rise, insurers raise premiums. Here, more insurance capacity, including from foreign reinsurers, has kept rates down for now. That is good for banks in the short term, because cover stays affordable. But the experts' warning is important: if losses keep rising, the market could turn quickly, and banks might find cover more expensive or harder to buy, especially smaller lenders.

The incidents also matter for customers. A data leak can expose names, phone numbers and loan details that criminals then use for phishing calls and messages. When a bank says its core systems are unaffected, it usually means money in accounts is safe, but leaked personal data can still be misused. Customers of any affected lender should be wary of calls or messages that quote their loan or account details and ask for OTPs or payments.

For the business of banking technology, the trend points to more spending on security, monitoring and data controls, including on third-party platforms that banks use for customer management. AU Small Finance Bank's case involved data on a third-party platform rather than its core banking systems, an area where scrutiny is likely to grow.

Peepals calculation: Rs 150 crore of claims over about seven months of the financial year (April to October) works out to roughly Rs 21 crore a month (150 ÷ 7 ≈ 21.4). Spandana Sphoorty's reported fraud of Rs 7.8 crore over 82 accounts averages about Rs 9.5 lakh per account (7.8 crore ÷ 82 ≈ 9.51 lakh). Our calculation from the reported figures.

Short-term: Insurers will look harder at banks' security controls when renewing cover, and lenders hit by incidents will be pressed by customers and regulators for details.

Long-term: If claims keep climbing, premiums could rise and cover could tighten, pushing banks to spend more on security to stay insurable.

Who is affected: Banks and financial firms; general insurers and reinsurers writing cyber cover; bank customers whose data may be exposed; and cyber-security service providers.

Questions and Answers