Hong Kong Premiums Up 30%; AI Automated Attacks Frequent; Microsoft Outage Ripples Through Cyber Insurance — Daily AI and Cyber Risk Summary
In a nutshell: As Hong Kong's insurance business grows steadily, AI-assisted automated attacks and large-scale system failures are simultaneously reshaping the cyber risk and insurance coverage needs that enterprises face.
Financial Secretary Paul Chan said in his address at the 2026 Asian Insurance Forum that Hong Kong's gross premiums reached HK$827 billion last year, up 30%, and rose over 35% again in the first half of this year; he also noted that geopolitics, climate disasters, cyber threats, and artificial intelligence are simultaneously changing the risks insurers underwrite and the way they operate, and the government is studying the introduction of a "protected cell company" structure to expand the risk management market (Zhitong Finance / Tencent News, 2026-11-13).
On the attack side, Palo Alto Networks Unit 42 revealed on 12 November that a China-linked group connected the open-source "Cairn" penetration-testing framework to the Zhipu GLM 5.2 and DeepSeek V4 models, launching 25 autonomous attack campaigns in August and September against 19 institutions, successfully intruding into 10 and extracting over one million records from one of them (AISeng Tech relaying Unit 42, 2026-11-12).
The global Microsoft 365 outage also sparked underwriting concern. Risk modelling firm Kovrr estimated that the underwriting loss from this outage ranges between US$300 million and US$1.4 billion, with a median of about US$700 million, similar in nature to the 2024 CrowdStrike incident, with claims depending on whether enterprises' policies cover non-malicious system failures by technology suppliers (Business Recorder, 2026-11-13).
Singapore's Cyber Security Agency (CSA) warned on the same day that local cyber incidents have tripled since September, and that AI is helping attackers discover and exploit vulnerabilities faster, greatly compressing enterprises' patching time window, urging organisations to patch immediately and adopt anti-phishing multi-factor authentication (AISeng Tech relaying CSA, 2026-11-13).
On incident records, Klaimee's "AI Agent Incident Watch" updated on 13 November: cloud platform Railway said attackers used autonomous agents to steal AI keys from up to 100,000 workspaces, with unauthorised charges from impersonation estimated at US$740,000; Notion also confirmed that the Fireworks incident leaked AI conversations and API keys from a small number of workspaces (Klaimee, 2026-11-13).
The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.