Impacted state (LMA cyber war exclusion)
The LMA 5565 to 5567 threshold: a state-backed cyber operation with a major detrimental impact on a state's essential services, security or defense.
On December 12, 2023, an attack that Ukrainian intelligence attributes to Sandworm, part of Russian military intelligence, took down Kyivstar, the country's largest mobile operator. About 24 million subscribers lost phone and internet service for several days. That is the situation the impacted state concept describes. It is a defined term in LMA 5565, 5566 and 5567, versions A and B, carried into the definitions of the cyber policy. A state becomes impacted when a cyber operation has had a major detrimental impact on it. There are two routes. Either the operation hits the state's functioning, through disruption to the availability, integrity or delivery of an essential service (financial institutions, health services, utility services), or it hits the state's security or defense. This dual test sets a threshold of systemic criticality. Outside war and retaliatory operations between the seven states the clauses name (China, France, Germany, Japan, Russia, the UK and the US), a state-backed operation is excluded only if it reaches that threshold. Below it, the operation stays covered within the policy limit, subject to other exclusions. LMA 5565 subjects that residual cover to limits set in the policy, 5566 does not, and 5567 also writes back systems located outside the impacted state. One point is often misread. Under 5565 and 5566, the exclusion bites as soon as a state is impacted, wherever the insured's system sits. Only 5567 makes that location count, and the insured's nationality counts under none of the three. The impacted state is the one on the receiving end, never the attacker. The threshold stays vague. Neither "major detrimental impact" nor the line with an ordinary sector incident is defined, and Lloyd's Market Bulletin Y5381 of August 2022, which made these exclusions mandatory at Lloyd's, does not settle it. Kyivstar makes the point its own way: in the middle of a war between Russia and Ukraine, the war exclusion itself is likely to bite before the impacted state test does.
Textbook case: a state-backed cyberattack paralyzes for 72 hours the interbank clearing system of a small EU member state. Transfers become impossible. Financial institutions are an essential service under the LMA definitions, so that state becomes an impacted state. Insureds whose systems are located in that state see their claims excluded under LMA 5566 and 5567 (but not the bystanding write-back under 5567A for systems located outside that state). Dated case: on December 12, 2023, an attack attributed by Ukrainian services to the Sandworm group of Russian military intelligence took down the network of Kyivstar, Ukraine's largest mobile operator. Some 24 million subscribers lost phone and internet service for several days.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.