War and state-backed attack exclusions in cyber policies

Most cyber policies exclude losses caused by war, and many also exclude cyber attacks that are "state-backed," meaning carried out by or for a government. The wording varies enough to change the result: one version excludes only attacks that seriously damage a nation's essential functions, another reaches any attack attributed to a government. The only major U.S. appellate ruling on the issue, Merck v. ACE American in 2023, favored the policyholder, but it interpreted an older property policy exclusion and does not control a modern cyber clause.

Where the exclusion comes from

War exclusions are old. The standard ISO commercial property causes of loss form, CP 10 30 (09 17 edition, as published in a New York state sample), excludes loss from war, including undeclared or civil war; warlike action by a military force, including action by any government, sovereign or other authority using military personnel or other agents; and insurrection, rebellion or revolution. That language was written for armed conflict. It says nothing about malware, and insurers began citing similar clauses after state-linked cyber attacks started destroying data at commercial companies. Manuscript and carrier cyber forms use their own wording, so the exclusion in your policy may look nothing like this one.

The NotPetya cases

In June 2017 the NotPetya malware spread from Ukrainian accounting software to companies worldwide. On February 15, 2018, the White House stated that the Russian military launched the attack and called it the most destructive and costly cyber attack in history. Two companies with large claims faced war exclusion defenses:

• Merck. The drug maker claimed about $700 million (reported as $699,475,000 in disputed coverage) under property policies containing a hostile or warlike action exclusion. A New Jersey trial court ruled for Merck in January 2022. On May 1, 2023, the Appellate Division affirmed (475 N.J. Super. 420). As Claims Journal reported, the panel held the exclusion applies when military action is involved and that treating a non-combatant company's loss as "hostile" would stretch the term beyond its context, contrary to the rule that exclusions are read narrowly. The insurers sought review in the state supreme court, but the parties settled in January 2024 on confidential terms.
• Mondelez. The snack maker, which had no standalone cyber policy, claimed losses well above $100 million under a property policy. Zurich treated the attack as state-backed and invoked its war-related exclusions. The Cook County, Illinois case settled in late October 2022, on the last day of a multi-week jury trial, on undisclosed terms (Insurance Business).

Neither case produced a ruling on a modern cyber policy. Merck is persuasive on how courts read old language, but it was decided under one state's law and one set of words.

How the market rewrote the clauses

Insurers responded by drafting explicit state-backed exclusions. In August 2022, Lloyd's Market Bulletin Y5381 required that, from March 31, 2023, standalone cyber policies written at Lloyd's include a state-backed cyber attack exclusion unless Lloyd's agreed otherwise. As a minimum the clause had to:

1. exclude war, declared or not, if the policy has no separate war exclusion;
2. exclude state-backed attacks that significantly impair a state's ability to function or its security capabilities;
3. say whether systems located outside an affected state are excluded;
4. set out a basis for attributing an attack to one or more states; and
5. define its key terms.

The Lloyd's Market Association published model clauses to meet the requirements. Outside Lloyd's, U.S. carriers draft their own, and they differ. A 2026 Insurance Business report quoting Marsh said clients with several layers of cover sometimes face five or more different war exclusion wordings in a single tower, which can leave gaps between layers.

Reading a modern clause

What the 2026 events add

In March 2026 an attack on the medical device maker Stryker, which an Iran-linked group claimed, was described by Insurance Business as a test case for war exclusion wordings. According to that report, the attack was destructive rather than a ransom play, and attribution was the central difficulty. We found no reported coverage ruling arising from it. Treat it as a reminder that the exclusions matter most for destructive attacks and for events that spread, not for ordinary criminal ransomware.

That is the practical view for a small or mid-size business. Most attacks you face come from criminals seeking money, and an exclusion that requires attribution to a government rarely applies. The exposure is real but concentrated: wiper malware, a compromised software update that reaches thousands of customers, and attacks timed to a geopolitical event.

A hypothetical: one attack, two clauses

Say a 40-person logistics company installs a routine update to its accounting software. The update carries destructive malware that wipes servers at hundreds of firms. Seven weeks later, a government publicly attributes the campaign to another country's intelligence service. The company's loss is $900,000 in rebuilding and lost income. This is an invented example.

• Clause A excludes state-backed attacks only if they significantly impair a state's ability to function. The campaign hit private firms and no essential government functions. The insurer would have to show the threshold was met, and the exclusion may not apply.
• Clause B excludes any loss arising from an attack attributed to a government. With the public attribution, the insurer has a strong basis to deny the whole $900,000.

The two policies could have the same limit and premium. The difference is a few lines in the exclusions section that are rarely read at placement. Note also the timing problem: for seven weeks nobody knew who was behind the attack, and a claim in that period can be handled under a reservation of rights while attribution is pending.

What to do at placement and renewal

1. Ask your broker for the full war and state-backed exclusion text and read it next to the definitions of "cyber operation," "state" and "attribution."
2. Request a threshold-based clause rather than "any state-backed" wording, and ask for a carve-back for collateral damage and for attacks on systems outside an affected state.
3. Check that the clause does not use causation words broader than the rest of the policy.
4. Compare the exclusions across every layer of an excess tower so a gap does not open between layers.
5. Check your property and general liability policies. They carry their own war exclusions, and cyber-caused physical damage may fall between policies (common cyber insurance exclusions).
6. Ask the carrier in writing how it would handle a claim while attribution is unresolved.

cyber insurance: what it covers for a business puts these exclusions in the context of the whole policy, and the cyber insurance market: capacity, pricing and appetite covers how carriers are changing terms.

Key takeaways

• Cyber war and state-backed exclusions differ widely. A threshold clause is much narrower than a clause that excludes any attack attributed to a government.
• The Merck decision (N.J. App. Div., 2023) read an older exclusion narrowly, but it settled and does not decide how a modern cyber clause will be treated.
• Lloyd's has required state-backed attack exclusions in standalone cyber policies since March 31, 2023, and many other carriers have adopted their own versions.
• Attribution, causation language and tower consistency are the points to negotiate.
• For most small businesses criminal attacks dominate, but destructive and widespread attacks are where the exclusion decides the claim.