Every aggregation model correlates losses. They look for the common provider, the common vulnerability, the shared dependency, and they answer the question of how many insureds will be hit at the same time. Yet there exists a correlation that touches no loss at all and strikes something else: the very ability to indemnify. On the day an attacking group is placed on a sanctions list, every ransom payment for its benefit becomes unlawful at the same instant, across every file in the portfolio that concerns it. Exposure has not moved by a single euro. What changed is the right to pay, and it changed for everyone at once.
It is worth measuring that this is not an exclusion. An exclusion is a stipulation of the contract, it is interpreted, it is argued, and the burden of proof lies with the party raising it. A sanctions impediment arises outside the contract: the cover still exists, it has simply become unlawful to perform. Most London policies restate it through a sanctions clause, LMA3100A, which relieves the insurer of paying where payment would expose it to a sanction of the United Nations, the European Union, the United Kingdom or the United States: the impediment then also becomes a stipulation, without becoming an exclusion to be proved. The Office of Foreign Assets Control advisory of September 21, 2021 explicitly extended the sanctions regime to the ransom payment facilitation chain, naming cyber insurance companies and incident response firms. The governing principle is strict liability, which means the absence of fraudulent intent protects no one. A good-faith insurer that facilitates a payment benefiting a listed entity incurs liability, and its good faith is not among the available defenses. That regime is American, and it reaches a French insurer only through a link with the United States, a payment in dollars, an American person or subsidiary. The law that binds it first is that of the European Union's sanctions regulations, including the regime specific to cyberattacks, Regulation 2019/796; a London underwriter adds the British OFSI, whose civil penalties have also rested on strict liability since June 2022.
A calendar difficulty compounds this and makes the rule very uncomfortable in practice. Attributing a ransomware to a group, then the group to listed persons, does not happen before the negotiation: it is built during it. Open-source intelligence sharpens as exchanges proceed, often after the insurer has authorized a negotiator and the attacker's countdown has started. The impediment can therefore appear mid-process, on a file already under way. And while the legal question is being examined, the business interruption clock keeps running: compliance review time is downtime, and it has a price.
Then comes the correlation proper, and it is what makes this a question of aggregation. A single listing simultaneously affects every insured then negotiating with the same group. A host outage correlates losses; a listing correlates impediments. No aggregation model catches it, because models are built on exposures and technical dependencies, never on legal permissions. The correlation is even harsher than an outage: a listing proceeds from an administrative decision, it arrives without notice, and it applies to a payment already being prepared.
The opposite effect exists and is just as correlated, which makes the full picture more interesting than a simple threat. A public action can also remove the need to pay. Operation Cronos, coordinated by the British National Crime Agency and Europol with ten countries and made public on February 20, 2024, seized thirty-four LockBit servers, identified one hundred and ninety-four affiliates and enabled the recovery of more than seven thousand decryption keys, made available to victims. Global ransom payments fell by thirty-five percent in 2024. The same category of event, an action by the authorities against a group, can therefore either bar a payment or make it unnecessary, and nothing in the nature of the risk says which of the two effects will reach a given file first.
One last fact deserves to be faced because it wrecks a widespread practice. After Cronos, LockBit attempted to recover and several of its affiliates migrated to competing groups, RansomHub and Akira. The disappearance of a brand therefore did not make the operators disappear: it renamed them. An aggregation model indexed on group names then measures a naming convention rather than a risk, and records a drop in exposure at the precise moment the same people resume the same activity under another banner. It is the kind of error that shows up very clearly afterwards and never during, because the data being tracked is clean, dated and wrong.
From this follows one simple operational consequence and one less simple coverage consequence. The first is that the sanctions question is the only variable the insurer genuinely controls, not through its answer but through the moment it is asked: asked on day one, it steers the whole file; asked as the funds are about to move, it arrives too late to change anything. The second concerns double extortion. Since exfiltration now precedes encryption, a lawful payment actually made does not extinguish the threat of publication, and therefore does not extinguish the data liability strand. The ransom cover and the liability cover meet on the same file, and paying now closes only half the loss.
A French logistics operator, insured by a cedant, is struck on February 4 by a double-extortion ransomware. The ransom demanded is 3.2 million euros. The insurer authorizes a negotiator on February 6 under the ransom cover. Negotiation brings the demand down to 1.9 million by February 18 and payment is prepared for the 21st. On February 20, the group's infrastructure is seized by an international operation and decryption keys are made available to victims. During the negotiation, open-source intelligence had suggested that some of the group's affiliates maintained links with listed entities, without the question ever being settled. Eleven other insureds in the same portfolio were negotiating with the same group at the same moment. The operator's business interruption is running at 180,000 euros per day.
This file reads like a lucky break, and that is the mistake: three distinct things happened at once and only one of them is good. The first is the release of the keys, which may make payment unnecessary and save 1.9 million. That still requires the keys to work on this variant and restoration to be faster than the negotiation would have been, and above all the saving falls on the smallest line in the file: sixteen days of shutdown at 180,000 euros already comes to 2.88 million, more than the ransom itself. The second is that the sanctions question was never settled, it was overtaken by events. Had the payment left on the 18th, it would have been lawful or not on facts nobody had established, and wherever a strict liability regime applies, such as the American or the British one, good faith does not defend the insurer. The file came within two days of a personal exposure for the insurer without the question so much as being logged. The third is the one the individual file does not show: eleven other insureds were in exactly the same position at the same instant, and any position taken here is taken on twelve files at once. A ransom decision stops being individual as soon as the group is common, which is an accumulation, but an accumulation of decisions rather than of losses. One question remains for the cedant to settle with its reinsurer, and it is far from obvious: do twelve ransomware files against one and the same group constitute a single event within the meaning of the aggregation clause?
- 01A sanctions listing does not correlate losses, it correlates impediments: exposure does not move, the right to pay disappears everywhere at once.
- 02A sanctions impediment is not an exclusion: the cover still exists, it has become unlawful to perform, and under a strict liability regime good faith does not protect.
- 03The only variable actually controlled is when the sanctions question is asked: on day one it steers the file, at the moment of transfer it changes nothing.
- 04An action by the authorities against a group can bar a payment or make it unnecessary, and nothing in the risk says which effect arrives first.
- 05An aggregation model indexed on group names measures a naming convention: affiliates migrate, frequency remains, the statistic falls.