Skip to content
←Back to glossaryCyber

Cyber incident

Disruption or failure of a computer system of non-malicious origin, as opposed to an intentional cyber act. The LMA 5400 write-back covers physical damage resulting from such an incident.

Definition

On August 3, 2018, a WannaCry variant got into TSMC through a new production tool installed without a virus scan, and halted several of the Taiwanese foundry's fabs over the weekend. Malicious code, accidental infection: the line between a cyber incident and a cyber act blurs on the first real case. In the LMA property clauses (LMA 5400), a cyber incident means a disruption or failure of a computer system resulting from a non-malicious cause: human error, software bug, hardware failure, faulty update or natural event affecting systems. A cyber act, by contrast, implies malicious intent. This distinction determines the scope of the write-back in LMA 5400: only physical damage (fire, explosion) resulting from a non-malicious cyber incident is reinstated into property coverage. Damage resulting from a malicious cyber act remains excluded. In practice, classifying the loss after the fact is often hard and usually takes a forensic investigation. It should not be confused with the cyber operation of the cyber war clauses, which requires a state dimension.

Its 4 cross-references, woven across the glossary's 18 categories
Cyber incident: Cyber glossary illustration, AlgoPolis
Example

In August 2018, a WannaCry variant got into TSMC through a new production tool installed without a virus scan and halted several of the foundry's fabs from Friday evening to Monday, August 6, with 80% of the affected tools back by Sunday the 5th. TSMC estimated the impact at about 3% of its third-quarter revenue. Malicious code, accidental infection, no attacker targeting TSMC: whether this is a cyber incident or a cyber act under LMA 5400 is already arguable here, and that call would have decided whether any resulting physical damage benefited from the fire/explosion write-back.

Read next
CyberCyber actA malicious act that uses a computer system to cause harm, as opposed to an unintentional cyber incident. The key term in the LMA 5400 and 5401 property clauses.Read the entry →CyberSilent cyber (non-affirmative cyber)Cyber exposure implicitly embedded in a traditional policy that neither explicitly mentions nor excludes cyber.Read the entry →InsuranceWrite-backContractual mechanism by which certain risks initially excluded from a policy are partially or fully written back into cover through a specific clause or endorsement.Read the entry →
Put it to work
QuizThe silence of policies, and how it endedAcademy questions on this concept, each one marked and explained.Test yourself →SimulatorPlay this case from the underwriter's seatEight quarters, one book, cyber and political risk files. You set the price and the war clause, then the market answers back.Take the seat →
Sources
  • TSMC, statements of August 5 and 6, 2018 on the virus incident (80% of tools restored on the 5th, full recovery on the 6th, impact revised to about 3% of third-quarter revenue), as reported by SecurityWeek, "Chip Giant TSMC Says WannaCry Behind Production Halt", August 6, 2018
Related terms
Related articles
Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.