Skip to content
←Back to glossaryCyber

Cyber act

A malicious act that uses a computer system to cause harm, as opposed to an unintentional cyber incident. The key term in the LMA 5400 and 5401 property clauses.

The clause, AlgoPolis summary · LMA 5400

Very narrow. LMA 5400 writes back one thing only: physical damage caused by the fire or explosion perils arising out of a non-malicious cyber incident. It writes back neither the resulting business interruption nor anything connected to a malicious cyber act.

The clause in the comparator
Definition

In November 2019, the Lloyd's Market Association issued the LMA 5400 and 5401 property clauses. They answered Lloyd's Market Bulletin Y5258 of July 2019, which required every policy to state whether it covers or excludes cyber risk, putting an end to silent cyber. In these clauses, a cyber act is a malicious act that uses a computer system to cause harm; a cyber incident is an error or failure with no intent to harm. The LMA 5400 write-back turns entirely on that difference. LMA 5400 excludes any loss arising from a cyber act, but writes back physical damage from fire or explosion caused by a non-malicious cyber incident. LMA 5401 excludes both, with no exceptions. The line is thin: a misconfiguration that starts a fire is a cyber incident, an attack that starts the same fire is a cyber act. On a claim, the real fight is often over proving intent. State cyber operation, the term used in the cyber war clauses (LMA 5564 to 5567), is a separate concept.

Its 4 cross-references, woven across the glossary's 18 categories
Cyber act: Cyber glossary illustration, AlgoPolis
Example

Textbook case: a hacker takes over a server room's climate control system and overheats the room until it catches fire. That is a cyber act, since malicious intent is established, and LMA 5400 would not cover the fire. Had the overheating come from an unintentional software fault, it would be a cyber incident, and the physical fire damage would fall within the LMA 5400 write-back.

Read next
CyberCyber incidentDisruption or failure of a computer system of non-malicious origin, as opposed to an intentional cyber act. The LMA 5400 write-back covers physical damage resulting from such an incident.Read the entry →CyberSilent cyber (non-affirmative cyber)Cyber exposure implicitly embedded in a traditional policy that neither explicitly mentions nor excludes cyber.Read the entry →InsuranceWrite-backContractual mechanism by which certain risks initially excluded from a policy are partially or fully written back into cover through a specific clause or endorsement.Read the entry →
Put it to work
QuizThe silence of policies, and how it endedAcademy questions on this concept, each one marked and explained.Test yourself →SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
In the LMA comparator

The wording of each of these clauses, with its variants, can be read and compared in the LMA comparator.

LMA 5400LMA 5401
Related terms
Affirmative cyber
Related articles
Also known as

cyber act, malicious cyber act, cyber operation, LMA 5400, lma5400, LMA 5401, lma5401

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.