Why the question arises
A traditional war exclusion takes out losses arising from war, declared or not, and from "hostile or warlike action" by a government or sovereign power. It was drafted with tanks and bombing in mind. A cyberattack run by a state agency looks like none of that: no declaration, no front line, and a perpetrator often identified only months later.
The case that set the terms: NotPetya
In June 2017 NotPetya, pushed out through the update channel of a Ukrainian accounting package, wiped tens of thousands of machines worldwide. On 15 February 2018 the United Kingdom, then the White House, attributed it to the Russian military (The Register, Axios).
Merck was claiming more than USD 1.4 billion under its all-risks property programme. Its insurers relied on the hostile or warlike action exclusion. On 1 May 2023 the Appellate Division of the New Jersey Superior Court upheld the finding that the exclusion did not apply: "hostile or warlike action" requires, at a minimum, action of a military nature, not merely a government's intent to cause harm (opinion, njcourts.gov, Justia). The parties settled on 3 January 2024, just before argument in the state Supreme Court, on undisclosed terms (Cybersecurity Dive, Claims Journal).
The other NotPetya test case, Mondelez against its property insurer, settled in November 2022, again on undisclosed terms (Insurance Journal, Infosecurity Magazine). No court has therefore held that a state cyberattack is war within the meaning of these exclusions.
What the market has written since
On 25 November 2021 the Lloyd's Market Association issued four model clauses for standalone cyber policies, LMA 5564 to 5567, ranging from a blanket exclusion to variants that keep limited cover (DAC Beachcroft, LMA). Their key move is a definition of cyber operation: the use of a computer system by or on behalf of a state to disrupt, deny, degrade, manipulate or destroy information in a computer system of or in another state.
On 16 August 2022 Lloyd's Market Bulletin Y5381 required that from 31 March 2023 every standalone cyber policy written in its market exclude state backed cyber-attacks, unless otherwise agreed, and that the clause set out a robust basis for attribution (Bulletin Y5381, Kennedys).
Where the answer is decided: attribution
These clauses move the question. It is no longer whether a cyberattack is war, but who carried it out, and who has to prove it. The LMA wordings look first to attribution by the government of the state where the affected system sits; pending that, to a reasonable inference drawn by the insurer, which bears the burden of proving the exclusion (LMA 5567A, DAC Beachcroft). Public attribution comes late, sometimes never: NotPetya took eight months. False flags and proxies muddy it further.
The second lever is the impacted state: several variants only remove losses from an operation with a major detrimental impact on the functioning or security of a state, and keep cover for systems located outside it (Bulletin Y5381 requires the clause to say so clearly). The same event can be excluded for one subsidiary and covered for another.
What to take away
Read the clause, not its heading: whether it predates 2021, which LMA variant it follows, how it attributes the attack, and what it does with systems outside the impacted state. AlgoPolis studies these texts; this page does not say which cover to buy.
Where we decided it
Our underwriting note no. 1, "The server is in Warsaw", published on September 27, 2026, takes this question on a file: a logistics company whose systems are in Poland. It concludes that an underwriter who relies on the war exclusion is making a legal bet, not an underwriting decision, and decides yes, with conditions. The market context is in the article "Lloyd's Retreat from Hybrid War Risk".