Does it matter whether President Trump calls the situation with Iran a “war” or an “excursion” or something else if your company is hit by a cyberattack that may be in retaliation? The Wall Street Journal reports:
From Europe to the Middle East, geopolitical conflicts have companies rereading the fine print on insurance policies that deny coverage for wartime cyberattacks.
Act-of-war exclusions—a common provision in homeowners, life and travel insurance—are largely untested in the cyber market, where the line between cybercrime and nation-state warfare is unclear. That can leave coverage terms ill-defined, ambiguous and open to interpretation, insurance industry lawyers and brokers say.
“Cyberwarfare is outpacing policy language,” said Emily Selck, senior director and national practice leader for cyber at the Baldwin Group, a risk management advisory and insurance brokerage firm. “Most companies don’t realize how their coverage responds until it’s tested in real time,” Selck said.
Adding to the uncertainty, many insurers in recent years have adopted more expansive language in wartime-exclusion clauses, said Chip Merlin, founder of Merlin Law Group, an insurance-recovery firm.
Beyond overt warfare, many policies today allow insurers to use any evidence that a data breach was done on behalf of a nation-state adversary “to deny, and win those coverage battles,” Merlin said. “The newer language does not require that it be a war,” he said.
Many older policies included coverage against “loss or damage caused by hostile or warlike action in time of peace or war,” citing attacks by military, naval, air forces or an agent of government, Merlin said. By contrast, policies now often exclude “any loss arising from a cyber operation carried out by or on behalf of a state,” he said.
What policies may have covered years ago may be quite different now. Read more at WSJ, and if you haven’t reviewed your cyber insurance policy recently to read the section on exclusions, you might want to do so.
