Cyberattack causing property damage: Who pays?

Cyberattacks have recently made the headlines, involving the manipulation of networked refrigeration systems in the food sector. Instead of cooling, the systems – switched to ‘defrost mode’ – heated up to 50 degrees Celsius. Tons of food went off. Whilst such incidents had previously occurred in other European countries, the cyberattacks have now also targeted supermarkets and cold stores in Germany.

This scenario is indicative of a wider trend. Cyberattacks are no longer confined to the digital realm. Anyone capable of manipulating control systems to cause goods to spoil can also destroy machinery, start fires and cause even worse damage.

This raises the question of which insurance policy covers such property damage.

I. Where existing policies fall short

It would seem obvious to turn to cyber insurance in this situation. However, this insurance does not usually cover property damage.

According to the GDV model terms and conditions ‘AVB Cyber’, for example, this insurance only covers pure financial losses – that is, losses that are neither personal injury nor property damage, nor are they directly derived from such losses. Spoilt refrigerated goods are therefore not covered.

It may be doubtful whether cover exists under a property insurance policy. This depends, amongst other things, on the nature of the damage incurred.

If, for example, a cyber attack causes a fire or an explosion, cover is usually provided under property insurance. This is because it is generally irrelevant how the insured risk was caused.

However, the coverage situation is less clear if a cyber attack does not result in an insured fire, but rather, for example, in the mere spoilage of food.

In some branches of property insurance, for example in accordance with Clause A1-3.2 of the General Conditions for Bundled Industrial Property Insurance (AGiS 2024), malicious damage to insured property is an expressly insured risk. A prerequisite for insurance cover, however, is that the damage is directly caused by the malicious act. It may be doubtful whether this is the case with a cyber attack.

In the case of all-risk cover schemes for unnamed perils (e.g. in accordance with Clause A1-14.1.1 of AGiS 2024), cover is more likely to apply. However, there are specific exclusions here for damage to stock caused by the failure or malfunction of air-conditioning, refrigeration or heating systems (e.g. clause A1-14.2.3(b) AGiS 2024).

Furthermore, it must be examined on a case-by-case basis whether the specific set of terms and conditions in use provides for specific exclusions relating to cyber-related causes of damage. Such exclusions are becoming increasingly common. The insurance industry is seeking to exclude so-called ‘silent cyber’ risks from traditional property insurance as a matter of principle.

II. Identifying and closing gaps in cover

The first step is to take stock of the situation. Property insurance policies should be reviewed for cyber exclusions, and cyber policies should be checked to see whether they include cover for property damage.

If a gap is identified, it may be possible to close it. Some cyber policies expressly provide cover for property damage. Alternatively, it may be possible to negotiate specific cover provisions within the property insurance policy or, conversely, exceptions to cyber exclusions.

Finally, for particularly sensitive goods, specialised goods damage insurance may also be advisable. In the case of defrosted foodstuffs, for example, refrigerated goods insurance may be an option. It is important that this also covers tampering with the system by third parties and does not contain a cyber exclusion.

We would be happy to assist you in reviewing and negotiating insurance arrangements, as well as in the event of a claim.