How exposed are Asia's factories to cyberattacks?
Many industrial losses fall outside traditional insurance policies.
Asia-Pacific (APAC) manufacturers are becoming more vulnerable to cyberattacks that can damage factories and disrupt production, but many may not have insurance covering the resulting physical losses.
“As operational technology becomes more integrated with IT (information technology) systems, cyber-attacks are increasingly targeting systems that control industrial activity, raising the potential for disruption to physical operations impacting machinery, facilities and production processes,” Georgie Furness-Smith, a cyber underwriter at Tokio Marine Kiln Group Ltd. (TMK) Asia, said in a June statement.
She said cyber risks remain underinsured partly because big industrial losses have been relatively uncommon, even as attacks on operational technology continue to increase.
APAC region accounts for more than half of global manufacturing output and posted about one-third of worldwide cyber incidents in 2024, the highest share of any region, TMK said in a report.
Manufacturing was the most targeted industry, whilst system intrusion attacks accounted for about 80% of breaches, up from 38% a year earlier.
TMK said many standard cyber insurance policies exclude physical damage, whilst property insurance might exclude losses caused by cyber incidents. As a result, companies could face uninsured repair costs and business interruption after an attack.
It added that manufacturers, logistics operators, healthcare providers, utilities, and power generators face growing exposure as they adopt more connected equipment, automation, and artificial intelligence.
Munich Reinsurance Company also identified a protection gap amongst consumers.
Its Global Cyber Risk and Insurance Survey 2026 found that 58% of respondents had experienced or been affected by a cyberattack, including online shopping fraud, malware, fraudulent bank transfers, data theft, and identity theft.
Despite that, 41% said they neither had nor intended to buy personal cyber insurance. Amongst those without cover, 32% were unaware such products existed, 31% considered them too expensive, and 19% did not understand what they covered.
Munich Re estimated global fraud losses at as much as $500b annually, including both digital and nondigital fraud.
Questions to ponder:
- How can manufacturers close cyber insurance gaps as factories become more connected and automated?
- Should cyber insurance evolve to cover physical damage caused by attacks on industrial systems?
- What can insurers do to improve awareness and adoption of cyber insurance amongst businesses and consumers?
Read Here
Advertise
Sign Up
EXPERT OPINION
In my view, the article highlights a significant and growing protection gap for Asia-Pacific manufacturers. Cyber risk is no longer limited to data breaches, ransomware or non-physical business interruption. As factories become increasingly reliant on Operational Technology (OT), automation, AI-enabled production and connected supply chains, cyber incidents can result in physical damage, production shutdowns and wider supply-chain disruption.
From a Hong Kong insurance market perspective, the key concern is that insurance coverage may not align with the underlying exposure. APAC accounted for approximately one-third of global cyber incidents in 2024, with manufacturing being the most targeted sector. At the same time, many cyber policies exclude physical damage, whilst property policies often exclude cyber-related perils. Consequently, insureds may discover after a significant incident that repair costs, machinery damage and related business interruption losses are not fully covered.
Cyber insurance should evolve to provide affirmative cover for cyber-triggered physical damage and business interruption, but this requires specialist underwriting. Unlike traditional cyber risks, cyber-physical exposures require an understanding of industrial processes, safety systems, machinery behaviour and OT environments. These risks should therefore be assessed through a combined cyber, property, engineering and business interruption lens rather than as a simple extension to conventional cyber policies.
Manufacturers can reduce this protection gap by identifying their critical IT and OT dependencies and assessing whether existing property, cyber and business interruption programmes respond appropriately to cyber-triggered events. Hong Kong’s Insurance Authority GL20 framework provides a useful reference, emphasising the identification of critical systems and dependencies, business impact analysis, continuous monitoring, and incident response planning. For insurers, the opportunity is substantial, with the global cyber insurance market expected to continue growing. However, sustainable growth will depend on clear policy wordings, robust accumulation modelling, effective incident response support and better policyholder education. The industry should avoid creating further uncertainty through silent or ambiguous cyber exposures within traditional property programmes.
The article also highlights a continuing awareness gap. Cyber insurance is often viewed solely as a data breach product, whereas insurers and brokers should position it more broadly as an operational resilience solution encompassing incident response, forensic services, cyber crime, liability, business interruption and, where purchased, cyber-triggered physical damage cover.
Overall, I agree with the article’s conclusion that Asia’s factories face a growing cyber-physical risk exposure and that the insurance protection gap is real. Manufacturers should undertake structured cyber-physical exposure assessments, insurers should develop clear affirmative coverage where they possess the required expertise, and brokers should help clients align operational resilience risks with policy coverage. In Hong Kong and across APAC, those insurers best able to combine cyber expertise, engineering knowledge and disciplined underwriting are likely to be the most successful.