Cyber breaches in major cities could cost the Australian economy up to $US16 billion ($20.9 billion), according to a study by Lloyd’s and Cambridge University.

Sydney alone has $US4.86 billion ($6.36 billion) of GDP at risk from cyber attack for 2015-2025, ranking it 12th among the world’s 301 major cities, the research shows.

Lloyd’s says businesses of all sizes and sectors need appropriate risk mitigation strategies and coverage in place.

“Where a decade ago people would talk about preventing a cyber attack, the reality is companies will be subjected to attacks,” Lloyd’s Global CEO Inga Beale said during a visit to Sydney last week. “The issue is how you mitigate against that.

“We are living in a world where people carry a globally connected supercomputer in their pocket and almost every important work document is stored in the cloud, on servers or online. The result is an explosion in the potential for cyber risk.”

Ms Beale says Lloyd’s has seen cyber coverage purchased in Australia increase 168-fold in the past two years, as more businesses seek to protect their balance sheets.

“The latest series of high-profile data breaches is just the beginning,” she said. “With the emergence of the Internet of Things, the potential for cyber risk is enormous.”

In the US 25% of businesses now have cyber insurance. Europe may catch up after the EU introduces its General Data Protection Regulation in 2018.

The regulation, with implications for Australian business holding European customer data, requires disclosure of breaches to national data protection authorities and potentially affected individuals.

Ms Beale says managing cyber threats requires a joint effort between government and businesses, and information sharing.

“For insurers that is critical, because we need to understand the risk to price it and provide protection,” she said.

Among other Australian cities in the study, Melbourne’s economic risk was measured at $US3.87 billion ($5.06 billion), followed by Canberra at $US2.8 billion ($3.66 billion).

Brisbane’s risk was $US2.05 billion ($2.68 billion), Perth’s $US1.83 billion ($2.39 billion) and Adelaide’s $US1.01 billion ($1.32 billion).