SINGAPORE: In November 2025, two sales and operations staff from Singapore-based freight forwarding company UEI Logistics received an e-mail that looked entirely routine.
It appeared to be from a Chinese shipping agency it had worked with for years. The sender asked for payment of US$18,288 (S$23,200) to be transferred to a different bank account, claiming that the original account was hit with high government transaction taxes.
Sensing something was amiss, the staff alerted managing director Terrence Tan. He noticed the sender’s e-mail domain was subtly different. A quick call to the Chinese partner confirmed his suspicions. The e-mail was a scam.
He said: “It was very scary and convincing because the attackers impersonated someone we work regularly with.”
The incident was a wake-up call for UEI Logistics, which has increasingly been receiving phishing e-mails from scammers. It prompted the firm to deploy a threat detection system from ST Engineering to look for suspicious activities round the clock, and purchase a cyber insurance plan from MSIG through the Cybersecurity Association of Singapore.
An annual payment of $980 gives UEI Logistics $300,000 coverage in the event of a breach for the cost of forensic investigations, legal counsel and hardware replacement, among others.
UEI Logistics is among a growing number of companies in Singapore which are taking up cyber insurance.
Eight insurers and brokers that The Straits Times spoke to reported increasing demand, especially over the past two to three years.
Insurers said that technology and financial firms, including banks, fintech and cloud providers, remain among the strongest buyers, with growing demand from manufacturing, transport and logistics, retail, healthcare, hospitality and professional services as they digitalise.
US-headquartered speciality insurer Markel said its cyber insurance business in Singapore has been increasing steadily since 2022. Most recently in 2023 and 2024, the number of policies sold yearly grew between 56 per cent and 125 per cent.
Regional insurer QBE Asia, meanwhile, sold 25 per cent to 30 per cent more policies to companies in Singapore from 2024 to 2026.
French-based insurer AXA XL and American insurance broker Marsh also said they sold more policies to first-time buyers here and fielded more queries from 2023 to 2025, but did not reveal business growth numbers.
Singapore-based AWG Insurance Brokers and London-headquartered broker Howden said more companies bought cyber insurance policies, but they did not reveal figures.
Japanese insurer MSIG and German insurer Allianz reported an increase in the number of Singapore customer queries, but did not reveal exact numbers.
Cybersecurity policies typically insure firms against the costs of recovering from data breaches and ransomware attacks, such as hiring forensic experts and lawyers, and restoring lost data.
Premiums depend on a company’s size, sector, where it operates, claims record, cyber defences, risk exposure, and the amount and breadth of coverage purchased, among others.
Media reports of damaging cyber attacks have brought the potential financial and operational fallout into sharper focus, prompting more businesses to seek coverage against losses for ransomware, sophisticated social engineering techniques and prolonged business outages.
At the same time, AI is enabling faster, larger-scale and more sophisticated attacks – a threat already felt by businesses here.
A May 2026 QBE survey involving 400 Singapore companies found that 39 per cent of firms had experienced at least one AI-related cyber incident in the past year.
These incidents include AI-generated malware, cyberattacks where AI was used to identify vulnerabilities, and phishing messages with AI-enhanced content.
“Cyber risk is no longer viewed solely as an IT or operational issue. It is increasingly being discussed at the board and senior management level as a governance and enterprise risk concern, leading many organisations to review and enhance their cyber insurance programmes as a fail-safe,” said Howden Singapore’s director of cyber and technology solutions for financial lines, Kenny Tan.
More stringent regulations in Singapore are also making breaches costlier. For example, in October 2022, Singapore increased the maximum penalty for data protection breaches to 10 per cent of an organisation’s annual local turnover, or $1 million, whichever is higher. Previously, the maximum fine was $1 million.
“A mid-sized business with an annual turnover of $20 million faces a potential $2 million fine for a single compliance failure, forcing them to purchase higher limits simply to protect against regulatory liabilities,” said a spokesperson for AWG Insurance Brokers.
Large multinational corporations and government bodies have also made cyber insurance a prerequisite for vendors bidding for contracts.
This is their way of strengthening an oversight of their suppliers’ cybersecurity defences after seeing a growing trend of attackers entering their networks through less-secure vendors, said AXA XL’s head of cyber for Asia and the Middle East, Samuel Bye.
Market conditions have also swung in buyers’ favour. Cyber insurance rates in Singapore have eased from their 2021 to 2022 highs as competition intensified.
Some of the latest entrants include US-based Liberty and Japan-headquartered Sompo, while established insurers such as Chubb, AIG and MSIG offered significantly broader coverage, said industry players.
AWG Insurance Brokers said annual premiums for small businesses with revenue below $2 million have halved since 2022. Such firms can now obtain $250,000 in coverage for premiums starting from $1,000 a year, down from $2,000 previously.
For mid-market firms with annual revenue of between $10 million and $50 million, the starting premium for $2 million in coverage has fallen 25 per cent, from $8,000 in 2022 to $6,000 today.
With premiums falling, some companies are using the room in their budgets get more comprehensive coverage.
The expanded coverage covers losses from cloud outages, failures of critical third-party technology providers, cyber extortion and expenses to recover from reputational harm after a cyber incident, said Olga Wong, head of Markel’s professional & financial risks and cyber team.
Businesses with weaker cyber defences also stand a better chance of obtaining coverage today.
In the past, they would have to fill up checklists of the technical measures they have in place, and may be declined coverage if they fell short even in one area, said industry players.
But after several years of gathering data from cyber incidents and insurance claims, insurers are now better able to estimate the potential cost of an attack for different types of businesses.
This allows them to calibrate and offer coverage to companies with less-developed defences, although they may charge higher premiums or impose more restrictions to account for the greater risk.
Karlis Trops, head of cyber and technology professional indemnity at Allianz Commercial Asia, said the industry used to ask extensive questions when assessing a company for cyber coverage, regardless of size.
“Now, we’ve reached a balance where the number and technicality of questions asked is reflective of the size of the company, what they do and the risks their business face,” said Trops.
Still, there are minimum requirements to meet. These typically include multifactor authentication for all remote access, a robust back-up strategy that includes offline or disconnected back-ups and a formal patch-management process, with faster remediation for high- and critical-severity vulnerabilities.
Insurers are encouraging companies to take advantage of the market conditions to get covered. “Cyber policies have become better value for buyers,” said Trops.
[Correction note: The story has been amended to clarify that UEI Logistics obtained cyber insurance coverage from MSIG through its membership with the Cybersecurity Association of Singapore.] - The Straits Times/ANN
