Directors & Officers in the Digital Age: Managing New Technological Risks Across APAC

Directors & Officers in the Digital Age: Managing New Technological Risks Across APAC
May 20, 2025 11 mins

Directors & Officers in the Digital Age: Managing New Technological Risks Across APAC

Directors & Officers in the Digital Age: Managing New Technological Risks Across APAC

With rapid technological advancements, directors and officers face increasing liabilities. Proactive risk management and board oversight can ensure organizational resilience.

Key Takeaways
  1. Directors and officers now face expanded responsibilities in the digital age. The rise of AI and cyber threats has added new risks.
  2. Directors must regularly update cyber security measures and have strong incident response plans to manage cyber incidents.
  3. Legal expectations for directors are increasing with technological advancements, requiring them to navigate a complex regulatory landscape.

The integration of advanced technologies, such as artificial intelligence (AI) into business operations and the increasing prevalence of cyber threats, has introduced new dimensions of risk for directors and officers today.

Aon’s 2024 Intangible Versus Tangible Risks Comparison Report found that most organizations use or intend to use AI products or services. Nearly half of S&P 500 companies now mention AI on their earnings calls, with this number even higher in some cases.

Andrew Mahony, Aon’s financial services, professions and cyber solutions co-leader for Asia, notes: “Vulnerability exploitation is becoming more effective than spear phishing in recent times, which requires more than just training staff. It requires technical solutions and a robust approach to attack surface management.”

The Australian Securities and Investments Commission reports that cyber attacks, data breaches and system failures are eroding market confidence and causing financial losses. It is no wonder that cyber risks are a top priority for directors and officers (D&O) insurance markets in the Asia Pacific (APAC) region.

“Strong governance frameworks addressing technology-related risks are vital to protect directors and officers from potential liabilities,” says Julie Hamilton, national D&O practice group leader in Australia. “For example, boards need to ensure they are providing clear stewardship to their organizations in an evolving landscape. They should also ensure their D&O policies cover liabilities from AI and other advanced technologies.”

In 2024, Stanford Securities Litigation Analytics began tracking Securities Class Actions filings with allegations related to AI as a trend category. While AI-related filings1 are not new (the number of AI-related filings more than doubled in 2024 compared to 2023), the growing prominence of AI in many companies' business models may lead to an increase in such filings in the future.

Case Study: Technology Risk is D&O Risk

Case Study

Technology Risk is D&O Risk

Medibank, one of Australia's largest private health insurers, faced a significant cyber attack that compromised sensitive customer data.2 The attackers accessed personal information, including medical records, sparking public outcry and regulatory scrutiny. This incident highlighted potential issues with its cyber security measures3 and board oversight.4 The Australian Information Commissioner is pursuing civil penalties against Medibank for allegedly failing to protect the personal information of 9.7 million Australians, violating the Privacy Act 1988. Additionally, the Australian Prudential Regulation Authority took action,5 emphasizing the need for stronger cyber security practices.

Growing Legal Expectations for Directors Across APAC

As technology rapidly evolves, so do the legal expectations placed upon directors. They must now navigate a complex regulatory landscape designed to address the growing risk associated with technological advancements.

A notable development is the introduction of a statutory tort for serious invasions of privacy in Australia, effective 10 June 2025. This law allows individuals to seek damages for privacy infringements or misuse of information, potentially resulting in significant legal and regulatory repercussions for directors and officers.

Similarly, several Asian countries are also enhancing their legal and regulatory frameworks to address cyber security and privacy concerns.

In South Korea, the Personal Information Protection Act is one of the world's most stringent privacy laws. The law requires companies to implement robust data protection measures and report data breaches promptly. Non-compliance can lead to heavy fines and criminal charges against responsible officers.

In Singapore, the Cybersecurity Act 2018 mandates that owners of critical information infrastructure take proactive steps to protect their systems and report cyber incidents. The Personal Data Protection Commission enforces strict guidelines under the Personal Data Protection Act to safeguard personal data, with penalties reaching up to SGD 1 million or more for severe breaches.

Japan has also strengthened its regulations with the enactment of the Act on the Protection of Personal Information (APPI). The amended APPI, effective since April 2022, imposes stricter requirements on businesses handling personal data, including mandatory breach notifications and enhanced data subject rights. Failure to comply can result in substantial fines and reputational damage.

These developments across APAC point toward a global trend to hold directors and officers accountable for cyber security and privacy, stressing the need for strong risk management and vigilance against technological threats.

For instance, after the 2017 Equifax breach,6 various lawsuits were brought against the company, and a senior executive was charged in connection with the incident. Similarly, the SolarWinds incident7 saw its chief information security officer, held responsible in lawsuits. These cases highlight the ongoing legal accountability for cyber security management, emphasizing the need for robust risk management and vigilance against technological threats.

Asian Telecom Breach

Case Study

Asian Telecom Breach

In early 2025, a major Asian telecom company faced a cyber attack that went undetected for over four years. State-sponsored hackers, known as Weaver Ant, exploited a misconfigured public application to gain access, using web shells and tunneling tools for persistent cyber espionage.8 The breach compromised sensitive information and underscored the importance of updating cyber security frameworks and continuous monitoring to address evolving threats. In response, U.S. legislators have proposed new laws aimed at requiring telecom companies to strengthen their cybersecurity measures.9

Directors are also being held accountable for their company's breaches of statutory obligations through the “Stepping Stone” liability.10 Regulators may allege that directors or officers have breached their duty of care and diligence by allowing or failing to prevent a company from breaching other legal obligations, potentially leading to civil penalties and disqualification.

Stepping Stone Liability
Stepping Stone Liability

Source: Clayton Utz11

Directors and Officers Face Regional Complexities

On top of expanding legal expectations, directors and officers are seeing significant differences in the D&O landscape across the APAC region. While heightened competition among insurers presents opportunities for cost savings, each country faces unique challenges and regulatory scrutiny. Rapid digital transformation, climate disclosures, AI governance, and cyber security are key factors influencing the D&O market, with varied emphasis and impact across different countries.

  • Australia
    • The D&O market for insureds has seen favorable conditions, with increased competition and opportunities for cost savings.
    • Insurers are focusing on emerging risks such as climate disclosures, AI governance and cyber security.
  • India
    • The country is experiencing rapid digital transformation, which has led to an increase in cyber threats.
    • Directors and officers need to be vigilant about cyber security and ensure that their organizations have robust risk management frameworks in place.
  • Japan
    • There is a growing focus on AI governance and the ethical use of technology.
    • Directors and officers are expected to implement robust governance frameworks to manage AI-related risks and ensure ethical practices.
  • Mainland China
    • China’s stringent cyber regulations (Cybersecurity Law, Data Security Law, Personal Information Protection Law) mandate rigorous data governance, cross-border transfer controls and breach reporting.
    • Directors and officers must prioritize compliance amid rapid digitalization, heightened cyber threats (e.g., state-sponsored attacks, ransomware) and evolving AI governance risks.
    • The Cyberspace Administration of China enforces strict accountability, requiring robust incident response plans, vendor due diligence and alignment with national standards such as the Multi-Level Protection Scheme.
    • Insurers increasingly tie D&O coverage to demonstrable cyber resilience and regulatory adherence.
  • New Zealand
    • The country lacks broad regulatory rigor in cyber security and AI, but the Financial Markets Authority and Reserve Bank of New Zealand are increasingly interested in how regulated entities manage data privacy risk and cyber resilience.
    • New Zealand D&O insurers emphasize the need for compliance with data protection laws and ethical AI governance to mitigate evolving sources of claims.
    • While litigation from cyber events has been rare locally, many New Zealand organizations and their boards are influenced by international trends, especially from Australia.
  • Singapore
    • The regulatory environment is stringent, with the Monetary Authority of Singapore (MAS) emphasizing the importance of cyber resilience.
    • Directors and officers must ensure compliance with MAS guidelines to avoid regulatory penalties.

$660K

The maximum penalty for non-serious interference with privacy that individuals, such as directors and officers, may face from the OAIC.

Source: Privacy and Other Legislation Amendments Act 2024 (Cth)

Four Proactive Steps for Directors and Officers

Regional dynamics indicate the need for specific risk management strategies to address the challenges faced by directors and officers in different countries.

Four proactive steps that directors and officers can take to manage cyber security risks, ensure compliance with regulatory expectations and sustain organizational resilience include:

  1. Regular Review of Risk Management Frameworks: Directors must ensure that their organizations’ cyber security measures are regularly reviewed and updated to address new and evolving threats. Using analytics frameworks and models, such as Aon’s Cyber Impact Analysis, can help to provide a financial quantification of cyber risks. Should a cyber incident occur, these models can demonstrate to regulators, shareholders, and courts that the board attempted to define the materiality of risks to inform appropriate control strategies in order to protect shareholder equity, customers and the public.
  2. Board Oversight and Accountability: The board must take an active role in overseeing cyber security practices and ensuring that there is accountability at all levels of the organization. For example, Wyndham Worldwide Corporation managed to successfully dismiss a shareholder derivative suit seeking damages arising out of three data breaches that occurred between 2008 and 2010 by highlighting its proactive approach to cyber security during multiple board meetings. The board successfully demonstrated a consistent focus on data security, including regular updates on data security measures, risk assessments and consultations with cyber security experts, reflecting the board’s ongoing commitment to addressing potential vulnerabilities.
  3. Training and Awareness: Directors should appropriately resource privacy and cyber security. They must ensure that they and their management teams are adequately trained and aware of the latest cyber security risks and best practices.
  4. Incident Response Planning: Organizations must have robust incident response plans in place to quickly and effectively respond to cyber incidents and mitigate their impact.

“Ensuring that organizations are well-prepared to handle cyber incidents allows directors and officers to protect themselves and their business from the increasing risks associated with the digital age,” says Ling Yu, Aon’s financial services and professions group leader for Asia.

Aon’s Thought Leaders
  • Andrew Mahony
    Cyber Solutions Leader, Financial Services, Professions & Cyber Co-Leader, Asia
  • Julie Hamilton
    National D&O Practice Group Leader, Australia
  • Ling Yu
    Financial Services & Professions Group Leader, Asia
  • Michael Parrant
    Director & Cyber Practice Leader, Australia

1 Securities Class Action Filings – 2024 Year in Review, Cornerstone Research
2 Australia regulator tells Medibank to set aside $167 million after data breach, Reuters
3 Medibank admits it didn't have cyber insurance to cover data hack, The ABC
4 Corporate governance implications of Medibank enforcement proceedings, Johnson Winter Slattery
5 APRA takes action against Medibank Private in relation to cyber incident, APRA
6 Equifax Data Breach Explained: A Case Study, Breachsense
7 What Is the SolarWinds Cyberattack?, Zscaler
8 Sygnia Discovers New Active China-Nexus Threat Actor Weaver Ant, Business Wire
9 Chinese hackers secretly infiltrated Asian telcos for years, report finds, Capacity Media
10 Don't keep it on the down low: data breaches, mandatory notification, personal liability of directors, and D&O policies, Clayton Utz
11 Don't keep it on the down low: data breaches, mandatory notification, personal liability of directors, and D&O policies, Clayton Utz

 

General Disclaimer

The information contained herein and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity. It is not intended to be comprehensive, nor does it, or should it (under any circumstances) be construed as constituting legal advice. You should seek independent legal or other professional advice before acting or relying on any of the content of this information. Although we endeavor to provide accurate and timely information and use sources, we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation. Aon will not be responsible for any loss, damage, cost or expense you or anyone else incurs in reliance on or use of any information contained in this article.

Terms of Use

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.

Aon's Better Being Podcast

Our Better Being podcast series, hosted by Aon Chief Wellbeing Officer Rachel Fellowes, explores wellbeing strategies and resilience. This season we cover human sustainability, kindness in the workplace, how to measure wellbeing, managing grief and more.

Aon Insights Series Asia

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series Pacific

Expert Views on Today's Risk Capital and Human Capital Issues

Aon Insights Series UK

Expert Views on Today's Risk Capital and Human Capital Issues

Client Trends 2025

Better Decisions Across Interconnected Risk and People Issues.

Construction and Infrastructure

The construction industry is under pressure from interconnected risks and notable macroeconomic developments. Learn how your organization can benefit from construction insurance and risk management.

Cyber Labs

Stay in the loop on today's most pressing cyber security matters.

Cyber Resilience

Our Cyber Resilience collection gives you access to Aon’s latest insights on the evolving landscape of cyber threats and risk mitigation measures. Reach out to our experts to discuss how to make the right decisions to strengthen your organization’s cyber resilience.

Employee Wellbeing

Our Employee Wellbeing collection gives you access to the latest insights from Aon's human capital team. You can also reach out to the team at any time for assistance with your employee wellbeing needs.

Environmental, Social and Governance Insights

Explore Aon's latest environmental social and governance (ESG) insights.

Q4 2023 Global Insurance Market Insights

Our Global Insurance Market Insights highlight insurance market trends across pricing, capacity, underwriting, limits, deductibles and coverages.

Regional Results

How do the top risks on business leaders’ minds differ by region and how can these risks be mitigated? Explore the regional results to learn more.

Human Capital Analytics

Our Human Capital Analytics collection gives you access to the latest insights from Aon's human capital team. Contact us to learn how Aon’s analytics capabilities helps organizations make better workforce decisions.

Human Capital Quarterly Insights Briefs

Read our collection of human capital articles that explore in depth hot topics for HR and risk professionals, including using data and analytics to measure total rewards programs, how HR and finance can better partner and the impact AI will have on the workforce.

Insights for HR

Explore our hand-picked insights for human resources professionals.

Workforce

Our Workforce Collection provides access to the latest insights from Aon’s Human Capital team on topics ranging from health and benefits, retirement and talent practices. You can reach out to our team at any time to learn how we can help address emerging workforce challenges.

Mergers and Acquisitions

Our Mergers and Acquisitions (M&A) collection gives you access to the latest insights from Aon's thought leaders to help dealmakers make better decisions. Explore our latest insights and reach out to the team at any time for assistance with transaction challenges and opportunities.

Natural Resources and Energy Transition

The challenges in adopting renewable energy are changing with technological advancements, increasing market competition and numerous financial support mechanisms. Learn how your organization can benefit from our renewables solutions. 

Navigating Volatility

How do businesses navigate their way through new forms of volatility and make decisions that protect and grow their organizations?

Parametric Insurance

Our Parametric Insurance Collection provides ways your organization can benefit from this simple, straightforward and fast-paying risk transfer solution. Reach out to learn how we can help you make better decisions to manage your catastrophe exposures and near-term volatility.

Pay Transparency and Equity

Our Pay Transparency and Equity collection gives you access to the latest insights from Aon's human capital team on topics ranging from pay equity to diversity, equity and inclusion. Contact us to learn how we can help your organization address these issues.

Property Risk Management

Forecasters are predicting an extremely active 2024 Atlantic hurricane season. Take measures to build resilience to mitigate risk for hurricane-prone properties.

Technology

Our Technology Collection provides access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities of technology. Reach out to the team to learn how we can help you use technology to make better decisions for the future.

Top 10 Global Risks

Trade, technology, weather and workforce stability are the central forces in today’s risk landscape.

Trade

Our Trade Collection gives you access to the latest insights from Aon's thought leaders on navigating the evolving risks and opportunities for international business. Reach out to our team to understand how to make better decisions around macro trends and why they matter to businesses.

Transaction Solutions Global Claims Study

Better Decisions Across Interconnected Risk and People Issues.

Weather

With a changing climate, organizations in all sectors will need to protect their people and physical assets, reduce their carbon footprint, and invest in new solutions to thrive. Our Weather Collection provides you with critical insights to be prepared.

Workforce Resilience

Our Workforce Resilience collection gives you access to the latest insights from Aon's Human Capital team. You can reach out to the team at any time for questions about how we can assess gaps and help build a more resilience workforce.

More Like This

View All
View All
Subscribe CTA Banner
OSZAR »