View source for Definition:Nation-state cyber attack

🌐 '''Nation-state cyber attack''' is a cyber operation planned, directed, or substantially supported by a sovereign government, targeting organizations, infrastructure, or data systems for espionage, disruption, or strategic advantage — and it has become one of the most consequential [[Definition:Exposure | exposure]] challenges in modern [[Definition:Cyber insurance | cyber insurance]] underwriting. These attacks are distinguished from ordinary cybercrime by their sophistication, persistence, and the resources behind them, with threat actors backed by intelligence agencies or military units of countries such as Russia, China, North Korea, and Iran. For the insurance industry, the critical question is whether losses from such attacks trigger the [[Definition:War exclusion | war exclusion]] commonly found in both traditional and cyber policies.

⚔️ The interaction between nation-state attacks and policy language has been fiercely litigated. The landmark dispute between Merck and its [[Definition:Property insurance | property insurers]] over the 2017 NotPetya malware — widely attributed to Russian military intelligence — brought the issue into sharp focus: carriers invoked war exclusions, while the insured argued the exclusions were drafted for conventional armed conflict, not cyber operations. Courts have reached varying conclusions, prompting [[Definition:Lloyd's of London | Lloyd's of London]] to mandate updated [[Definition:War exclusion | war and cyber operation exclusion]] clauses across its market beginning in 2023. These clauses attempt to distinguish between nation-state attacks that are part of a declared or undeclared war and those that are not, introducing attribution as a critical underwriting and [[Definition:Claims management | claims]] variable. [[Definition:Underwriter | Underwriters]] now scrutinize geopolitical risk alongside technical threat intelligence when pricing [[Definition:Cyber insurance | cyber]] portfolios.

🛡️ The rise of nation-state cyber threats has reshaped the entire [[Definition:Cyber risk | cyber risk]] ecosystem. [[Definition:Reinsurance | Reinsurers]] and [[Definition:Insurance-linked security (ILS) | ILS]] markets are recalibrating their appetite for [[Definition:Systemic risk | systemic]] cyber scenarios that could trigger correlated losses across thousands of [[Definition:Policyholder | policyholders]] simultaneously. [[Definition:Catastrophe modeling | Catastrophe modeling]] firms have developed dedicated nation-state attack scenarios, and [[Definition:Insurance regulator | regulators]] are asking carriers to demonstrate they can withstand aggregation events of this scale. For [[Definition:Insurtech | insurtech]] companies building cyber products, clear and defensible policy language around nation-state activity is no longer optional — it is a prerequisite for securing [[Definition:Reinsurance | reinsurance]] backing and maintaining market credibility.

'''Related concepts'''
{{Div col|colwidth=20em}}
* [[Definition:Cyber insurance]]
* [[Definition:War exclusion]]
* [[Definition:Systemic risk]]
* [[Definition:Catastrophe modeling]]
* [[Definition:Cyber risk]]
* [[Definition:Attribution (cyber)]]
{{Div col end}}