The server is in Warsaw

Review due on 27 March 2027. On that date this note will be read again against what actually happened, and the review will be published at the top, whether it proves me right or wrong.

Amended on 26 September 2026, before publication. The cyber reviewer objected, the objection partly held, and the decision now carries four conditions instead of three. The objection and the reply are in section 7, as written: it should be possible to see what changed and why.

The risk is fabricated. It combines real market configurations; no existing company is described. The note says what an underwriter would decide. It tells nobody what to buy, or where: it contains no recommendation of cover, limit, deductible or premium.

1. The risk

A freight forwarder and logistics operator headquartered in France. EUR 340 million turnover, 2,100 employees, eleven sites in Europe, four of them in eastern Poland, on the corridor that carries freight to Ukraine. Two of them are bonded warehouses.

Three things shape the exposure. Polish customs declarations run through a single piece of software, published locally and updated automatically. The ERP and warehouse management system for the whole group are hosted in one data centre in Warsaw, a historical choice of the Polish IT team, and their backups are replicated in the same building. And a single Active Directory covers all eleven sites.

The request is the renewal of a standalone cyber policy. Since 31 March 2023, Lloyd's has required managing agents to include, in every standalone cyber policy, a clause excluding losses from state-backed cyber attacks (market bulletin Y5381, 16 August 2022), based on the model clauses published by the Lloyd's Market Association on 25 November 2021 (LMA 5564 to 5567), since revised in A and B versions. The renewal is therefore negotiated under one of these families of wording, and this is where political risk enters the cyber contract.

2. What is missing

A physical inventory of systems. I know where the ERP is. I do not know where email, the directory, offline backups if any, or the administration workstations run. Yet under these clauses the test is neither the insured's head office nor the attacker's nationality: it is where the affected system is physically located. Attribution is read first in the statements of that State's government, and some variants write back into cover the so-called bystanding cyber asset, defined as a system not physically located in the impacted State. Without the inventory, I do not know which part of the group would be in the impacted State and which part would be a bystander.

The update process for the customs software. Pushed by the vendor or validated internally, from which network, with which rights.

A dated restoration test. Not a backup policy: a test, with its date and its measured duration.

The relationship with the vendor. Permanent remote maintenance access, or access opened on request only.

Each of these gaps weighs more than the whole standard questionnaire, because they decide both the probability of a severe loss and how the contract will be read on the day it happens.

3. The signals

Retained

The single local business software, updated automatically. This is the NotPetya path of June 2017: a Ukrainian tax accounting package compromised at source, whose update carried a destructive payload to all its users, including groups that nobody was targeting. The United Kingdom and the United States attributed the attack to the Russian military in February 2018. A forwarder whose customs declarations depend on a single local vendor, in a country bordering a war, is in that configuration.

The concentration in Warsaw. It counts twice. In frequency, because one site carries the ERP, the WMS and their backups. In characterisation, because a state operation with a major detrimental impact on Poland's essential services would make this data centre a system located in the impacted State. The same incident would be excluded for the Warsaw systems and potentially covered for those in Lyon. Where a server sits, decided ten years ago by an IT team, now sets the boundary between cyber risk and political risk.

The single directory. It turns a local compromise into a group compromise. That is what turns a Polish loss into an eleven-site loss.

Sanctions. If the attack comes with extortion, the recipient of a ransom may be a sanctioned person. The US Treasury said so in its advisory on ransom payments (OFAC, 1 October 2020, updated 21 September 2021). The insured's ability to recover cannot therefore rest on a payment: it rests on restoration, which is why the dated test is a condition and not a question.

Accumulation on the vendor. Every user of the customs software shares the same path. This signal is not asked of the insured: it is read in the underwriter's own portfolio, and on its own it can change the answer. (Retained after the cyber reviewer's objection, section 7.)

Set aside

Proximity to the conflict, taken alone. Being in eastern Poland does not in itself raise the probability of being targeted. What raises it is the path: a shared software package, a flat directory, a compromised supplier. I keep the path and set aside the map. And what makes the insured a target is its trade on the aid corridor, not its place on the map (section 7).

No losses in five years. It tells us about the frequency of ordinary incidents, not about a correlated tail event. NotPetya hit companies that had never reported a cyber claim.

The external attack surface score. It measures what can be seen from outside. The vector retained here comes in through the trusted door, a signed update; a good external score says nothing about it.

The exclusion itself, as a reason to accept. This is the most tempting signal, and I set it aside deliberately. On 1 May 2023 Merck won on appeal, before the New Jersey Appellate Division, the ruling that the "hostile or warlike action" exclusion in its property policies did not apply to NotPetya; the case ended in a settlement in January 2024. Mondelez had settled on the same question in 2022. An underwriter who accepts a risk because they are counting on the war exclusion is making a legal bet, not underwriting. The recent clauses have clarified attribution, they have not removed the dispute: the burden of proof stays with the insurer, and an official attribution may come late, or never.

4. The decision

Yes, subject to conditions. And I decide as if the exclusion did not apply.

The scenarios I fear, a compromised update or a stolen account spreading through the directory to the Warsaw ERP, are scenarios whose characterisation will be disputed. I do not leave them to the exclusion; I reduce them at the source. The conditions concern information and the risk, never the terms of the contract:

1. A physical inventory of critical systems, delivered before inception: ERP, WMS, directory, email, backups, with the country and building of each.
2. A copy of critical backups outside Warsaw, immutable or offline, and a dated restoration test less than six months old, with its measured duration.
3. The customs software isolated: updates received on a separate segment and validated before deployment, with no trust relationship to the group directory; vendor remote maintenance opened on request only.
4. Identity held, and verified: multi-factor authentication on all remote access and on email, directory administration accounts separate from everyday accounts, and a review of mailbox access rights less than three months old, stating whether unknown delegations were found. (Added after the cyber reviewer's objection, section 7.)

If any of the four is missing at inception, the decision becomes no. These are not recommendations to the insured: they are the facts without which I do not know what I am accepting.

5. What would prove me wrong

That the insured is the target of a destructive operation, not of an espionage operation. That it is a target at all is an established fact at the date of this note, and I had missed it at first (section 7): logistics operators on this corridor have been publicly targeted since 2022. What I still assume is that this targeting seeks to know, not to destroy. If, by 27 March 2027, the Polish government or an allied government publicly attributes to a State a destructive operation aimed directly at a private logistics operator established in Poland, then operators on this corridor have moved from intelligence to destruction. My four conditions are no longer enough, the frequency I assumed is wrong, and the decision should have been no.

And a second, more modest signal: if the insured cannot produce a dated restoration test within thirty days, its backups are a policy and not a capability. The "yes" falls, and I will have been wrong to announce it before seeing it.

6. The review

27 March 2027. We will look for three things, in this order: a public attribution of a destructive operation aimed at a logistics operator in Poland; a court ruling or published award applying one of the LMA 5564 to 5567 clauses to collateral damage; a compromise at source of a regional business software package, in any country bordering the conflict. The review will say which one happened, and what it does to the decision.

7. The cyber reviewer's objection, and the reply

The objection, Saturday 26 September

Your note has the wrong dominant vector, and a public document says so. On 21 May 2025, CISA, the FBI and the NSA published with their partners a joint advisory (AA25-141A) on a campaign by unit 26165 of Russian military intelligence against logistics and technology companies that deliver aid to Ukraine. Among the co-signers: the Polish Internal Security Agency (ABW) and the Military Counterintelligence Service (SKW). Poland is among the countries of the compromised entities. Your insured sits exactly in that scope. It is not a hypothetical bystander: its trade is a documented, attributed target, for more than three years at the date of the advisory.

And the techniques described do not go through a software update: password spraying, spearphishing, changes to mailbox access permissions. The path is identity. You retain the single directory as a signal and make no condition of it.

I add the frequency argument, which holds even without any State: for a logistics operator of this size, the most likely loss is criminal ransomware entering through remote access or a stolen account. It also goes through identity, it also goes after the Warsaw backups, and no war exclusion touches it. Your note decides on the tail and leaves the body of the distribution without a condition.

Finally, correlation. The single customs software is not only this insured's risk; it is the risk of everyone who uses it. An underwriter who says yes here adds a line to an accumulation they must measure.

The political risk drafter's reply

On targeting, the objection holds and I take it in full. I wrote "that the insured is a target" as the refutation condition for a fact that was already public. That is exactly the error a note must avoid: treating as a future uncertainty what is information available today. Section 5 is rewritten accordingly. What I maintain is the distinction that matters for characterisation: the advisory describes espionage. Access used to read does not produce a loss; the same access may one day be used to destroy, and on that day the attribution question will arise about an operation already attributed in its intelligence phase. That is why the review of mailbox rights becomes a condition: it does not look for a future risk, it looks for a possible presence today.

On identity and frequency, the objection holds. The fourth condition follows directly from it. It serves both scenarios, the state one and the criminal one, which is the best reason to make it a condition.

On correlation, it is right but it is not aimed at the insured. Accumulation on a regional vendor is the underwriter's work on their own portfolio, not information the insured can provide. I retain it as a signal, not a condition: if the portfolio already carries other users of this software, the answer may become no for a reason that has nothing to do with this file, and that decision is taken separately.

What I do not change: deciding as if the exclusion did not apply. The cyber reviewer did not contest it, and the 2025 advisory reinforces it: a campaign attributed to a State in its espionage phase would make a dispute over a destructive phase more likely, not less.

Public sources cited. Lloyd's, market bulletin Y5381, 16 August 2022. Lloyd's Market Association, clauses LMA 5564 to 5567, 25 November 2021, and their A and B revisions. Superior Court of New Jersey, Appellate Division, Merck & Co. v. ACE American Insurance Co., 1 May 2023; settlement filed in January 2024. UK Government and the White House, attributions of NotPetya, February 2018. U.S. Department of the Treasury, OFAC, Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments, 1 October 2020, updated 21 September 2021. CISA, FBI, NSA and partners, including Poland's ABW and SKW, joint advisory AA25-141A, Russian GRU Targeting Western Logistics Entities and Technology Companies, 21 May 2025.