Monday morning, encrypted servers
A forty-person distributor comes in on a Monday to find its servers encrypted. Invoicing is down, the warehouse is working blind, and getting back to normal takes a week. The managing director pulls out the company's multirisque professionnelle, the French business package: fire, escape of water, theft, machinery breakdown, business interruption. Everything is there except what has just happened.
Business interruption in a package policy normally hangs off covered physical damage. An encrypted file has not burned or flooded, and most wordings do not treat it as physical damage. So the section that was meant to pay for the lost week does not respond, unless the policy has provided for the case.
Where the question comes from: silent cyber
For two decades, property policies were drafted for fire and flood and said nothing about computer risk. Neither included nor excluded: the UK regulator called this non-affirmative cyber risk in its Supervisory Statement SS4/17 of 5 July 2017, and expected insurers to measure it across all their property and casualty lines (PRA, SS4/17).
NotPetya put a price on that silence. In June 2017 Merck lost about USD 1.4 billion and claimed under its all-risks property programme, not under a cyber policy. Its insurers relied on the war exclusion, the New Jersey courts held it did not apply, and the case settled in January 2024, days before argument in the state Supreme Court (Cybersecurity Dive, The Record). A policy written for fire came close to paying for a computer attack across a global group.
What London wrote in 2019
In July 2019, Lloyd's Market Bulletin Y5258 banned silence: every policy has to say whether it covers cyber losses or excludes them. Property damage went first, for new and renewal business incepting on or after 1 January 2020, including where property is combined with other lines in a blended product; the remaining classes followed in phases (Bulletin Y5258, Insurance Business).
On 13 November 2019 the Lloyd's Market Association issued the model wordings that answer the bulletin for property: LMA 5400 and LMA 5401, alongside their marine counterparts (Bulletin LMA19-031-PD). LMA 5401 is the absolute exclusion. It removes malicious attacks and accidental incidents alike, data included, and gives nothing back. LMA 5400 also excludes, but writes back physical damage from a fire or explosion that follows a non-malicious cyber incident (Hinshaw, BMS). They replaced the 2001 endorsements NMA 2914 and 2915. The LMA describes them as illustrative only, so any contract may amend them, and what counts is the wording actually signed.
And in a French package policy
The French small business market went the same way, on its own terms. Recent general conditions usually carry an exclusion of attacks on computer systems and data, drafted by the insurer rather than lifted from a London form. Some soften it by giving back the ensuing fire or explosion. Others bolt on an optional cyber section, with its own limit, its own sub-limits and often a waiting period before business interruption starts to count.
Those exclusions are not always well drafted. In September 2022, the French Treasury's report on cyber insurance called for better drafting practice on exclusion clauses, so that they stay clear and limited and remove ambiguity (Actu-Juridique). Under French law a vague exclusion simply fails: Article L. 113-1 of the Insurance Code requires it to be "formal and limited".
The complaint rule applies to every policy
The interior ministry programming law of 24 January 2023, known as LOPMI, created Article L. 12-10-1 of the French Insurance Code, in force since 24 April 2023. Any insurance payment for an attack on an automated data processing system is conditional on a criminal complaint filed no later than 72 hours after the victim becomes aware of the attack. It applies to legal entities and to individuals acting in a professional capacity, for the offences in Articles 323-1 to 323-3-1 of the Criminal Code; an accidental outage falls outside it (DAC Beachcroft, Squire Patton Boggs, French Treasury FAQ).
The rule makes no distinction between policy types. A package policy that gives back fire following an attack pays nothing for that fire if the complaint is missing. The full timetable is on the page after a cyberattack in France, who do you notify in the first 72 hours?
What to take away
Read the wording, not the brochure. Start with the date of the general conditions: a text from before 2020 may still be silent. Then the exclusion itself, with its definitions of "data" and "computer system", and the line it draws between a malicious attack and an accidental incident. Then whatever it gives back, if anything: fire, explosion, breakdown of the hardware. Then the trigger for business interruption, which is almost always physical damage. Last, if there is a cyber section, its own limit, its sub-limits, its waiting period and its security conditions. AlgoPolis studies these texts; this page does not say which cover to choose. The history of silent cyber is in the article "Silent Cyber: from Gray Zone to Explicit Clause".