The finding points to a cyber risk profile that differs from many other regions. For insurers, privacy incidents can trigger regulatory scrutiny, legal expenses, notification costs, and reputational damage, even when operational disruption is limited.

