Glossary

War exclusion

A clause removing losses caused by war, military action and similar hostilities, which cyber policies now stretch to attacks backed by a nation-state.

Also called: war and military action exclusion, warlike action exclusion, state-backed cyber attack exclusion, hostile or warlike action

Nearly every property and liability policy excludes loss from war, whether declared or not, along with warlike action by a military force, insurrection, rebellion and revolution. The ISO special form (CP 10 30) lists it with other large-scale perils the market cannot price, because a war loss would hit many insureds at once.

Cyber attacks made the clause contested. Merck's property insurers cited a hostile or warlike action exclusion against its losses from NotPetya, malware widely attributed to Russia. In May 2023 the New Jersey Appellate Division held that the exclusion did not apply (Merck v. ACE American), and the insurers settled in January 2024 before the state supreme court could rule.

The market responded by rewriting the exclusion. Lloyd's Market Bulletin Y5381 (August 2022) required stand-alone cyber policies written at Lloyd's from March 31, 2023 to exclude war and state-backed attacks that significantly impair a state's functioning or security, and other insurers adopted similar clauses. Open questions follow: who attributes an attack to a state, how "significant impairment" is judged, and whether collateral damage to systems outside the affected state is excluded. Negotiate a carve-back for collateral damage and have the wording reviewed before binding. Terrorism is handled separately; see Terrorism Risk Insurance Act. The guide on war and state-backed attack exclusions in cyber policies compares the common wordings, and the exclusion entry explains how exclusions are read.

Last reviewed October 10, 2026

In the index now

Related terms

Exclusion A policy provision that removes coverage for specified perils, property, people or types of loss that the insuring agreement would otherwise include. Ransomware Malicious software that locks or encrypts a victim's data or systems and demands payment for the key, often with a threat to publish stolen files. Terrorism Risk Insurance Act (TRIA) The 2002 federal law, run by Treasury, that backstops insurers' losses from certified terrorist attacks and requires them to offer terrorism coverage. Cyber extortion A demand for payment backed by a threat to encrypt, destroy or publish your data or disrupt your systems, and the cyber policy coverage that responds to it.

Related guides

Commercial property exclusions: what the standard policy won't pay The ISO special form covers direct physical loss unless excluded. The exclusions that fail claims, how the three tiers read, and where each gap is bought back. Common cyber insurance exclusions The cyber policy exclusions that matter most, from prior knowledge and war to infrastructure, contracts and web tracking, and the carve-backs that help. War and state-backed attack exclusions in cyber policies What cyber war and state-backed attack exclusions say, how the NotPetya cases and Lloyd's 2023 rules shaped them, and what to check in your policy wording. Event cancellation insurance: what it covers and what it leaves out Event cancellation insurance repays the net loss when a conference, festival or show is cancelled or moved for a covered cause. Triggers and exclusions. Kidnap, ransom and extortion insurance What K&R insurance covers beyond the ransom itself, who buys it, why the policy is confidential, and the sanctions and legal limits on paying. Political risk insurance: what it covers and who needs it Political risk insurance covers expropriation, blocked currency transfers, government contract breach and political violence abroad. Who writes it, how to buy.