Skip to content
 
Our latest places light up by day
The maps

The insurance world

The countries our articles cite, the latest eight highlighted and updated with each new publication, then the major cyber crises that changed how the market underwrites, each with what it changed for insurance and the public documents that establish it: each layer switches on or off. The major earthquakes the USGS publishes in the public domain replay from 1990 onward; other natural catastrophes under open licenses will follow. The basemap is Natural Earth, a compromise projection opening on the whole inhabited world; Jacques Bertin's projection (1953) and the classic map remain available.

Cyber and political crises, from 2015 to today

Cyber crises as diamonds, political risk crises as triangles, each at its date. A dot inside the triangle marks where the two meet: a state act that causes or characterizes a cyber loss. Hover or tap a mark to read what it changed and its sources; click to light it up on the map.

  1. December 23, 2015 · State-attributed operation · Ukrainian power grid outage : The first known grid outage caused by a cyber attack: physical damage and utility-supplier failure stop being theoretical scenarios for property underwriters.
  2. May 12, 2017 · State-attributed operation · WannaCry : A global worm: one vulnerability hits thousands of insureds over a weekend, and attribution to a state comes seven months after the loss. Accumulation and the state-act question arrive in the same year.
  3. June 27, 2017 · State-attributed operation · NotPetya : The war exclusion goes to court: on 1 May 2023, the New Jersey Appellate Division holds that a property policy's hostile/warlike action exclusion does not apply, on about USD 1.4 billion. Hence clauses LMA 5564 to 5567 and Lloyd's requirement (bulletin Y5381) to exclude state-backed attacks.
  4. March 19, 2019 · Ransomware or extortion · Norsk Hydro (LockerGoga) : The textbook case of a paid and public claim: business interruption dominates, recoveries arrive in instalments and cover only part of the impact. Underwriters read in it the gap between economic and insured loss.
  5. November 16, 2019 · State-ordered internet shutdown · Iran internet shutdown : A week without a network across a whole country, by state decision: telecoms-supplier failure becomes an act of authority, which government-action exclusions in business interruption policies can capture.
  6. July 30, 2020 · Sanctions or asset freeze · First EU cyber sanctions : The junction in EU law: a cyber attack becomes grounds for sanctions, and a payment to a listed person becomes unlawful. Cyber underwriters now have to read a sanctions list before reading a claim.
  7. October 1, 2020 · Sanctions or asset freeze · OFAC ransomware advisory : A ransom stops being a plain claims expense: it can be prohibited by a state act. An insured's ability to recover has to rest on restoration, not on a payment.
  8. December 2020 · State-attributed operation · SolarWinds (Orion) : State espionage through the software supply chain: few direct insured losses, but a vendor-accumulation pattern portfolios had not mapped, and an official attribution followed by sanctions, that is, political risk.
  9. February 1, 2021 · State-ordered internet shutdown · Myanmar coup and internet shutdowns : Shutdowns become a lasting tool of government rather than a one-week incident: for underwriters, a site's dependence on a national network is read in the country's political risk, not in the carrier's contract.
  10. May 2021 · Ransomware or extortion · Colonial Pipeline : Ransom becomes a public policy question, paid by the insured then partly seized by the state, and critical infrastructure a risk underwriters no longer read like the others: one insured's shutdown hits a whole region.
  11. July 2, 2021 · Single provider compromised · Kaseya VSA (REvil) : Accumulation through managed service providers: one tool, hundreds of unrelated insureds. The question "which providers do you share?" enters underwriting.
  12. December 9, 2021 · Systemic vulnerability · Log4Shell : The market's catastrophe scenario, a flaw present almost everywhere, actually happened. It was a reminder that accumulation is measured by shared exposure, before any claim is reported.
  13. February 24, 2022 · State-attributed operation · Viasat KA-SAT : Collateral damage from a wartime operation to third parties outside the conflict: precisely the "bystander" systems that clause LMA 5567 writes back and that Lloyd's requirement forces wordings to address.
  14. March 10, 2022 · Expropriation or nationalization · Leased aircraft held in Russia : The largest insurance dispute tried in London turns on a state act, not physical damage: the line between war risks and all risks in a policy decides billions, and the cause of loss, the Russian law, draws it.
  15. April 2022 · Seizure or restitution of artworks · Morozov collection held in Paris : An undamaged work may not come back: sanctions override immunity from seizure and the loan agreement. For fine art underwriters, the question is no longer just the hanging and the transit, but the owner's name.
  16. May 8, 2022 · Ransomware or extortion · Costa Rica (Conti) : A criminal group paralyses a state: the line between cyber and political risk blurs, because the shutdown of public services hits everyone in the country who depends on them, insured or not.
  17. April 25, 2023 · Expropriation or nationalization · Russia's "temporary management" decree : Creeping expropriation by another name: nothing is confiscated, management is "temporary", and that is exactly what makes the date of loss and the loss of control disputable under an expropriation policy.
  18. May 31, 2023 · Single provider compromised · MOVEit Transfer (Cl0p) : A data theft campaign without encryption: the loss sits in liability and notification, spread over hundreds of organisations. Accumulation through file-transfer software joins accumulation through managed service providers.
  19. June 9, 2023 · Seizure or restitution of artworks · Scythian gold returned to Ukraine : A change of sovereignty during a loan: the objects are intact, but the lender is no longer the one receiving them. Title can change during an exhibition, and nine years of litigation are the price.
  20. January 9, 2024 · Seizure or restitution of artworks · Cassirer: the Pissarro stays in Madrid : Title to a work is decided by the choice of law, decades after the looting: title risk is a legal and political risk that does not show on the work.
  21. February 21, 2024 · Single provider compromised · Change Healthcare : Dependence on a single point in a sector: thousands of practitioners cut off from cash flow without being attacked. Dependent business interruption, often sub-limited, becomes the cover that matters.
  22. May 7, 2024 · Sanctions or asset freeze · LockBit leader designated by three states : The most active criminal group now has a named, sanctioned leader: paying a LockBit ransom becomes an identified sanctions risk, and a loss the policy can no longer reduce by paying.
  23. June 3, 2024 · Single provider compromised · Synnovis (Qilin) : The single provider of a vital service: the outage at the customer is not the victim's own loss, and bodily injury enters the scope of a cyber event.
  24. June 18, 2024 · Single provider compromised · CDK Global (BlackSuit) : Accumulation through vertical software: an entire trade stopped by one vendor, one more dependent business interruption case, and the same pattern as Change Healthcare in another sector.
  25. June 20, 2024 · State act and cyber loss · US ban on an antivirus vendor : A state act removes the main security control of thousands of insureds, with no attack at all: a cyber policy's risk declaration can become inaccurate mid-term by government decision.
  26. July 19, 2024 · Non-malicious failure · CrowdStrike outage : A systemic event with no attacker: system failure cover, with no war exclusion or attribution to argue, becomes the line underwriters reread first.
  27. January 2025 · Expropriation or nationalization · Gold seized at Loulo-Gounkoto : Confiscation is no longer legal but physical and immediate: the stock, normally insured as property, is taken by the host state, and the question becomes one for a confiscation policy, not a theft policy.
  28. April 2025 · Ransomware or extortion · Marks & Spencer : Entry through human error, not a software flaw: underwriting weighs human procedures (access, help desk, providers) as much as technical controls, and a retailer's business interruption far exceeds what a policy covers.
  29. June 19, 2025 · Expropriation or nationalization · Somaïr nationalization : Creeping expropriation carried through, two years after the coup: permit withdrawal, loss of control, nationalization. The date of loss is the underwriting question, and a policy bought after the first symptom buys a dispute.
  30. August 31, 2025 · Ransomware or extortion · Jaguar Land Rover : The state becomes the insurer of last resort for a private cyber loss, through an export credit guarantee. The question of a public backstop for systemic cyber, as for terrorism, leaves theory.
  31. December 29, 2025 · State act and cyber loss · Poland: destructive energy attack, attributed : The junction in a single case: the affected state attributes within two weeks, the formal joint attribution comes six and a half months later, and a private company is among the victims. That is exactly the period during which a state cyber operation exclusion stays undecided.
  32. March 11, 2026 · State act and cyber loss · Stryker: a wipe attributed to an Iranian ministry : A state-attributed, destructive operation against a private company, attributed in nine days: attribution exists, but the major detrimental impact on a state's functioning that cyber war clauses require does not appear to be met. Attribution is only half of the exclusion.
  33. July 27, 2026 · State act and cyber loss · Bahrain v Shehabi: no state immunity for spyware : A supreme court locates a state cyber operation by where the affected machine sits, the very test of the London market's cyber war clauses. The day a judge reads "physically located", this precedent will be on the table.

The countries and their articles

The same map, as text: every country cited by published articles or hit by a major cyber crisis, from most to least named. A state cited on its own, Florida or California, is filed under its country; a crisis is filed under its country of origin and under each affected country its sources name.

United States

15 articles · 8 major cyber crises · 6 political risk crises

United Kingdom

9 articles · 4 major cyber crises · 4 political risk crises

France

9 articles · 1 decision · 1 political risk crisis

Ukraine

3 articles · 1 decision · 3 major cyber crises · 1 political risk crisis

Russia

3 articles · 4 political risk crises

Germany

2 articles · 1 major cyber crisis · 1 political risk crisis

India

4 articles

Switzerland

4 articles

China

2 articles · 1 major cyber crisis

Australia

1 article · 1 political risk crisis

Belgium

2 political risk crises

Bermuda

2 articles

Iran

2 political risk crises

Ireland

1 article · 1 political risk crisis

Japan

2 articles

Kenya

2 articles

Netherlands

1 article · 1 political risk crisis

Poland

1 decision · 1 political risk crisis

Bahrain

1 political risk crisis

Costa Rica

1 major cyber crisis

Denmark

1 major cyber crisis

  • June 27, 2017 · State-attributed operationNotPetya

Finland

1 political risk crisis

Italy

1 article

Mali

1 political risk crisis

Mexico

1 article

Myanmar

1 political risk crisis

Niger

1 political risk crisis

Norway

1 major cyber crisis

Spain

1 political risk crisis

Sweden

1 major cyber crisis

Taiwan

1 article

Basemap: Natural Earth (public domain), at 1:110m in the wide view and 1:50m past zoom level 3.