Cyber Insurance Market and War Exclusions in the Ukraine Conflict Era

The cyber insurance market has been thrown into significant uncertainty by the Ukraine conflict and its cyber dimensions. Nation-state cyber attacks causing massive collateral damage—most famously NotPetya in 2017, which caused an estimated $10 billion in global damages—have forced insurers to confront the question of whether their cyber policies cover state-sponsored attacks. The answer has significant implications for Ukrainian organizations, multinational companies doing business in Ukraine, and the global cyber insurance market's viability.

Lloyd's War Exclusion Mandate

Lloyd's of London mandated in August 2022 that all standalone cyber policies issued through Lloyd's syndicates must include war exclusion clauses—excluding losses from cyber attacks attributed to nation-state actors, specifically where the attack significantly impairs the ability of a state to function or is conducted in response to military attacks. This mandate followed years of industry debate about war exclusion applicability to cyber and was accelerated by the Ukraine conflict's demonstration of state-sponsored cyber attacks causing widespread commercial damage.

The Lloyd's war exclusion requirements specify four minimum standards: exclusion of losses from state-sponsored attacks that "significantly impair" state functioning; limitation of attack attribution requirements to avoid the attribution problem; clear contractual language about what constitutes a "cyber war" event; and requirements for insurers to substantiate any denial of claims under war exclusion. The specification of "significantly impairs state functioning" is intended to cover nation-state attacks like NotPetya and Viasat/KA-SAT while leaving coverage for typical cybercriminal activity.

The Attribution Problem for War Exclusions

War exclusions are legally enforceable only if the war attribution can be established in courts. Credible attribution of nation-state cyber attacks is technically and legally complex: governments attribute attacks through classified intelligence that cannot be disclosed in commercial litigation, private sector forensic attribution may be contested, and the chain of evidence connecting a cyber attack to a specific nation-state meets a different standard in commercial insurance litigation than in diplomatic or intelligence communities. The Merck v. ACE Insurance case—where Merck sued its insurer for $1.4 billion in NotPetya losses after the insurer invoked war exclusion—resulted in a New Jersey court initially ruling in Merck's favor before a complex settlement, illustrating the legal uncertainty.

Cyber Insurance War Exclusion Landscape

US Treasury and TRIA Cyber Debate

The Terrorism Risk Insurance Act (TRIA) provides a US government backstop for insurance losses from certified terrorism events, enabling insurers to provide coverage for catastrophic terrorism risks they could not underwrite alone. The proposal to create a cyber-TRIA equivalent—establishing government reinsurance of catastrophic cyber losses from nation-state attacks—has been debated in Washington policy circles throughout the Ukraine conflict period. The argument is that cyber conflicts involving nation-states create uninsurable systemic risks that require government backstop mechanisms to maintain insurance market viability.

CISA and the Treasury Department jointly convened multiple stakeholder consultations on a cyber insurance backstop mechanism, with the conclusion as of 2024 being that further study was required before any legislative proposal. The challenges include defining the triggering events, setting appropriate premium structures, and balancing government backstop access with moral hazard concerns about reducing organizational incentives for cybersecurity investment.

Alternative Financing for Ukrainian Organizations

With conventional cyber insurance either unavailable in active conflict zones or covering only limited scenarios, Ukrainian organizations have accessed alternative risk financing mechanisms. International donor-funded assistance programs cover post-incident recovery costs for critical infrastructure operators. EU solidarity funding and reconstruction programs provide financial resources for rebuilding IT systems destroyed by cyber or kinetic attacks. International financial institutions including the World Bank and EBRD have provided financing instruments accessible by Ukrainian organizations for cybersecurity investments that reduce the frequency and severity of incidents requiring post-incident financing.

FAQ

What is the difference between a war exclusion and a hostile nation-state exclusion?

War exclusions are standard insurance contract provisions that exclude physical war damage from coverage. When applied to cyber, they exclude losses from state-sponsored cyber attacks. Hostile nation-state exclusions are narrower, framing the exclusion around attribution to specific designated hostile states—a distinction that affects which attacks are excluded and creates challenges when attribution is contested or when attacks are conducted by proxies or criminal groups with state ties.

Did NotPetya actually test war exclusion clauses in court?

Yes. Multiple litigation cases arose from NotPetya, most notably Merck v. ACE Insurance ($1.4 billion claim) and Mondelez v. Zurich Insurance. In the Merck case, the New Jersey court ruled that because NotPetya did not take place in the context of "traditional warfare," the war exclusion did not apply—resulting in Zurich settling the case. These decisions drove the Lloyd's mandatory war exclusion reform to provide clearer contractual language for future cyber war events.

Can Ukrainian businesses get cyber insurance coverage during active conflict?

Most international cyber insurers have excluded or sharply limited coverage for businesses with primary operations in Ukraine during active conflict. Some limited coverage may be available through specialized war risk markets for specific scenarios. Ukrainian government entities typically access coverage through indemnification agreements with international partners rather than conventional insurance markets.

What is the current status of the US cyber insurance backstop proposal?

As of 2024, no US federal cyber insurance backstop legislation has been enacted. CISA and Treasury continue studying the mechanisms, and various Congressional proposals have been introduced for a TRIA-like cyber backstop. The challenge is that defining triggering events, attribution standards, and appropriate premium levels for nation-state cyber attacks is significantly more complex than for physical terrorism covered by TRIA.

How does the cyber insurance war exclusion affect companies outside Ukraine that face Russian cyber attacks?

Companies in NATO countries and globally face the same war exclusion question: if Russian state-sponsored cyber actors attack them (as occurred with NotPetya, SolarWinds, and ongoing campaigns), are their losses covered? The Lloyd's exclusion and similar policies from other insurers potentially exclude such losses. Companies need to review policy language carefully, understand attribution clauses, and consider whether their policies provide meaningful coverage for nation-state attack scenarios.

Sources

1. Lloyd's — "Market Bulletin: Cyber War Exclusion Requirements," lloyds.com August 2022
2. US Treasury / CISA — "President's Working Group on Cyber Insurance Backstop," 2022-2023
3. Merck v. ACE American Insurance — New Jersey Superior Court coverage decision, 2022
4. Munich Re — "Cyber Insurance Market Report," munichre.com 2023
5. RAND Corporation — "Cyber Insurance for Critical Infrastructure," rand.org 2023