Bricking
A situation in which an attack makes equipment permanently unusable without visible physical damage, and the cover for its replacement, long stuck between the property policy and the cyber policy.
Equipment is said to be bricked when an attack or a corrupted update damages its firmware to the point that it no longer boots and can only be reset through costly intervention, or not at all. The hardware looks intact but is worthless. This situation long escaped every policy. The property policy required direct physical damage and did not treat software corruption as such. The cyber policy covered restoration of data and software, but not replacement of hardware. Bricking cover, which appeared in cyber policies in the late 2010s, fills that gap by covering the cost of replacing or repairing equipment made unusable, sometimes limited to replacement value or depreciated value. It has grown in importance with the spread of connected devices, payment terminals and industrial controllers, whose firmware is a prime target for destructive attacks, including state ones.
In August 2012, the Shamoon wiper erased about 30,000 workstations at the oil company Saudi Aramco, which had to replace hard drives on a massive scale at very short notice. In February 2022, the attack on the KA-SAT network made tens of thousands of satellite modems unusable, and the operator had to replace them physically.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.