Hack-and-leak operation
An operation that steals documents in order to publish them at the most damaging moment, often to sway an election, whose harm lies in reputation and liability rather than interruption.
A hack-and-leak operation combines two moves: intrusion into a target's mailboxes or servers, then calculated publication of what was stolen, sometimes mixed with forgeries, on platforms chosen for their audience. The aim is not money, unlike double extortion, but influence: discrediting a candidate, a party, a company or an institution at the moment when publication will do the most harm. Such operations are frequently attributed to intelligence services, which places them squarely at the junction of cyber and political risk. For insurance, the harm falls on covers that a cyber policy treats as secondary: crisis management and communication costs, liability for third-party personal data contained in the leaks, reputational harm, sometimes directors' liability. Business interruption is slight, and the loss can look modest in direct costs while its political effect is considerable. The war exclusion question arises, but rarely decisively, absent an armed conflict.
On May 5, 2017, a few hours before the official end of the French presidential campaign, about nine gigabytes of emails and documents from Emmanuel Macron's team were published online, mixed with forgeries. In October 2020, US prosecutors indicted six Russian military intelligence officers for a series of operations including that 2017 campaign and NotPetya.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.