Why it turns up at renewal
On 16 August 2022, Lloyd's Market Bulletin Y5381 required every standalone cyber policy in its market to exclude state backed cyber-attacks from 31 March 2023, at inception or renewal of each policy (Bulletin Y5381, DAC Beachcroft). A policy written before that date meets the new language when it comes up for renewal. Lloyd's does not mandate any particular wording, and the Lloyd's Market Association clauses are models that each market may amend (LMA). The legal background, NotPetya and the Merck case, is on our page "Does a war exclusion apply to a state-sponsored cyberattack?". This page reads the endorsement itself.
The last line: which clause, and what date
An LMA clause ends with its number and date, for instance "LMA5567A - 18 January 2023". On that day the LMA issued eight clauses, 5564A and B through 5567A and B, and withdrew the four from November 2021 (DAC Beachcroft). The letter A means an attribution clause is included; B means it is not.
The family runs from the tightest to the widest. 5564A takes out any loss arising from a state cyber operation, with no threshold. 5565A excludes war, cyber operations carried out as part of a war, and any cyber operation that makes a state an "impacted state", then confines all other cyber operations to two amounts to be filled in, one per operation and one for the period; left blank, the wording says there is no cover for any cyber operation. 5566A carries the same exclusions without those two amounts (Jenner & Block). 5567A adds the sentence on systems located outside the impacted state, and it is the one the market uses most (Carrier Management).
The date matters as much as the number. A correction issued shortly afterwards removed from 5565A and 5566A a write-back that belonged only in 5567A (LMA bulletin LMA23-003-PD). With no LMA reference at all, the clause is bespoke and nothing below can be assumed: every definition has to be read in the text.
The definition of cyber operation
In 5567A it is the use of a computer system by a state, at its direction or under its control, to disrupt, deny access to or degrade the functionality of a computer system, or to copy, remove, manipulate, deny access to or destroy information in one (LMA 5567A). Ransomware run by a criminal gang falls outside it until someone ties it to a state. The whole clause turns on that link.
Two phrases in the opening sentence weigh more than their length. "Notwithstanding any provision to the contrary" puts the exclusion above the rest of the policy. And the wording removes "that part of" any loss arising from these events, not the whole loss as a matter of course. One more detail: where the definition of computer system differs from the policy's own, the policy definition applies, so both have to be read.
The impacted state threshold
A state becomes impacted when a cyber operation has had a major detrimental impact on its functioning, through disruption to an essential service, or on its security or defence. Essential services are listed but not limited: financial institutions and market infrastructure, health services, utilities. Nothing puts a number on "major".
For a company at renewal the consequence is easy to state and hard to settle. A state operation aimed at a mid-sized business, with no effect on how a country runs, does not reach that threshold: under 5565A, 5566A and 5567A, paragraph 1.3 does not bite. Under 5564A it falls away regardless, because that clause has no threshold.
The sentence on systems outside the impacted state
5567A provides that paragraph 1.3 shall not apply to the effect of a cyber operation on a computer system used by the insured or its third party service providers that is not physically located in an impacted state. The 2021 versions used a defined term, "bystanding cyber asset", which the 2023 text no longer uses.
Three phrases deserve a close read. "Used by", not "owned by": a leased server counts. "Third party service providers": the hosting firm and the managed service provider are inside the sentence. "Physically located": for a cloud service the question becomes where the data centre sits, which the hosting contract sometimes states and sometimes does not. The sentence only switches off paragraph 1.3; war itself stays excluded everywhere.
Attribution: who proves it, and when
The 2021 clauses set out three steps. Attribution by the government of the state where the affected system sits was the primary factor; pending that, the insurer could rely on an "objectively reasonable" inference, and no loss was to be paid during that period; if that government took an unreasonable length of time, did not attribute, or declared it could not, the insurer had to prove attribution from other evidence (The Register). Official attribution of NotPetya took eight months.
The January 2023 version of 5567A says something else. The insurer's burden of proof "shall remain unchanged", and both parties consider the objectively reasonable evidence available to them, which may include formal attribution by the government of the state where the system is located (LMA 5567A). The sentence that held up payment is gone. A B version has no attribution clause at all, and the question falls back on the ordinary rules of proof under the policy. If your endorsement contains "pending attribution" or "no loss shall be paid", it carries the 2021 logic, whatever number it bears.
The expiring wording, side by side
An endorsement overrides the earlier terms for what it changes, and only for that. The useful reading is therefore a comparison, paragraph by paragraph. Did the old policy carry a traditional war exclusion, drafted around "hostile or warlike action", the kind the New Jersey court declined to stretch to NotPetya? Does the endorsement replace it, or sit on top of it? In the second case two texts apply and each is read on its own terms. A clause that was not there last year, or a definition of cyber operation that grows wider, moves the edge of your contract even if the rest of the policy has not changed by a comma.
What to take away
Read the endorsement from the bottom up: the reference and its date, then the definitions, then the impacted state threshold, the sentence on systems located elsewhere and the attribution clause. Then read it against the expiring text. AlgoPolis studies these clauses; this page says what each sentence changes, not what to sign.
Where we decided it
Our underwriting note no. 1, "The server is in Warsaw", published on September 27, 2026, puts these clauses to work on a file: a logistics company whose systems are in Poland. It decides yes, with conditions. The market context is in the article "Lloyd's Retreat from Hybrid War Risk".