Essential service
A service essential to the maintenance of vital functions of a sovereign state, including financial institutions, health services and utility services, whose disruption may trigger the impacted state qualification.
On December 23, 2015, three electricity distributors in western Ukraine lost control of their substations: around 225,000 customers went dark for several hours, and the attack was attributed to Sandworm, a GRU unit. That is the kind of hit LMA 5565, 5566 and 5567 have in mind when they talk about an essential service. The clauses define it as a service essential to the maintenance of vital functions of a sovereign state, "including but not limited to" financial institutions and associated financial market infrastructure, health services and utility services. The list is open-ended, by design. The term is the hinge of the impacted state definition: a state only becomes impacted if the cyber operation had a major detrimental impact on the availability, integrity or delivery of an essential service, or on its security or defense. A state-backed operation that reaches neither an essential service nor defense makes no state an impacted state, and losses of insureds whose systems sit there fall outside that limb of the exclusion. Where the line falls is the open question, and the wording does not draw it. Is a regional grid outage enough? A mid-size banking network? Since Lloyd's Market Bulletin Y5381 of August 2022, which requires syndicates to exclude state-backed cyber attacks from March 31, 2023, the answer decides how much accumulation an underwriter keeps on the book.
The 2015 attack on the Ukrainian power grid, attributed to the Sandworm group linked to the GRU, cut power to hundreds of thousands of customers. The electricity network falls within the utility services listed in the LMA definition. Had the attack occurred after 2023, it would likely have qualified Ukraine as an impacted state under LMA clauses 5565 to 5567.
essential service, critical infrastructure, critical national infrastructure
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.