Buyers urged to review war exclusions as cyber risks rise

Risk managers should pay extra attention to exclusions in their insurance contracts amid a growing threat of nation-state cyberattacks and recent litigation, legal experts have told Commercial Risk. The warning comes as Fitch Ratings said this week that businesses with links to Russia or Ukraine, as well as firms in countries that have imposed sanctions on the former, are running a heightened risk of cyberattacks. Fitch said the number of cyberattacks has already increased since conflict broke out. It believes there is the risk of more widespread spillover cyberattacks against other, non-primary targets in line with the 2017 NotPetya cyberattack, which began as an attack on the Ukrainian government and the country’s businesses, and quickly spread to the rest of the world. NotPetya, which impacted shipping company Maersk, US pharma group Merck and food group Mondelez, was later blamed on the Russian military by the UK and the US. Both Merck and Mondelez sought to recover some of their losses from their insurance, which their insurers denied. Almost five years on, Merck recently won its case against its insurers, led by Chubb, which had sought to use a war exclusion to deny the US pharmaceutical company’s $1.4bn claim for physical damage and business interruption (BI) losses related to NotPetya. Mondelez’s $100m dispute with its insurer Zurich is ongoing. Merck’s all-risk property policy, which did not have a cyber exclusion, included cover for losses resulting from destruction or corruption of computer data software. However, it did contain an exclusion for war and hostile acts. The New Jersey court ruled in favour of Merck, saying that a “reasonable understanding” of “hostile or warlike action” only applied to “traditional forms of warfare”, and therefore the war exclusion did not apply to the cyberattack. The ruling, which may yet be appealed, sends an important message out to insurers and policyholders, according to Julian Miller, a partner at law firm DAC Beachcroft. “The ruling, while of only limited precedential value, is of great interest to the market as it is one of the first related to war and cyber. It highlights that insurers should be concerned about the application of war exclusions for cyberattacks, and the need to put in place specific cyberwar and terrorism clauses,” he said. Companies and their insurers have a vested interest in understanding how insurance policies will respond to the growing threat from sophisticated state-sponsored cyber threats, according to Michael Bahar, partner and co-lead of global cybersecurity and data privacy at Eversheds Sutherland. “Both sides have an interest in clarifying cover, whether they exclude or include. At this point I don’t believe ambiguity is helpful as this is now a much higher probability event than it was. A few years ago, you could have said it was unlikely to happen, now it’s a question of when not if,” said Bahar. Growing geopolitical tensions make the recent Merck ruling more pertinent, according to Hans Allnutt, partner and head of DAC Beachcroft's cyber and data risk team. “Insurers need to look at their wordings and make sure [war and terrorism] clauses are up to date for cyberattacks. The threat of Russian-sponsored cyberattacks [due to] the conflict in Ukraine shows that this issue needs to be urgently addressed,” he said. Insurers have been making changes to policies since NotPetya to address ambiguity around nation-state cyberattacks and the application of war exclusions, explained Bahar. This process is likely to accelerate following the recent Merck case. “With the increase in the number of cyberattacks sponsored by state actors, you are going to see more disputes around legacy force majeure clauses or force majeure clauses that people did not focus on when they agreed their policy,” warned Bahar. Cyberattacks typically fall just below the threshold for armed conflict, which would be excluded under force majeureclauses, he explained. However, a state government could declare a cyberattack an act of war, he added. “In a repeat of NotPetya, many insureds would be surprised to find they are not covered [under a cyber policy, due to exclusions],” according to Bahar. “Those that have taken the time to exclude cyberattacks from the force majeureclause should be pleased to find it is covered. [That’s] not to say there won’t be litigation. But the more clarity you get the better,” he said. Insurance companies are spending a lot more time thinking through exclusions but it is incumbent on insureds to look at how their insurer is defining cover too, said Bahar. “It’s important to read the coverage and make sure both sides know what is covered and what isn’t,” he said. It’s better to get clarity at the outset and not wait for a loss to test the policy, according to Bahar. “Removing ambiguity over whether a nation-state cyberattack is excluded has advantages for both parties. Potentially it may mean less cover but certain industries like critical infrastructure are more likely to need cover against a state-sponsored cyberattack,” he said. “There has been increased attention on defining cyberattacks in terms of acts of war and terrorism. Whether there is a consistent approach to wording is yet to be determined, given the evolving nature of the threat, regulations and the [cyber insurance] market,” added Bahar. DAC Beachcroft recently supported the Lloyd’s Market Association (LMA) in its bid to update wordings for cyberwar and terrorism. “In November, the LMA issued four clauses in modern language that address the issue of cyberwar head on. They have yet to be widely adopted but they are a positive reflection on the market and show insurers are proactively developing wordings and not just responding to court rulings,” said Bahar. Future events will test policy wordings and clauses, according to Miller. “We are now transitioning to an era of testing the extent of coverage under a cyber insurance policy,” Allnutt said. There are a number of other grey areas related to cyber coverage, according to Miller. Areas of coverage that could lead to future disputes and litigation include the treatment of double insurance, the aggregation of cyber claims and the calculation of cyber-related BI losses. It is yet to be seen how existing clauses in these areas will translate to cyber claims and whether they are appropriate for cyber losses, said Miller.

Buyers urged to review war exclusions as cyber risks rise

Want to read this article?

Read Next

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Want to read this article?

Read Next

Courage and collaboration needed to manage emerging construction sector risks

Dubai floods put $8bn of aircraft at risk, estimates Russell Group

Parima heads to Manila for first of three conferences this year

Munich Re ‘more likely’ to exceed 2024 profit target after €2.1bn gain in Q1

Insurance Europe calls for EC to ‘get it right’ on Solvency II

Related Articles