In June 2017 a piece of malware called NotPetya spread from a Ukrainian accounting software update to networks in more than sixty countries. It encrypted files, but encryption was not its main purpose. It was designed to destroy, and it did. Merck lost manufacturing and research capacity for months. Maersk lost its container booking systems and reinstalled thousands of servers and tens of thousands of personal computers. FedEx's TNT division never fully recovered the European volumes it lost.

Merck had property insurance. It claimed about 1.4 billion dollars. Its insurers refused, and one of the reasons they gave was a clause that had been in property policies for most of a century: loss caused by "hostile or warlike action in time of peace or war" by "any government or sovereign power" or by "any authority maintaining or using military, naval or air forces" was excluded. NotPetya, the insurers argued, was an act of war. It had been attributed by Western governments to the Russian military intelligence service, and a state attack on a state's companies was hostilities by another name.

In January 2021 a New Jersey judge disagreed. The clause, the court held, required something that looked like war: armed conflict, military force, a sovereign acting as a sovereign. Malware that spread through commercial networks and damaged a pharmaceutical company did not meet that description, even if a state had built it. Merck recovered. The insurers appealed, and the case settled before the appeal was decided.

The rising cost of recovering from a ransomware attack

That judgment is the most cited moment in the argument about cyber insurance and war, and it is frequently described as the moment the industry learned that its war exclusion did not work. The description is half right. The judgment established that one particular wording, read by one court, did not cover one particular attack. It did not establish that cyber losses are covered, that state-backed attacks are insurable, or that the exclusion is dead. What it did establish is that a clause written for navies could not be applied to a network without someone deciding what a navy is.

The clause is older than the internet

War exclusions exist because insurance works by pooling independent risks. A war is not independent. It damages many policyholders at once, in the same place, for the same reason, and an insurer that has sold fire cover across a city cannot hold enough capital to pay every claim if the city burns. The exclusion is therefore not a moral judgment about violence. It is a limit on accumulation: the insurer agrees to cover accidents, and declines to cover the event that turns every accident into a catastrophe.

The wording reflects the risks of the nineteenth and twentieth centuries. Marine policies excluded "hostilities, warlike operations, acts of piracy" and the consequences of "war, civil war, revolution, rebellion, insurrection". Property policies used phrases such as "hostile or warlike action", "enemy attack", "invasion" and "act of foreign enemy". These were drafted by lawyers who had seen what a blockade, a bombardment and a requisition did to insured property, and they assumed that the actor would be a state with armed forces and a territory.

Cyber operations do not fit that grammar. There is no declaration of war, no uniformed force, no territory to invade and often no clear moment at which the operation begins. The actor may be a state intelligence agency using infrastructure in a third country, a criminal group paid by a state, a group that shares tools with a state but acts on its own, or a state-owned contractor. The effect may be confined to one company, or it may spread to thousands through a supply chain. The old words describe a world of clear sides. The new risk is a world of ambiguous ones.

Insurers did not ignore the gap. From the mid 2010s they began to write cyber-specific policies, and they began to add war and state-backed exclusions to those policies too. The problem was the policies that did not mention cyber at all. A commercial property policy written in 2010 covered "physical loss or damage", and a court could find that a corrupted database or a destroyed server was physical loss. That ambiguity became known as silent cyber, and it meant that losses the insurer had never priced could land on a property policy.

What the New Jersey court actually decided

The Merck judgment turned on a principle of contract interpretation rather than on the facts of the attack. The exclusion listed a series of actors: a government or sovereign power, an authority maintaining military, naval or air forces, and a military, naval or air force. The court read the general phrase "hostile or warlike action" as belonging to the same family as the specific actors listed, a reading known in law as ejusdem generis. Hostile action, on that reading, meant action of the kind a military force takes in a conflict, not any action that a state happens to sponsor.

The court also noted that the clause addressed action "in time of peace or war". That phrase was drafted to cover undeclared hostilities, not to convert every covert operation into a war. The insurers' reading would have made the exclusion apply to a state-sponsored intrusion in peacetime, which the court found inconsistent with the structure of the clause.

The reasoning is careful and it is narrow. It does not say that a state-backed cyber attack can never be a warlike act. It says that this wording, applied to this attack, did not meet the threshold without evidence of armed conflict or military force. A different policy with different language, a different court, or an attack that formed part of an armed conflict could produce a different answer. The settlement removed the chance for an appellate court to give the reasoning wider authority.

Mondelez, which had claimed about 100 million dollars for NotPetya damage under a property policy that contained a war exclusion, settled with its insurer in 2022 on terms that were not disclosed. Two cases, two settlements, no appellate precedent. The industry was left with a first-instance judgment that most lawyers expected to be distinguished rather than followed.

The rewrite depends on a government saying who did it

Insurers responded by drafting exclusions that do not need the old words. The approach that became standard in the London market from 2022 and 2023 has three parts. It defines a state-backed cyber attack, usually as an attack carried out by or on behalf of a state. It requires that the attack be attributed to a state by a government, an intelligence agency or another official body. And it limits the exclusion to attacks that have a material effect on the insured, or on the services the insured provides.

Each part solves a problem and creates another.

The attribution requirement solves the insurer's evidential problem. Rather than proving in court that a state was responsible, the insurer can point to a public finding by a government. That is much easier, and it is why the wording has spread. But it hands the trigger for a claim to an actor with no duty to the insured. A government may attribute an attack months or years after it happens, may decline to attribute for diplomatic reasons, may attribute informally, or may attribute to a state that the insured's own government does not want to name. The insured's cover then depends on a decision made by someone it cannot sue.

The materiality requirement solves a different problem. Without it, a state-backed intrusion that did nothing would technically trigger the exclusion, which is absurd. With it, the insurer and the insured have to agree on what material means: lost revenue, lost customers, regulatory action, a fixed number of days of disruption. Those are arguments that will be had after the event, when the insured has no leverage.

The definition of state-backed is the third problem. An attack by a criminal group that a state tolerates is not obviously state-backed. An attack by a group that a state uses but does not control is state-backed in one reading and criminal in another. The distinction matters most in the cases that are hardest to prove, which are the cases that reach litigation.

Attribution is a political judgment, and courts know it

The deeper difficulty is that attribution is not a neutral technical process. Governments attribute cyber operations for reasons of deterrence, alliance management and domestic politics. The United States indicted officers of Russia's military intelligence service for NotPetya and other operations in 2020, three years after the attack. The United Kingdom attributed NotPetya to the Russian military in 2018. Those statements are authoritative in a political sense and evidentiary in a limited sense: they rest on intelligence that is not disclosed and cannot be cross-examined.

Insurance law is built on facts that a court can test. A fire has a cause that an investigator can establish. A ship has a position and a log. A cyber attack has an actor whose identity is inferred from infrastructure, code, tradecraft and signals, and the inference is often probabilistic. When an insurer denies a claim on the ground that a government has attributed an attack to a state, the insured's remedy is to dispute the attribution in court, which means asking a judge to review a conclusion reached by an intelligence service on evidence the judge cannot see.

Some policies try to avoid that by defining attribution formally: a written statement by a named agency, published in a specified form. That makes the trigger administrable, at the cost of tying cover to a publication decision. Others allow the insurer and insured to appoint an expert. Very few give the insured a right to challenge the attribution without losing the claim.

The market repriced everything else instead

While the legal argument continued, the market did something simpler. It raised prices, cut limits and rewrote conditions. Cyber cover that had been cheap and broad in 2018 became expensive and narrow by 2022, as ransomware claims rose and insurers discovered that their accumulated exposure to a single piece of software, a single cloud provider or a single managed service provider was larger than they had thought.

The repricing was brutal for a period. Rates rose by double digit percentages quarter after quarter through 2021 and 2022, retentions rose, sublimits for ransomware and for system failure appeared, and insurers began to require evidence of basic controls before they would quote. Multi-factor authentication, offline backups, network segmentation and incident response plans became conditions of cover rather than good practice. Insurers also began to limit cover for attacks that spread from a third party's systems, which is precisely how NotPetya spread.

Then the cycle turned. Rates fell through 2024 and 2025 as new capital entered, claims frequency stabilised and insurers competed for the business they had just repriced. A softer market creates its own risk: the conditions that made the cover profitable in 2023 are the conditions most likely to be relaxed when competition returns. That pattern has been seen in every specialty line, and there is no reason to think cyber is exempt.

The result is a market that is larger, more technical and more fragmented than it was. A large company may buy a primary policy, several excess layers, a captive and a parametric product, each with a different war exclusion and a different attribution clause. A small company may buy a packaged policy in which cyber cover is a sublimit, and may not know whether the war exclusion applies to it until it claims.

What a cyber policy pays for, before any exclusion is reached

A cyber policy is not one cover. It is a bundle, and the bundle explains why disputes so often turn on detail rather than on principle.

The first component is incident response. The insurer pays for forensic investigation, legal advice, notification to regulators and affected individuals, credit monitoring and public relations. This is the part insurers most want to control, because the decisions taken in the first seventy two hours determine the size of everything that follows, so most policies name a panel of forensic and legal firms and require the insured to use them. A company that calls its own adviser may find the cost is not covered, which is a surprising discovery at the worst possible moment.

The second component is business interruption. The policy pays for lost gross profit during the outage, usually after a waiting period of eight to twelve hours, and it usually requires the loss to result from an interruption to the insured's own systems. Contingent business interruption extends that to a failure at a supplier or a customer, and it is much harder to claim because the insured has to prove a direct dependency, a loss and a causal chain. The cloud outage that stops a company trading is exactly the event that tests whether the wording describes the dependency accurately.

The third component is data restoration and system rebuild. The insurer pays to restore data from backups and to rebuild systems to the condition they were in before the attack, which sounds straightforward and rarely is, because the baseline condition is disputed and because rebuilding often means buying new hardware that is better than the old hardware.

The fourth is third party liability. A breach that exposes customer data invites claims from customers, from business partners and from regulators, and the policy responds to those claims within its limit. The fifth is ransom reimbursement, where it is legal to pay, and the sixth is the cost of dealing with an extortion demand that is not met.

The structure matters because the war exclusion sits on top of all of it. An exclusion that removes cover for a state-backed attack does not just remove the business interruption payment. It removes the forensic investigation, the notification, the legal defence and the restoration, at the moment when the insured most needs someone else to pay. That is why the wording of a clause that appears in a definitions schedule is worth litigating for years.

The sanctions interface makes the ransom decision harder

The other clause that decides claims is not about war at all. It is about sanctions. Paying a ransom to a group that is designated under a sanctions regime can be a criminal offence, and insurers that reimburse such a payment can be exposed as facilitators. The United States Treasury's Office of Foreign Assets Control warned in an advisory updated in September 2021 that facilitating a ransomware payment to a sanctioned actor carries enforcement risk, and that companies should have sanctions screening and legal review in place before they pay.

That advisory changed the practical handling of ransomware claims. Insurers now require the insured to obtain a sanctions assessment, to check the wallet address or the group against designated lists, and to document the decision. Some policies exclude ransom payments altogether. Others cover them only where the payment is lawful and only after the insurer's approval. The result is that a company facing an extortion demand has to make a legal judgment under time pressure, with a insurer looking over its shoulder and a regulator potentially watching.

The sanctions question and the war exclusion interact. A ransomware group that operates with the tolerance of a state may be designated, which makes the payment unlawful, which makes the insurance irrelevant. A group that is not designated may still be state-backed in the sense the war exclusion uses, which makes the cover disputed. The insured is caught between two clauses that were written by different people for different purposes, and neither was written with the other in mind.

Where the loss actually lands

The practical effect of the exclusion is to move a category of loss off insurance and onto the balance sheet. A company that suffers a state-backed attack and finds its cover excluded has three options: absorb the loss, sue its insurer and argue about attribution, or rely on a government scheme if one exists. For critical infrastructure, the third option is the interesting one.

Several countries have schemes for risks that private markets cannot carry. Terrorism pools exist in the United Kingdom, the United States and elsewhere because insurers could not price the accumulation of a coordinated attack. Flood schemes exist because the risk is correlated and politically unacceptable to leave uninsured. Cyber has no equivalent in the major markets, despite repeated proposals. The reason is partly that cyber losses have been smaller than the scenarios predicted, partly that governments do not want to underwrite corporate security, and partly that the private market has been willing to write the risk at a price.

That willingness is itself a bet. A systemic cyber event, whether a state attack on payment infrastructure or a vulnerability in a widely used cloud service, would produce losses across many policies at once, and the war exclusion would be the clause insurers reached for. If the exclusion holds, the loss lands on companies and their customers. If it does not, it lands on insurers and reinsurers. The Merck case showed that the answer depends on wording that was never designed for the question.

How long the war exclusion took to resolve

The regulatory layer changed the question

Two European rules have made the coverage question less important for some companies and more important for others. The second Network and Information Security Directive, known as NIS2, requires essential and important entities to manage cyber risk and to report incidents, with supervisory penalties for failure. The Digital Operational Resilience Act, which applies to financial entities, goes further: it requires contractual protections with technology providers, incident reporting, resilience testing and a register of arrangements.

Neither rule requires insurance. Both require evidence of resilience, and that evidence is what insurers now ask for. A company that can show tested backups, segmented networks, a rehearsed response plan and board level accountability is a better risk, and it will get better terms. The regulatory requirement and the insurance requirement have converged on the same checklist, which is convenient for the company that has to satisfy both and awkward for the company that was buying insurance as a substitute for controls.

The convergence also changes the argument about the war exclusion. If resilience is the primary defence, then the exclusion matters less for companies that have invested and more for those that have not. The companies most exposed to a state-backed attack are often the ones whose systems are oldest and whose security budgets are thinnest, which is exactly the population least able to absorb an uninsured loss. Insurance was supposed to transfer that risk. A war exclusion that triggers on attribution transfers it back.

Captives, parametric cover and the search for a cleaner trigger

Companies large enough to have a view on this have stopped relying on a single policy. The first alternative is a captive insurer, a subsidiary that insures the parent and reinsures part of the risk in the commercial market. A captive does not remove the war exclusion, because the reinsurance contract behind it will contain one, but it gives the parent control over claims handling and over the definition of the event. It also gives the parent a vehicle for the risk it decides to retain, which is often the whole point.

The second alternative is parametric cover. Instead of indemnifying a proven loss, the policy pays a fixed amount when a defined trigger occurs: a specified outage duration, a threshold of affected users, a revenue drop measured by an independent index. Parametric contracts are faster and cheaper to administer, and they avoid the argument about causation that makes cyber claims so slow. Their weakness is basis risk: the trigger may not match the loss, so a company can suffer a severe event and receive nothing, or receive a payment for an event that cost it little.

The third alternative is the capital market. Cyber catastrophe bonds have been issued by reinsurers and specialty insurers since 2023, transferring a defined layer of aggregate cyber loss to investors. The bonds are small relative to the property catastrophe market, and their triggers are carefully defined to exclude the ambiguity that makes the war exclusion litigable. If the market grows, it will create a second source of capacity that does not depend on a single insurer's appetite, and it will also create a second set of definitions for what counts as a covered cyber event.

None of these solves the underlying problem, which is that the risk is correlated, the cause is hard to establish and the actor may be a state. They distribute it differently. A captive keeps it inside the group, a parametric contract converts it into a payout rule, and a bond sells it to an investor who is willing to take the tail. The war exclusion remains the line between the risk the market will carry and the risk it will not.

What the courts might do next

The Merck reasoning is not the only possible reading, and it would be a mistake to assume that later courts will follow it. Three factors push in the other direction.

The first is that a court in a different jurisdiction may read "hostile or warlike action" more broadly, particularly if the attack occurred during an armed conflict or formed part of a campaign against a state's infrastructure. The second is that the new exclusions are drafted specifically for cyber, which removes the ejusdem generis argument: a clause that expressly addresses state-backed cyber attacks does not need to be stretched to cover them. The third is that courts are generally reluctant to impose uninsurable catastrophic risk on insurers when the policy clearly intended to exclude it.

Against that, insureds have a strong argument that an exclusion should be read narrowly, that ambiguity is construed against the party that drafted it, and that a clause requiring attribution by a government the insured cannot control is close to unworkable. The Lloyd's wording tries to meet that by specifying the attribution mechanism, but specifying a mechanism does not answer the question of what happens when the mechanism produces no answer.

What the numbers do not establish

The Sophos recovery cost figures are survey responses from organisations that experienced an attack. They measure the cost of recovery as reported by the victim, not the insured loss, and they exclude the losses that make a catastrophe: lost customers, litigation, regulatory penalties and the value of destroyed intellectual property. They are useful for showing direction and useless for pricing a systemic event.

The Merck claim figure is a claim, not a loss. The company reported charges in the hundreds of millions of dollars, and the difference between what it claimed and what it recorded is the difference between an allegation and an accounting entry. The settlement figure was reported, not confirmed by the parties.

The rate movements in the insurance market are averages across a book of business that changes composition every year. A falling average rate can coexist with rising rates for the riskiest buyers, because the mix of what is insured changes. The direction is informative; the magnitude is not a price for any particular company.

And the claim that the war exclusion will decide the next systemic cyber loss is a prediction, not an observation. What the record establishes is narrower: the clause was written for a world of states and fleets, it did not fit the first great cyber catastrophe, the industry rewrote it around attribution, and attribution is the one input in the chain that no court can independently verify.

Sources