Sep 19, 2019
War Exclusion: Misconceptions about Cyber Coverage
In 2017, the NotPetya malware infected computers and servers across the globe, shutting down businesses and causing billions of dollars in damage. In response, President Trump issued a statement assigning blame to Russia designating the malware as an Act of Cyber Warfare. As businesses worked to recover, claims for damages and lost income began flooding the insurance market. Mondelez, the manufacturer of Cadbury Eggs, recently made headlines after a claim filed under their property policy was denied due to the property policy’s war exclusion. The denial has resulted in the spread of misinformation through articles such as “Big Companies Thought Insurance Covered a Cyberattack. They May Be Wrong” by The New York Times that fail to attribute the denied claim to the property market rather than the cyber market. Articles such as the aforementioned have sent ripples across the insurance world for companies who believe their cyber policy would not respond. When a cyberattack is blamed on a foreign government, many factors can impact coverage, including how the US government designates such an attack. To quote William Wright, partner and joint-head of cyber at Paragon International Insurance Brokers, “whilst it has promoted lively debate and much need language reform in the insurance market, Mondelez vs Zurich is at its core a very good reason for insureds to purchase stand-alone cyber insurance, where the intent and expectation of coverage is to pay claims emanating from pandemic, untargeted malware like NotPetya and Wannacry.” Insurance largely revolves around the word “intent.” When property policies were first written, the intent was not to cover mass cyber events such as NotPetya; therefore, it is not surprising to see the property market utilizing the war exclusion. The war exclusion, which is found in almost all commercial insurance lines, is meant to protect insurers from paying claims related to damages caused from war or war-like actions. To narrow the war exclusion in cyber policies, carriers may provide, for example an affirmative coverage grant for “cyber terrorism” or a “cyber terrorism” carve back to the war exclusion with the expected intention to provide coverage for mass non-targeted cyberattacks.
read more
