Wiper malware
Malware designed to destroy or render data irrecoverable, with no intent of ransom, often for sabotage or geopolitical ends.
On August 15, 2012 the Shamoon malware wiped the disks of about 30,000 Saudi Aramco workstations; the company recovered nothing and had to buy replacement hardware. A wiper is malware built to destroy, with no aim of financial gain. Ransomware encrypts data to release it against payment; the wiper irreversibly destroys or corrupts files, sometimes the systems themselves, and leaves no prospect of recovery. Its logic is sabotage. It is frequently associated with geopolitical motives or conflicts, and deployed to paralyze adversaries' infrastructure. Some wipers disguise themselves as ransomware to blur attribution and sow confusion: they display a sham ransom demand while the data are already destroyed. NotPetya in 2017 remains the reference case. Under the guise of ransomware, it wiped the data of countless companies worldwide and caused billions of dollars in damage. For insurance, the wiper piles up difficulties. The damage reaches catastrophic scale, and the impossibility of recovery aggravates business interruption. Above all, state attribution can trigger war exclusion clauses, and it is what fueled the debate on silent cyber.
Textbook case: a global logistics company sees, in a matter of minutes, all of its systems wiped by malware spread through a booby-trapped software update. Rebuilding takes weeks, and the insurer invokes a possible state attribution to dispute the application of the war exclusion.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.