A claim worked step by step, from notice to the excluded part

This lesson follows a single claim, from the day it is notified to the day the excluded part is quantified. The case is fabricated for the lesson, and it says so: the states are designated by letters, the insured and the amounts are invented. The facts are chosen so that each provision seen in the first three lessons has to operate at least once. The policy is a 15 million euro standalone cyber policy, written in 2025, carrying LMA 5567A. The order of the investigation counts as much as the answer: a file worked out of order often reaches the right conclusion for the wrong reasons, and it is the reasons that will be reread, by the insured, by an expert, then perhaps by a judge.

The facts. A maritime logistics company based in France runs its own servers in a data center in Lyon and entrusts its enterprise software to a provider located in state A, which hosts it there. On a Monday in March, a destructive malware spreads in state A through the update of an industrial monitoring tool; it shuts down the operator of state A's power grid for four days, along with the systems of two of its ports. Through the private network linking the provider to its clients, it also reaches the insured's servers in Lyon, and wipes them. The insured notifies two heads of loss: 2.4 million euros for restoring its servers and the resulting business interruption, and 1.8 million for business interruption caused by the outage of the software at the provider. Three weeks later, the government of state A publicly attributes the operation to state B. No armed conflict sets the two states against each other, and the French government has not spoken.

Step one: fix the facts before classifying them. The claims handler draws up a dated chronology, the list of affected systems with their physical location, and apportions the loss by system, before even opening the clause. Step two: paragraph 1.1. War is defined as armed conflict involving physical force; there is none between state A and state B. Paragraph 1.1 does not apply, and it would not apply either if relations between the two states were tense: tension is not armed conflict. Step three: paragraph 1.2, the cyber operation carried out as part of a war or its immediate preparation. With no war, and no movement of forces that would announce one, nothing points to immediate preparation; 1.2 does not apply either. The file is therefore not a war claim, and everything that follows falls under 1.3.

Step four: the impacted state. Paragraph 1.3 excludes the cyber operation that causes a state to become an impacted state. A four day shutdown of state A's power grid is a disruption of an essential service of the kind the definition cites, utility services, and the shutdown of two ports adds to it; the effect on the functioning of the state will likely be held major. State A is an impacted state. France is not: wiping one company's servers, however costly for that company, has no major effect on the functioning of the French state. Note that this step is worked without knowing anything yet about the perpetrator, since it concerns effects. It is not enough to exclude, however, because 1.3 only targets a cyber operation, meaning an operation carried out by, at the direction of, or under the control of a state.

Step five: attribution, and only where it changes the outcome. For the Lyon servers, it changes nothing. If the operation is state backed, 1.3 would apply, but the 5567 write-back sets it aside for a system not physically located in an impacted state; if it is not, it is not a cyber operation within the clause, and none of the exclusions applies. Either way, the first head of loss is not excluded by the war clause. For the software hosted in state A, attribution decides everything: if state backed, the operation falls under 1.3 with no write-back available; if not established, it stays covered. That head of loss, and that one alone, is therefore where the insurer must gather proof. It has the official attribution by the government of state A, precisely the state where the affected system sits, and its own technical evidence. The clause makes these things to consider, not a conclusion, and the burden of proof stays with the insurer.

Step six: the part. The clauses exclude "that part of" the loss arising from the excluded event. The claim is therefore not settled wholesale: if the insurer establishes state origin, it excludes the second head of loss, 1.8 million euros, and pays the first under the policy terms. Joint costs, for example the forensic investigation that served both heads of loss, are apportioned by a key written into the file, and that key is itself a document the insured may challenge. Step seven: write the position. The letter to the insured cites the paragraph applied, the dated facts on which it rests and the evidence relied on, and it states what remains open. If the proof has not been gathered by the date of settlement, the head of loss is paid: the A versions no longer carry a waiting rule, and an attribution that comes later is only one more piece of evidence.

What the case teaches lies in the order more than in the answers. Effects before the perpetrator, because the impacted state is established without attribution; the geography of systems before the proof, because it shows which head of loss the proof serves; the proof last, limited to the head of loss where it changes the outcome, because it is costly and the insurer bears it. A handler who started with attribution would spend months seeking a certainty that half the file does not need. Sources: the text of clause LMA 5567A of January 18, 2023, the definitions of war, cyber operation, impacted state and essential service, the attribution clause and the bystanding write-back, published by the Lloyd's Market Association and reproduced in the observatory's comparator. The facts, states and amounts of the case are invented.