Cyber war exclusion (LMA 5564-5567, Y5381)
Excludes state-backed cyber attacks from cyber cover: the LMA 5564 to 5567 wordings, their A and B versions, and Lloyd's Bulletin Y5381.
The cyber war exclusion is a provision in standalone cyber policies that excludes losses resulting from cyberattacks sponsored or conducted by states or state-related actors. It differs from traditional twentieth-century war exclusions (designed for kinetic armed conflicts), whose limits the 2023 Merck ruling exposed: the New Jersey appellate court held that the hostile or warlike action exclusion in Merck's policy did not apply to NotPetya. In August 2022, Market Bulletin Y5381 required such clauses in all standalone cyber policies written by Lloyd's syndicates from March 31, 2023. The Lloyd's Market Association published four model clauses in November 2021 (LMA 5564 to LMA 5567), which differ in how much cover they keep, from the total exclusion (LMA 5564) to the widest write-backs (LMA 5567), then replaced them in January 2023 with an A and a B version of each. The A versions contain an agreement on attribution: the insured and the insurer consider the objectively reasonable evidence available, including an official attribution by the government of the state where the affected system is located, and the burden of proof stays with the insurer; they are the ones that satisfy Bulletin Y5381. The B versions contain none, and attribution is then proved under the law governing the contract. The main difficulty in practice is attribution: certain states deliberately sponsor criminal groups while maintaining ambiguity about their status, making the boundary between organized crime and state operations deliberately blurred. That gray zone is where much of the next decade's litigation is expected. Not to be confused with the traditional war exclusion, which requires a war or hostilities, nor with the sanctions exclusion, which looks not at the author of the attack but at the recipient of the payment. Where the term appears: in the general exclusions of the standalone cyber policy, often under the number of the clause adopted (for example LMA 5567A); the letter A or B tells whether an attribution provision exists.
The 2017 NotPetya attack was attributed by the US and UK governments to Russian military intelligence. Yet in the Merck and Mondelez cases, insurers attempted to invoke classical war clauses to refuse indemnification. The New Jersey appellate court rejected that reading of Merck's clause in 2023, and the Mondelez case ended in a settlement in 2022, without a judgment. Lloyd's introduced Y5381 precisely to close that kind of gap: an explicitly drafted cyber-war clause is legally more defensible than a generic war clause, but the attribution question remains its Achilles heel.
- LMA, bulletin LMA21-042-PD, 25 November 2021 (LMA 5564 to 5567)
- Lloyd's, Market Bulletin Y5381, 16 August 2022
- Merck & Co. v. ACE American Insurance Co., New Jersey Appellate Division, 1 May 2023
The wording of each of these clauses, with its variants, can be read and compared in the LMA comparator.
cyber war exclusion, LMA 5564-5567, LMA5567, Lloyd's Y5381, state-backed cyber attack exclusion, LMA 5564, lma5564, LMA 5564A, lma5564a, LMA 5564B, lma5564b, LMA 5565, lma5565, LMA 5565A, lma5565a, LMA 5565B, lma5565b, LMA 5566, lma5566, LMA 5566A, lma5566a, LMA 5566B, lma5566b, LMA 5567, LMA 5567A, lma5567a, LMA 5567B, lma5567b, LMA 5567A Variant, lma5567avariant, LMA 5567A Variant Hamilton, lma5567avarianthamilton, LMA 5567B Variant, lma5567bvariant, LMA 5629, lma5629, LMA 5630, lma5630, LMA 5631, lma5631
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.