The modem was in Germany

Read on 16 October 2026, as it will be published. One fact was missing: on 29 December 2025, a state operation targeted remote access to some thirty renewable sites in Poland, one of the insured's four countries, through a distribution operator's private mobile network (section 3, fact 35). The review of 2 October had flagged it; the note did not carry it. The decision stands; what the fact asks of it is stated in section 6.

Tightened on 6 October 2026. The review of 6 October found the chosen option softer than its analysis: the analysis places the accumulation at the satellite operator, and option A only reached it if information was missing. Option A remains a yes subject to conditions, but two conditions change (section 5): the satellite part is accepted only if a backup link is in service at inception, or by 30 June 2027 at the latest, and no bulk command on the fleet goes out without a second approval. A counter-case is folded into section 3, from a note that will not be published on its own: the March 2026 wiper attack on Stryker, during an open war, where the same paragraph 1.2 could not be proven.

On 1 October 2026, this note became a decision. It builds the file, sets out what a grid would have returned, and proposed three complete decisions. Option A, recommended by the drafter, was adopted: it appears in section 6 with its reason, and the other two stay on the record.

On 1 October 2026, before publication, a senior underwriter reviewed it. Three additions, no substance removed: the insured's loss bounded in figures (section 1), the accumulation and the two scenarios that would hurt a portfolio (section 3), and the dated thresholds that would change the decision before inception (section 6). The decision stands; the assumptions behind the figures are stated in section 9, fact 30.

On 28 September 2026, every fact was checked or withdrawn. The list in section 9 gives, for each fact, its source and what became of it. Web access was partial, as for note No. 3: a search engine answered, but the actual pages (the Council of the EU, the Lloyd's Market Association, the courts) were blocked from the drafting machine. "Checked" therefore means: confirmed by at least two concordant sources, one of them primary where the primary source's summary was readable. LMA 5567A was read by its passages on 29 September: the LMA document stayed blocked, but its decisive sentences were found word for word, each by an exact search pointing to the LMA document and to a second source. Section 9 says which. No clause was read in one piece, and the note says so wherever it matters.

Proposed review on 18 October 2027. On that date the note will be read against what happened, and the review will be published at its head, whether it proves the retained decision right or wrong.

The case is public, the insured is fabricated. The attack, its effects, its attribution and the market clauses cited here are real and dated. The company seeking cover does not exist: it assembles configurations common in its trade. The note says what an underwriter would decide; it tells no one what to buy or where, and carries no recommendation on cover, limit, deductible or premium.

0. Why this case

Note No. 1 asked where the server is, because the London market's cyber war clauses read attribution first from the government of the state where the affected system is located. It looked at an insured exposed to the state under attack. This one takes the opposite case: a system located in a state that is not at war, hit by an operation aimed at another. It is the most common case in practice, and the one the recent clauses say they have settled by writing back "bystanding" systems. The note asks what that write-back really covers, and what it leaves to the judge.

Note No. 1 deals with the Merck litigation and the NotPetya attributions; they are not repeated here.

1. The risk

The public fact

On 24 February 2022, one hour before the invasion of Ukraine, the KA-SAT satellite network, owned by Viasat, was attacked. Viasat published its incident report on 30 March 2022: the attacker came in from the ground, not from space, by exploiting a misconfiguration in a VPN appliance, that opened up the network's management segment to it. From there it sent legitimate management commands to many consumer modems at once, overwriting their memory: the modems could no longer connect, without being permanently destroyed. The wiper involved was described on 31 March 2022 by SentinelLabs, which named it AcidRain; Viasat confirmed its use.

Tens of thousands of modems lost their connection in Ukraine and across Europe. Among the victims who were nobody's target: 5,800 Enercon wind turbines with 11 gigawatts of capacity in Germany, whose remote monitoring and control ran over that network. The turbines kept generating, in automatic mode; it was supervision that disappeared. Enercon had to replace the communication hardware on site. By 19 April 2022, more than 95% of the affected machines were supervised again, across 1,217 wind farms: nearly eight weeks after the attack.

On 10 May 2022, seventy-five days after the attack, the United Kingdom, the United States and the European Union, through a declaration by its High Representative "on behalf of the European Union", attributed the attack to Russia. The EU declaration says the attack, carried out one hour before the invasion, facilitated the military aggression. I found no separate statement by the German government; the attribution that holds for Germany is that of the Union and its Member States.

The clauses

Lloyd's required, in market bulletin Y5381 of 16 August 2022, that every stand-alone cyber policy written or renewed from 31 March 2023 exclude state-backed attacks, on a legally reviewed wording; bulletin Y5433 of 14 May 2024 later updated the approach. The market has largely lined up behind the Lloyd's Market Association models: four clauses published on 25 November 2021 (LMA 5564 to 5567), reissued on 18 January 2023 in eight versions, A and B. The only difference between the two: the B versions do not say how an operation is attributed to a state.

The most favourable to the insured is LMA 5567A, today the most widely used. Read by its passages (section 9), it excludes three things:

1. war (paragraph 1.1), defined as armed conflict involving physical force, by a state against another state or in a civil war, rebellion or military action, "whether war be declared or not";
2. a cyber operation carried out as part of a war, or its immediate preparation (paragraph 1.2: "carried out as part of a war, or the immediate preparation for a war");
3. a cyber operation that makes a state an "impacted state" (paragraph 1.3): a major detrimental impact on its functioning, through disruption of an essential service, or on its security or defense.

And it writes back, against paragraph 1.3 only, systems used by the insured or its service providers that are not located in an impacted state: "paragraph 1.3 shall not apply to the direct or indirect effect of a cyber operation on a computer system used by the insured or its third party service providers that is not physically located in an impacted state but is affected by a cyber operation". The 2021 clauses called them "bystanding cyber assets"; the 2023 versions say the same without that defined term.

The 2023 version is not the 2021 one. The 2021 wording excluded an operation "in the course of war", and retaliation between seven named states (China, France, Germany, Japan, Russia, the United Kingdom, the United States). The 2023 wording removed the retaliation limb, and added the immediate preparation for a war. The first draft of this note, on 28 September, described the 2021 wording under the 2023 name; it is corrected here.

Attribution, in the A versions, is read first from the statements of the government of the state where the affected system is physically located: the text makes it "the primary but not exclusive factor". If that government does not attribute, takes an unreasonable time to do so, or declares itself unable to, it is for the insurer to prove attribution by the other evidence available, and it may rely on an "objectively reasonable" inference.

The insured, fabricated

A French company that operates and maintains onshore wind turbines for wind farm owners. EUR 410 million turnover, 2,300 turbines under contract in France, Germany, Poland and Romania. Its contracts guarantee owners an availability rate for the machines, with penalties if it is missed.

1,400 turbines are supervised by satellite link, all on a single operator's network, because the sites are remote; 900 by fiber or mobile network. Supervision allows a stopped machine to be restarted without sending a technician. Without it, every stop needs a visit, and availability falls.

The request is the renewal of a stand-alone cyber policy, in the London market, with LMA 5567A. The insured was barely affected in 2022: its modems were then on another network. Its cyber loss record is nil over five years, its controls are good (strong authentication, offline backups, segmentation of business IT from supervision), and it passed a security audit last year with no major finding.

The exposure, bounded

The clause decides whether the policy pays; we still need to know how much the insured loses. The figures below are assumptions of the fabricated file, stated so they can be challenged (section 9, fact 30): 1,400 turbines of 2.5 megawatts on average, a 25% capacity factor, output valued at 80 euros per megawatt-hour, and, without supervision, availability down four points because every stop waits for a site visit.

1. The 2022 event, replayed on this insured: fifty-four days without supervision, the time it took Enercon. Output of the 1,400 machines over that period is about 1.13 million megawatt-hours; four points of it is 45,000, i.e. 3.6 million euros of penalties. Replacing equipment at 1,400 remote sites adds 1.7 million, at 1,200 euros a visit. In all, about 5.3 million euros, 1.3% of turnover.
2. The same event with no backup link and no equipment to hand: six months instead of fifty-four days. Penalties grow just over threefold, to 12.2 million; with the equipment, about 14 million euros, 3.4% of turnover.

A loss that gets litigated, without threatening the insured. It is heavy enough for the insured to claim, contractual enough (penalties, every week) to be quantified without argument, and it arises from an event on which the insurer will have its strongest reason to invoke paragraph 1.2. The figure does not change the decision; it shows why condition 2 of option A, the force majeure clause of the maintenance contracts, may remove most of this sum before any insurance question arises.

2. What is missing

Where the satellite network's management segment sits, and in which state. The 2022 attack came in there, and that is where the modems were wiped from. Is the affected system the insured's modem, in Germany, or the operator's management segment, elsewhere? The clause asks for the state where the affected system is located. Until I know which of the two will be looked at, I do not know which government attributes.

How the 1,400 modems are spread across states. Four states means as many as four governments whose word counts for attribution, and four states of which it must be said whether they are "impacted". In 2022, the only attribution valid for Germany came at Union level, on day seventy-five.

What the maintenance contracts say about an act of war. If the force majeure clause suspends the availability guarantee in case of war or an act of state, most of the insured's loss (the penalties) disappears with the triggering event. If it does not, the insured owes the penalties, and its cyber policy might not give them back.

A backup link. Is there, on the satellite sites, a second route, even a slow one, over the mobile network? Enercon took eight weeks to restore 95% of its machines by replacing hardware on site. Eight weeks of visits to 1,400 remote turbines is the loss.

The cellular access of the other 900, by country. How many go through a cellular router, and on which private mobile network, starting with Poland? That was the December 2025 route (section 3). None of option A's four conditions asks for it.

3. The signals

Retained

The bystander write-back does not cover war. This is the heart of the note, and the text says it in so many words: "paragraph 1.3 shall not apply". LMA 5567A writes back systems located outside an impacted state against paragraph 1.3, the one on major impact on a state. It writes them back neither against 1.1, war, nor against 1.2, an operation carried out as part of a war or its immediate preparation. Such an operation remains excluded, whether the modem is in Kyiv or in Brandenburg. The bystander is protected from the state cyber attack; it is not protected from the war the attack is part of.

"One hour before the invasion": the 2023 text has answered. Under the 2021 wording the question was open: was an operation launched before the first shot carried out "in the course of war", when war is defined by physical force and none had yet been used? The 2023 version closes it, by also excluding an operation carried out as part of the immediate preparation for a war. An operation launched one hour before the tanks, which the EU says facilitated the military aggression, is the textbook case. I had set this reading aside on 28 September as coming from a single source; it is in the text, and other sources quote it. What remains open is narrower: how far back "immediate" reaches (one hour, surely; a month of pre-positioning in the network, nothing says), and how the insurer proves the "as part of" link. I found no published decision that answers. On an event like KA-SAT, the write-back therefore very probably does not apply: paragraph 1.2 applies, and it has no write-back. The write-back would only apply to a state operation carried out outside any war and its preparation, and only if Germany is not itself an impacted state.

One satellite network is one event. All the operator's customers are hit at the same hour. That is exactly the accumulation war exclusions exist to cap, and it is therefore on this precise event that the insurer will have the strongest reason to invoke paragraph 1.2. The underwriter must decide knowing that the clause will be argued at the moment it costs most.

Seventy-five days without attribution. No government had attributed the attack between 24 February and 10 May 2022. Meanwhile the claim runs, and the question arises whether that delay was "unreasonable" within the meaning of the clause, which would shift the burden of proof to the insurer. An insured paying penalties every week cannot wait seventy-five days to be told who attacked it.

December 2025, in Poland: the same pattern on the so-called safe part. On 29 December 2025, an operation targeted remote access to some thirty renewable energy sites in Poland, and a combined heat and power plant. No outage reached customers. Warsaw blamed Russia in January 2026; the United Kingdom and the Union attributed it to the FSB's Centre 16 in July 2026, while ESET sees Sandworm, a military intelligence unit: researchers differ on the unit, not on the state. CERT Polska's follow-up report of 8 August 2026 gives the route: the VPN firewall of a wind farm substation, reachable without multi-factor authentication, then a cellular router, then the distribution operator's private mobile network (APN), with no client isolation, from which the attacker reached other facilities. Among the 900 turbines option B treats as diversified, those on the mobile network are exactly what this route targets. And the clause would have excluded nothing: no war, so neither 1.1 nor 1.2; a grid that held, so probably no impacted state under 1.3. The same operation against the insured's Polish farms would be a covered state operation. Here the entry was the farm itself: the hygiene the note sets aside for 2022 counts in this case, and the insured has it.

Set aside

The quality of the insured's controls. They are good, and they change nothing in this case: in 2022, the victims did nothing wrong. The entry point was at the operator, not at the insured. I retain the dependency, I set aside the hygiene.

Damage to the turbines. They ran in 2022, in automatic mode. The risk is not that a machine breaks; it is that it can no longer be restarted remotely, for weeks.

The particular satellite operator. One operator was attacked in 2022; any operator can be, and the file does not depend on its name. The question is how many suppliers there are, and there is only one.

The counter-case: the war was open, and paragraph 1.2 could not be proven

KA-SAT is the case where paragraph 1.2 applies, because a public authority wrote the link: the EU declared that the attack had facilitated the military aggression (section 9, fact 12). The opposite case exists, and it is recent.

1. On 28 February 2026, US and Israeli strikes hit Iran; the armed conflict is open.
2. On 11 March 2026, Stryker reports an incident disrupting its Microsoft environment worldwide. The Handala group claims to have wiped over 200,000 devices in 79 countries, the attacker's own figures, in retaliation for a US strike. A single administrative account was enough, in every country.
3. On 19 March 2026, the Department of Justice seizes four domains and states that Handala is one of the personas of a unit of Iran's intelligence ministry.

The operation is therefore that of a belligerent State, during an open war. And yet paragraph 1.2 cannot be proven: the "as part of a war" link rests only on the attacker's claim, which has every reason to make it, and on a coincidence of dates. No authority wrote it, and a court reads an exclusion narrowly (Merck). Paragraph 1.3 does not apply either: a single company, UK hospitals under demand management for two weeks, no major detrimental impact on the functioning of a State.

What the counter-case changes for note No. 4. Scenario 2 below, the one where the exclusion falls, is not a classroom hypothetical: it is enough that the operation that cuts the operator is tied to the war only by the attacker's word. Paragraph 1.2 protects a portfolio only on the day a public authority writes the link, and nothing guarantees that it will. A decision that leaves the operator accumulation in the contract while counting on that paragraph is counting on a lawsuit. That is what tightens option A. And Stryker's point of entry, an account that could wipe everything, is the one accumulation the insured controls itself: hence the fourth condition.

The accumulation, and the two scenarios that would hurt

The accumulation in this file sits at the operator. A cyber underwriter who writes this operator also writes, without knowing it, other customers of the same satellite network: energy operators, water network managers, remote industrial sites. Their only common point is a management segment that no proposal form asks about. Accumulation is measured by the provider, not by sector or country.

The portfolio can then be hurt in two opposite ways, and that is what makes the question serious.

1. The exclusion holds. A state operation cuts the network at the start of a conflict; the insurer invokes paragraph 1.2 against every affected insured, on the same date. The portfolio pays nothing, but it opens as many disputes as there are insureds, on a reading of "immediate preparation" no court has yet given, with the risk that one adverse decision applies to all.
2. The exclusion fails. A court or tribunal reads "immediate preparation" narrowly, or the operation is tied to no war: the bystander write-back applies, and the portfolio pays every customer of the operator outside the impacted state at once. That is the accumulation bulletin Y5381 meant to bound by requiring state-backed attacks to be excluded. The March 2026 counter-case shows how one gets there without any court having to read "immediate preparation": it is enough that no authority writes the link.

What the insurer does with this accumulation is not for this note, which sets no limit. It says only that the first fact of option A, the state where the management segment sits, is also the portfolio's accumulation key.

4. What an engine would have decided

The grid

An ordinary cyber appetite grid would have read this:

sector               energy services                      monitored
controls             MFA, offline backups, segmentation   favourable
audit                no major finding                     favourable
loss record          nil over five years                  favourable
countries            France, Germany, Poland,             compliant
                     Romania (none at war)
war exclusion        LMA 5567A, bystanding systems        favourable
                     written back
dependencies         declared providers                   standard
------------------------------------------------------------
result               accept, LMA 5567A clause

sector

energy services

monitored

controls

MFA, offline backups, segmentation

favourable

audit

no major finding

favourable

loss record

nil over five years

favourable

countries

France, Germany, Poland, Romania (none at war)

compliant

war exclusion

LMA 5567A, bystanding systems written back

favourable

dependencies

declared providers

standard

result

accept, LMA 5567A clause

The engine accepts, and it has good reasons to. On what it reads, this is a good risk: above-average controls, no losses, no site in a country at war, and the most favourable clause on the market.

Where judgement departs from it, and why

In one place only: the line "war exclusion: bystanding systems written back, favourable". The engine reads it as protection for systems far from the war. I read it as protection against one of the three exclusions only, which leaves whole the one an insurer will invoke on the only event able to hit 1,400 turbines at the same hour.

Three reasons make this departure more than a scruple:

1. The engine thinks the insured's geography decides. None of its countries is at war, so war does not concern it. In 2022, the war cut off turbines in Germany. Paragraphs 1.1 and 1.2 do not look at where the system is; they look at what the operation is part of, preparation included.
2. The engine reads "declared providers" as a list. It does not see that one provider carries more than half the fleet, nor that this provider is a single point through which a state operation passes to reach all its customers.
3. The engine does not count time. Attribution took seventy-five days, restoration eight weeks. The insured's loss is a duration, not damage: weeks of penalties and visits, during which nobody yet knows whether the policy will pay.

What the review will settle. On 18 October 2027 we will know whether an operation attributed to a state cut a telecommunications network shared by several European countries, and whether a judge or arbitrator has read, in a clause of the LMA family, how far back the "immediate preparation" for a war reaches. If nothing of the kind happened, the grid was right over the period, and judgement will have to say whether its departure was worth what it cost.

5. The three possible decisions

Each is complete and defensible. None concerns the terms of the insurance contract: they say whether we accept, for which part of the fleet, and on what information.

Option AYes, subject to information and backup conditions (tightened on 6 October 2026)

We accept the whole, and turn the uncertainty into written facts. Before inception, the insured hands over:

1. the spread of satellite modems by state, and the state where the operator's management segment sits, based on the contract and on what the operator has said publicly;
2. its maintenance contracts' force majeure clause, to know whether an act of war or of a state suspends the availability guarantee;
3. the status of the backup link on the satellite sites: in service, planned and dated, or absent;
4. the administration rule of its supervision platform: no bulk command (shutdown, firmware update, wipe) across more than one wind farm without a second approval by another person.

If the first, the second or the fourth is missing, the decision becomes option B. The satellite part is accepted only if the backup link is in service at inception, or by 30 June 2027 at the latest; failing that, that part is declined as in option B, whatever the other facts say. These conditions recommend nothing to the insured. Without these facts, I know neither who will attribute, nor what the insured loses, nor for how long, and the date from which the accumulation at the operator is no longer total.

Option BYes for the fleet connected by land, no for the part that depends on the satellite network alone

We accept the exposure of the 900 turbines connected by fiber or mobile network, whose dependency is diversified, and decline the part of the 1,400 turbines supervised by the satellite network alone, until they have a backup link. It is the easiest decision to defend before a committee: it declines the accumulation and keeps the ordinary risk. It has a real cost for the insured, who must find cover elsewhere for the most exposed part of its business, or go without.

Option CYes, on the engine's terms

We accept as the grid does. The insured is well run, loss-free, far from any war; LMA 5567A is the clause the market chose for this case, and 2022 shows that turbines keep generating without supervision. Declining or conditioning because an operator was attacked once is pricing an event the clauses were rewritten to handle.

6. What would prove each option wrong

A would be wrong if the facts provided were accurate and useless: if, on the day, the exclusion applied anyway under paragraph 1.2, whatever the geography of the modems, and the information had only served to describe an uncovered loss. It would also be wrong if the insured could not obtain from the operator the location of the management segment: that means the dependency is opaque down to the contract, and A should have been B from the start. Even tightened, it would still be wrong if the backup link were missing on 30 June 2027 for a reason outside the insured's control (a supplier, a permit): it would then decline the satellite part as B does, six months later, having carried that accumulation in the meantime.

B would be wrong if, by 18 October 2027, no shared telecommunications network in Europe had been cut by a state operation, and satellite operators had hardened their management segments enough to make 2022 unlikely. The insured would have borne the cost of an accumulation that never happened.

C would be wrong if, during the period, an operation attributed to a state had cut a network shared by several European countries; or if a judge or arbitrator had read the "immediate preparation" for a war as covering an operation launched before hostilities, as the text already invites; or if an attribution had again taken weeks to come. In each of these cases, the policy accepted on the strength of the write-back would have been fought over the exclusion the write-back does not touch.

What would change my mind before inception

The policy renews on 1 January 2027 (a date of the fabricated file). Here, dated, are the facts that would tip option A before that date.

1. By 1 December 2026, the insured has not obtained from the operator the state where the management segment sits: the decision becomes option B, the satellite part declined, since the dependency is opaque even in the contract.
2. The maintenance contracts' force majeure clause does not suspend the availability guarantee for an act of war, and the backup link is neither in service nor dated before 30 June 2027: option B. The loss quantified in section 1 then stays entirely with the insured, and it arises from precisely the event the clause excludes.
3. A court decision or award published before 1 January 2027 reads the "immediate preparation" of a war: if it reads it broadly, A holds, and the loss in section 1 is to be treated as probably not covered; if it reads it narrowly, scenario 2 of section 3 becomes the central case, and the decision is re-examined on that accumulation, ahead of inception.
4. Before inception, an operation attributed to a state cuts a telecommunications network used across several European countries: the file is re-examined on the facts of that operation, not those of 2022.

On 18 October 2027, these thresholds will be reviewed alongside the five facts in section 7.

The Polish case, added on 16 October 2026, does not change the decision. It was not in the file on 6 October. It does not bring option A down: condition 1 already gives the spread by state, and the loss would read with the same penalties. But it targets the part option B treats as safe, and none of the four conditions asks for the farms' cellular access. Adding that fifth item would change a decision already taken, which a review does not do: the question was put to management on 16 October 2026.

The drafter's recommendation

Option A. Reason: the four facts requested are the ones that decide whether the policy will pay and how much, and the insured can obtain them before inception, in its contracts and from its operator. It does not bet on the reach of "immediate preparation", which nobody has settled: it reduces what depends on that reading. The March 2026 counter-case shows that this reading can fail even during an open war: A therefore keeps the satellite part only if the accumulation at a single operator ends before 30 June 2027. B declines more than half the fleet for a contract line that can be read; C treats the write-back as a boundary, when it leaves open the exclusion that will be argued.

What the recommendation is not: a decision. If the decision chooses B or C, that decision prevails, and the published note will carry both, disagreement included.

Decision: Option A, yes subject to information and backup conditions, following the drafter's recommendation, under the delegation rule of 29 September 2026, and tightened on 6 October 2026: the satellite part is accepted only if a backup link is in service by 30 June 2027 at the latest, and no bulk command goes out without a second approval.

Reason in one sentence: It asks for the facts that decide whether the policy pays and how much, and keeps the accumulation at a single operator only if it ends before 30 June 2027, because paragraph 1.2 protects a portfolio only on the day a public authority writes the link with the war.

Date of decision: 1 October 2026, tightened on 6 October 2026

Review date: 18 October 2027 (proposed, and open to change)

7. The review

On 18 October 2027, or on the date that has been set. As the insured is fabricated, the review bears only on public facts. We will look, in this order, for five verifiable facts:

1. A cyber operation publicly attributed to a state that cut a telecom network used across several European countries, from 18 October 2026 to the review date. Yes or no, with the date of the incident and of the attribution.
2. A published court decision or arbitral award reading an exclusion of the LMA 5564 to 5567 family, and in particular how far back the "immediate preparation" for a war reaches.
3. The time from incident to attribution for each major state operation of the period, against the seventy-five days of 2022.
4. A new Lloyd's bulletin or a new version of the LMA clauses changing the bystander write-back or the attribution rule.
5. A public dispute over the bystander write-back, in Europe or the United States.

The review will say which occurred, what it does to the retained option, and who was right, the grid or the judgement. If none of the five occurred, it will say so too, and option C will be credited with its win. Beyond those five, it will also look at any attributed operation against remote access to renewable energy farms in Europe, and at what the Polish distribution operators did with their private mobile networks after the CERT Polska report.

8. Objections

Adversarial review, played by a political risk reviewer in the posture of a senior London market political risk underwriter. Its three hardest objections, and the answers.

Objection 1 · "Viasat produced no insurance dispute."

"You build a note on an event that cost cyber insurers almost nothing. The turbines ran, the modems were replaced, and I know of no insured who argued the war exclusion over KA-SAT. The market looked, and found nothing to settle."

Answer. The objection is right about the past, and I found no published dispute either. But the absence of dispute comes from the loss, not the clause: the 2022 victims lost supervision, not turnover. The insured in this note loses availability penalties, every week, on 1,400 machines. The same event, on an insured whose loss is contractual, produces the dispute 2022 did not, which is why condition 2 seeks to know whether that loss exists.

Objection 2 · "One hour before the invasion is war."

"Any court will say that an operation launched one hour before the tanks, against a network used in Ukraine, is part of the war. Your question is settled in one hearing."

Answer. The objection has the text on its side: the 2023 version excludes an operation carried out as part of the immediate preparation for a war, and the first draft of this note wrongly set that aside. But it proves me right on the point that matters: the bystander write-back is worth nothing on the only event able to hit the whole satellite fleet at once, and the grid, which scores it "favourable", was wrong. Whether the clause is read widely or narrowly, the decision must not rest on it. That is what option A does: it makes the loss known before knowing who will bear it.

Objection 3 · "You are asking the insured for its supplier's architecture."

"No customer of a satellite operator knows where the network's management segment is. You set an impossible condition, which amounts to declining."

Answer. It is the fairest objection, and it forces condition 1 to be made precise: it asks for what the operator's contract and public statements say, not for an audit of its network. In 2022, Viasat published its incident report thirty-four days after the attack, and that report said where the attacker came in. If the operator refuses to say in which state it administers the network more than half the fleet depends on, the refusal is itself the information: a dependency the contract does not allow you to locate is a dependency the clause does not allow you to read, and the note then moves to option B, as it already says.

9. The facts checked

Check of 28 September 2026. Twenty-four facts: 20 kept, 3 requalified, 1 withdrawn, and one figure withdrawn from fact 5. Partial web access, stated at the head of the note. Given as a list, since note pages do not yet render tables.

Second check, 29 September 2026, against the text of LMA 5567A. The LMA document (War and Cyber Operation Exclusion No. 4, LMA5567A) and the law firms' commentary stayed blocked from the drafting machine. Each passage quoted below was found word for word by an exact search, whose results pointed to the LMA document and to at least one other source. This is a reading by passages, not in one piece: the exact order of paragraphs 2 onwards, and the verbatim wording of the unreasonable delay rule, could not be checked. It corrects facts 19, 20 and 23, refines facts 21, 22 and 24, and adds facts 25 to 29.

1. On 24 February 2022, one hour before the invasion, attack on the KA-SAT network. Consilium: declaration of 10 May 2022 by the High Representative on behalf of the EU; CCDCOE, "Viasat KA-SAT attack (2022)". Checked, kept.
2. A VPN appliance misconfiguration let the attacker in; it then sent legitimate management commands to the modems. Viasat incident report of 30 March 2022; The Register, same day; BankInfoSecurity. Checked, kept.
3. The modems were made unusable, but not destroyed for good. Same source. Checked, kept.
4. AcidRain wiper described by SentinelLabs, use confirmed by Viasat. SentinelLabs, 31 March 2022; The Record, TechCrunch, 31 March 2022. Checked, kept.
5. "Tens of thousands of modems" in Ukraine and Europe. Viasat, 30 March 2022, and press. Checked, kept. The figure of about 30,000 modems replaced, found in a single secondary source, is withdrawn.
6. 5,800 Enercon turbines in Germany, 11 GW, supervision lost. pv magazine, 1 March 2022; Renewables Now; Modern Power Systems. Checked, kept.
7. The turbines kept generating in automatic mode. DatacenterDynamics and Renewables Now, quoting Enercon. Checked, kept.
8. Over 95% reconnected, 1,217 wind farms, by 19 April 2022. Enercon release reported by REVE, 21 April 2022. Checked, kept.
9. "Nearly eight weeks": fifty-four days from the attack to 19 April 2022. Recalculated, kept.
10. Attribution to Russia on 10 May 2022 by the EU, the UK and the US. Consilium and TechCrunch, 10 May 2022; SC Media. Checked, kept.
11. Seventy-five days between attack and attribution. 24 February to 10 May 2022. Recalculated, kept.
12. The EU says the attack "facilitated the military aggression". EU declaration of 10 May 2022. Checked, kept.
13. No separate statement by the German government. None found; sources cite the Union "and its Member States". Requalified: written as "I found no", not "there is none".
14. Lloyd's bulletin Y5381 of 16 August 2022, requirement from 31 March 2023, stand-alone cyber policies. Lloyd's, bulletin Y5381; DAC Beachcroft; Kennedys. Checked, kept (already checked for note No. 1).
15. Bulletin Y5433 of 14 May 2024, updating the approach of Y5381. Lloyd's, bulletin Y5433 (State backed cyber attack wordings); DAC Beachcroft. Checked; dated on 7 October 2026, the date not having been checked on 28 September.
16. On 25 November 2021, LMA 5564 to 5567 published. Note No. 1, checked; LMA. Checked, kept.
17. On 18 January 2023, A and B versions published; B without the attribution rule. LMA bulletin LMA23-002; DAC Beachcroft; Lexology. Checked, kept.
18. LMA 5567A the most widely used. A single market training source from 2026, not corroborated. Requalified: "today the most widely used" kept as market opinion, without a figure.
19. Three exclusions. On the 28th: "war and operation in the course of war; retaliation between named states; major detrimental impact on a state", at secondary source. Corrected on the 29th: that was the 2021 wording. In 2023: 1.1 war; 1.2 an operation carried out as part of a war or its immediate preparation; 1.3 an operation that makes a state an impacted state. Facts 25 to 27.
20. Retaliation between seven named states (China, France, Germany, Japan, Russia, UK, US). Corrected on the 29th: an exclusion of the 2021 wording, removed in 2023. Kept in the body as the clause's history, withdrawn from the list of 5567A exclusions.
21. Write-back, for the third exclusion only, of systems outside an impacted state; the term "bystanding cyber asset" dropped in 2023. Marsh; DAC Beachcroft (correction of the paragraph 1.3 write-back, specific to 5567). Read in the text on the 29th: "paragraph 1.3 shall not apply to the direct or indirect effect of a cyber operation on a computer system used by the insured or its third party service providers that is not physically located in an impacted state but is affected by a cyber operation" (LMA5567A; the same sentence in the Munich Re clause put online by Insurance Journal in May 2023). This is the pivot, and it holds.
22. Attribution by the government of the state where the system is; failing that, the burden falls on the insurer, which may rely on an "objectively reasonable" inference. Marsh; DWF, October 2022; DAC Beachcroft. Checked at secondary source, kept. First half read on the 29th: per LMA5567A and IBA materials of 18 April 2023, the government of the state where the system is located is "the primary but not exclusive factor". The unreasonable delay rule, not found word for word, stays at secondary source.
23. The exclusion extended to the "immediate preparation" for a war. On the 28th: one market source only, withdrawn. Restored on the 29th, and withdrawing it was a mistake: "a cyber operation that is carried out as part of a war, or the immediate preparation for a war", paragraph 1.2 of LMA5567A. Found by exact search with the LMA document, a DAC Beachcroft note republished by Lexology (January 2023) and an article in The Geneva Papers on Risk and Insurance (2025); Munich Re describes the same extension. The lesson is in the drafter's log: a single source that contradicts the thesis is checked before it is withdrawn, like one that supports it.
24. No published decision on these clauses. None found on the 28th or the 29th, notably on "immediate preparation". Requalified: "I found no decision", not "there is none". Search repeated on 7 October 2026: none found.
25. Definition of war: armed conflict involving physical force, by a state against another state or as part of a civil war, rebellion, revolution, insurrection, military action or usurpation of power, "whether war be declared or not". LMA5567A, found by exact search; DAC Beachcroft. Kept.
26. Paragraph 1.3 and the impacted state definition: a major detrimental impact on "the functioning of a state due to the direct or indirect effect of the cyber operation on the availability, integrity or delivery of an essential service in that state", or on its security or defense. LMA5567A, found by exact search; Elmore; Cloud Security Alliance. Kept.
27. On 18 January 2023, A and B versions replace the 2021 clauses: out goes retaliation between named states, in comes immediate preparation. Sources: IBA materials of 18 April 2023 and DAC Beachcroft, January 2023. Kept.
28. The write-back targets paragraph 1.3 only. Follows from fact 21, read in the sentence itself ("paragraph 1.3 shall not apply"): no passage found writes a system back against 1.1 or 1.2. Kept, subject to the reading being by passages.
29. Document title: "War and Cyber Operation Exclusion No. 4". LMA document, LMA5567A, indexed in 2025. Kept.
30. Added on 1 October 2026 (senior review): the insured's loss in figures. Assumptions of the fabricated file, not public facts: 2.5 megawatts per machine, 25% capacity factor, 80 euros per megawatt-hour, four availability points lost without supervision, 1,200 euros per visit, six months for the severe case. Only the fifty-four-day duration is a public fact (Enercon, 19 April 2022, facts 8 and 9). Calculation: 1,400 × 2.5 × 0.25 × 24 × 54 ≈ 1.13 million megawatt-hours; 4% ≈ 45,000; × 80 ≈ 3.6 million euros; 1,400 × 1,200 ≈ 1.7 million. Severe case, six months of 182 days: 1,400 × 2.5 × 0.25 × 24 × 182 ≈ 3.82 million megawatt-hours; 4% × 80 ≈ 12.2 million euros; with the site visits, 13.9 million, i.e. about 14 million and 3.4% of turnover (working added on 12 October 2026). Added, open to challenge.
31. Folded in on 6 October 2026, from note No. 18: the strikes on Iran of 28 February 2026. Khaleej Times; KTVU; IOL, citing a New York Times investigation. Checked, kept.
32. The wiper attack of 11 March 2026 on Stryker, claimed by Handala (over 200,000 devices, 79 countries, the attacker's figures) in retaliation for a US strike. Stryker, Form 8-K; KrebsOnSecurity; ClearanceJobs; Digital Health. Checked, kept, with the figures under reservation.
33. The attribution of 19 March 2026 to a unit of Iran's intelligence ministry, and the seizure of four domains. The Record; Cyber Daily; CTV News; Healthcare IT News. Checked, kept. Corrected on 7 October 2026: the note said 20 March; the Department of Justice release and its report by Iran International are dated 19 March.
34. UK hospitals under demand management; the market reading through the impacted state threshold. NHS England; Digital Health; Cloud Security Alliance, 10 April 2026; Claims Pages, 23 March 2026. Checked, kept.
35. Added on 16 October 2026: the operation of 29 December 2025 against some thirty Polish renewable sites and a combined heat and power plant, blamed on Russia by Poland in January 2026, attributed to the FSB's Centre 16 by the United Kingdom and the Union in July 2026 (ESET: Sandworm); entry through a wind farm's VPN without multi-factor authentication, then the distribution operator's private mobile network, with no client isolation. CERT Polska, follow-up report of 8 August 2026; The Record, July 2026; gov.uk; BleepingComputer; SecurityWeek. Flagged by the review of 2 October 2026, checked on 16 October by search, pages not opened. Kept.

What the check changes to the decision. On the 28th, nothing that brought it down, and the pivot (fact 21) remained to be read in the text. On the 29th, the thesis holds, and it is stronger: the write-back targets paragraph 1.3 only, in so many words, and paragraph 1.2 goes further than the first draft said, since it covers the immediate preparation for a war. The "one hour before the invasion" question, which the first draft called open, is largely settled by the text; how far back "immediate" reaches remains open. Option A, the recommendation, does not change: it did not depend on that reading. At publication, the LMA document has still not been read in one piece: the order of paragraphs and the unreasonable delay rule still rest on secondary sources.

Public sources cited. Declaration by the High Representative on behalf of the European Union on Russian cyber operations against Ukraine, 10 May 2022. Viasat, KA-SAT incident report, 30 March 2022. SentinelLabs, AcidRain, a modem wiper rains down on Europe, 31 March 2022. Enercon, releases of March and 19 April 2022. Lloyd's, market bulletins Y5381 (16 August 2022) and Y5433 (14 May 2024). Lloyd's Market Association, clauses LMA 5564 to 5567 of 25 November 2021 and their A and B versions of 18 January 2023, including War and Cyber Operation Exclusion No. 4 (LMA5567A). DAC Beachcroft, LMA publishes updated war and cyber operation exclusions, January 2023. International Bar Association, The LMA Cyber War Exclusions, materials of 18 April 2023. Munich Re, War and Cyber Operation Exclusion, put online by Insurance Journal, May 2023. At publication, neither the LMA document nor Viasat's incident report could be read in one piece: the note relies on their passages, found as this section explains.