Lloyd’s new cyberattack insurance policies mandate exclusions for state-backed cyberattacks starting from March 2023.
These exclusions applied to cyberattacks that disrupted essential state functions or security and insurers had to attribute these attacks to specific states.
Despite some infrastructure operators ignoring government warnings, insurers were acutely aware of the risks with billions of dollars at stake.
The main issue likely to cause disputes between insurers and policyholders is the attribution of cyberattacks, as the covert nature of cyberattacks makes it difficult to determine state responsibility.
Additionally, the definition of “major detrimental impact” remains vague, which could lead to disagreements over what qualifies as significant disruption.
As insurers step away from covering cyber warfare-related risks, the question of responsibility looms.
Businesses must now contend with a new reality where neither governments nor insurers can fully shield or cover them from nation-state attacks.
The recent MOVEit, Change Healthcare, and NHS incidents showed how attacks on a single critical software and government service can cascade across the economy, creating systemic aggregate losses.
A recent report by a cyber insurer noted that the risk of and uncertainty around aggregation continues to hang over the market by impeding capital inflows and tempering risk appetite.
Careful review of cyber policy wordings is crucial to reduce the risk of disputes over cyberattack claims.