Australian companies’ spending on cyber insurance could surge by 70 per cent to more than $800 million in the next two years, as businesses seek protection against hackers and governments impose tougher penalties for data breaches.

The damaging cyberattacks on Optus and Medibank Private have underlined the financial threat posed by hackers, and Macquarie research highlights the growth in what businesses are spending on insurance against this risk.

The investment bank’s analysts estimated gross written premiums for cyber insurance in Australia had more than doubled since 2020 to $480 million this year, and they predicted this figure would jump to $815 million in 2024.

While cyber insurance is still a relatively small market compared with other types of cover, it is expanding quickly as premium rates surge, with the analysts saying demand for cyber protection had exceeded supply from insurers.

The analysts said 68 per cent of ASX 200 companies bought cyber insurance and this figure was likely to climb after the Optus and Medibank attacks, while government moves to jack up fines for privacy breaches could send premiums climbing further.

“The proposed backdating of higher fines in Australia could lead to a further 12-24 months of significant repricing across all industries,” they said.

When companies suffered a cyberattack, the biggest costs were legal and consulting expenses to rebuild their technology, rather than fines and ransoms, the analysts said. Although boards have been repeatedly warned to put more focus on cyber risks, the research said environmental, social and governance (ESG) ratings agencies were yet to put enough focus on cyber when reviewing companies’ ESG risks.

“Data is the new coal – once the greatest asset on the balance sheet, now the greatest contingent liability,” it said.

Aside from hacks of Optus and Medibank, there was also a data breach last month at a shopping website owed by Woolworths, while The Smith Family was attacked last week.