Stuxnet
A computer worm discovered in 2010 that destroyed Iranian uranium enrichment centrifuges, the first public proof that a state cyber operation can cause physical damage.
Stuxnet is a computer worm discovered in June 2010, designed to sabotage Iran's Natanz uranium enrichment site. It targeted programmable logic controllers from one specific manufacturer, altered the rotation speed of the centrifuges until they were damaged, and fed operators normal readings to conceal the attack. It crossed the network's air gap through removable media and exploited several previously unknown vulnerabilities. Its attribution to a joint operation by the United States and Israel is widely accepted, though never officially acknowledged. For insurance, Stuxnet established two ideas. The first is that code can produce direct physical damage, which brings cyber into property policies and underpins the whole question of silent cyber in industrial risks. The second is that such damage, when it serves one state's policy against another, sits at the junction of sabotage, war and terrorism, and that exclusions written for kinetic war say nothing clear about it.
Public estimates hold that about a thousand centrifuges at Natanz had to be replaced between late 2009 and early 2010, out of some nine thousand installed, a little over ten percent of the fleet, without a single explosive device being used.
Stuxnet, Stuxnet worm, Olympic Games
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.