Insurers face claims for claims for war-related digital attacks

Insurers face potentially billions of dollars in claims from digital attacks linked to Russia’s invasion of Ukraine, although the contracts are designed so that coverage doesn’t extend to wars, industry sources say.

European and North American insurers, which took hefty losses last year, raised premiums due to rising cost of coverage and the prevalence of ransomware attacks.

If Russia launches a digital attack that spreads across multiple countries, it could lead to total damage claims of $20 billion or more, similar to the amount involved after a major hurricane in the United States, industry sources said on condition that anonymity.

Lloyd’s of London, one of the world’s largest digital insurance and other commercial policies, said last week that it had received many claims stemming from the Russian invasion.

The cyber insurance – whose rating agency Fitch says was worth more than $2.7 billion in 2020 in the US alone – covers a business to repair hacked networks, losses from business interruption and also ransom payments in the event of a breach. digital attacks.

Such policies do not cover wars or attacks by so-called “state-sponsored actors”. But it is often difficult to identify the perpetrator of a digital attack.

“Defining what is state-sponsored is quite challenging,” Lloyd’s of London president Bruce Carnegie-Brown said last week. “These policies are tested by new events and we need to work in the newsroom and make sure our customers understand where they are covered and where they are not.”

Even if an insurance company proves that an attack was a result of the conflict in Ukraine, the emphasis in contract wording for non-coverage in the event of war may be insufficient.

Policy terms vary from insurer to insurer and are open to interpretation, said Marcos Alvarez, head of insurance at credit rating agency DBRS Morningstar.

A specific gray area is about digital terrorist attacks, which are usually covered by insurance.

Terror is typically defined more narrowly than war, but Thomson Reuters’ Westlaw said last week that cyber terrorism is sometimes defined “very broadly to include any attack against a computer system with the intent to cause damages for the sake of social, ideological, religious, economic or political objectives”.

“Whenever there is an ambiguous wording in a policy, it is to the customer’s advantage, not the insurer’s.”

There are also cases where companies have other policies that do not specifically exclude digital attacks, with customers being able to claim based on them.