Cyber Risk and the Global Insurance and Reinsurance Markets

Introduction

On June 27, 2017, malware concealed in an update of a Ukrainian accounting software package spread within hours to the networks of multinational companies on every continent. The NotPetya episode, whose global cost is commonly estimated at around ten billion dollars,² revealed three realities that insurance law had not yet absorbed. First, a single triggering event can hit thousands of insureds at once, regardless of borders. Second, computer risk had settled, unpriced, into property and liability policies that did not address it. Third, attributing an attack to a state raises a coverage question worth hundreds of millions of dollars per insured.

Nearly ten years later, cyber insurance is a market in its own right. Munich Re estimates global premiums at nearly USD 15 billion in 2025 and expects them to double by 2030.³ Yet the market remains young, concentrated and legally unsettled. Its contracts are not standardized as marine insurance contracts are; its key exclusions have been rewritten under pressure from the London market's own regulator; its claims process borrows as much from crisis management as from insurance law; and its losses are resolved before courts and authorities in several countries at once.

This Article proposes a comprehensive legal framework for analyzing cyber risk from the standpoint of the insured, the insurer, the reinsurer and their counsel. After characterizing cyber risk and its manifestations (Part I), it analyzes underwriting and policy architecture (Part II), then the identity of insureds, public or private, and the territorial reach of coverage (Part III). It next examines the specific claims-handling process by type of attack (Part IV), the role of criminal complaints and regulatory notifications (Part V), and the lawyer's role in defense and recovery (Part VI). Finally, it considers the reinsurance of cyber risk and its transfer to capital markets (Part VII), before offering a perspective from Moroccan law and emerging markets (Part VIII).

I. Cyber Risk as a Distinctive Insurable Risk

A. Definition and Characteristics

Cyber risk may be defined as the risk of loss, expense or liability arising from a breach of the confidentiality, integrity or availability of an organization's information systems and data, whether malicious or accidental. Security professionals refer to this triad by the acronym CIA (confidentiality, integrity, availability), which supplies the substantive criterion common to most coverage triggers.

Four features make cyber risk a distinctive object of insurance. It is, first, intangible: it affects data and services rather than tangible property, which places it outside property policies built on the concept of physical loss or damage. It is, second, dual: a single attack causes the victim its own loss (first-party loss) and exposes it to liability toward others (third-party liability), so that a cyber policy necessarily combines first-party and liability insurance. It is, third, adversarial and evolving: unlike natural perils, it is generated by an adversary who adapts to defenses, quickly rendering loss histories obsolete. It is, fourth, potentially systemic: a software vulnerability, the compromise of a shared vendor or the failure of a cloud provider can trigger a cluster of correlated losses, an accumulation phenomenon that is the reinsurers' foremost concern.

This last feature materialized on July 19, 2024, when a defective update from a security vendor crashed some 8.5 million Windows devices. Verisk PCS designated the non-malicious incident a cyber catastrophe event, and estimates of insured loss ranged from a few hundred million to roughly USD 1.5 billion.⁴ Parametrix estimated direct losses for the Fortune 500 alone (excluding Microsoft) at USD 5.4 billion, of which only 10 to 20 percent would be insured, owing to large retentions and low limits.⁵ The gap between economic and insured loss, the protection gap, is a structural feature of the market.

B. A Typology of Attacks and Incidents

The technical characterization of an incident determines which coverage responds, how the claim is handled and what the insured's legal obligations are. A precise typology is therefore required. Table 1 maps each type of incident to the coverage it typically triggers.

Table 1. Types of Cyber Incidents and Coverage Triggered

Two observations follow. First, the categories overlap: modern ransomware is almost always a data breach as well, which simultaneously triggers first-party and liability coverage, along with notification duties. Second, the legal characterization (a personal data breach under data protection law, an offense against an automated data processing system under criminal law) does not necessarily coincide with the contractual one (security breach, privacy event, cyber event, depending on the wording). Because insurance is governed by the parties' agreement within the limits of public policy, the contractual definition of the triggering event prevails, which is why definitions must be negotiated at placement.

The concept of a data breach deserves particular attention, since it runs through the entire body of litigation. The EU General Data Protection Regulation (GDPR) defines it as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data.⁶ This definition, adopted or extended to corporate confidential information in most policies, calls for four remarks: mere access suffices, without proof that the data were exploited; an impairment of availability alone (encryption without exfiltration) is a breach; human error is covered as well as malicious acts; and the incident may stem from a processor's act, opening the door to recovery actions.

C. The Global Market: Volumes, Players and Dynamics

According to Munich Re, the global cyber insurance market stood at roughly USD 15 billion in premiums in 2025, with growth slowing markedly over the past three years after an exceptionally steep rise.⁷ Swiss Re projects roughly USD 16.4 billion for 2026.⁸ North America accounts for roughly two-thirds of premiums; Europe is growing; Africa, Latin America and much of Asia remain underinsured. The pricing cycle has turned: after the 2021-2022 increases driven by the ransomware wave, rates fell in 2024 and 2025 as abundant capacity entered the market, even though claims frequency remains high.

Table 2. Leading Players in the Global Cyber Insurance and Reinsurance Market

Reinsurance concentration is a defining trait: according to Howden Re, the top five cyber reinsurers write 62 percent of premiums and the top ten, 87 percent.⁹ This concentration gives reinsurers, and the Lloyd's market, a de facto normative power over the terms offered by all direct insurers: exclusions required by reinsurers cascade down into the policies purchased by businesses worldwide.

II. Underwriting and Contract Architecture

A. Underwriting: From Risk Disclosure to Technical Audit

Cyber underwriting has been transformed. The traditional proposal form is now supplemented by an external technical analysis of the applicant's exposure (scanning of its internet addresses, known vulnerabilities, open ports, email configuration) and by minimum security requirements that condition access to coverage: multi-factor authentication (MFA) for remote access and privileged accounts, endpoint detection and response (EDR) tools, offline and tested backups, a patching policy, network segmentation and anti-phishing training.

These representations are not a formality. The general law of risk disclosure attaches severe sanctions to inaccuracies, and U.S. practice has provided a notable illustration: in 2022, Travelers sought rescission of a cyber policy in federal court in Illinois on the ground that the insured had falsely represented that it used multi-factor authentication; the insured agreed to the rescission.¹⁰ The lesson is twofold: the security representation is material to the assessment of the risk, and its wording must be verified by the insured's technical teams, not merely by its legal or finance functions.

Disclosure also affects prior acts. Policies exclude incidents known to the insured before inception or predating a retroactive date. Yet an intrusion may go undetected for months: an attacker already present in the system at inception creates a risk of dispute over prior knowledge, which the continuity date (the date of first uninterrupted coverage) helps to contain.

B. The Myth of a “Standard Lloyd’s Policy” and the Reality of Wordings

Contrary to a widespread belief, there is no standard cyber policy imposed by Lloyd's. Each syndicate or carrier uses its own wording, often protected by copyright, and Lloyd's regulates only certain aspects of it. Lloyd's exercises its normative role through market bulletins binding on the managing agents of syndicates, and through the model clauses of the Lloyd's Market Association (LMA), which are optional but serve as a reference for the global market. As early as 2022, the Lloyd's wordings repository held more than three hundred cyber-related clauses.¹¹

Despite the diversity of wordings, a common architecture has emerged. The standalone cyber policy groups, in separate insuring agreements each with its own limit, retention and sometimes trigger, first-party and liability coverages, together with a breach response service. Table 3 sets out the typical structure.

Table 3. Typical Architecture of a Standalone Cyber Policy

C. Technical Mechanisms of the Contract

A cyber policy combines several temporal regimes. Liability coverages generally operate on a claims-made and reported basis, while first-party coverages are triggered by discovery of the incident. The coexistence of these two triggers within a single contract creates difficulties when an incident is discovered in one policy period and third-party claims arise in another, particularly upon a change of carrier.

Business interruption is governed by specific parameters: a waiting period, generally a few hours, below which no loss is indemnified and which operates as a time deductible, and an indemnity period, which caps the duration of coverage. After the July 2024 incident, Guy Carpenter noted that waiting periods in the market typically ranged from four to twelve hours, which significantly limited insured losses.¹²

Claims handling is framed by clauses that give the insurer broad control over the crisis. The panel vendors clause requires or strongly encourages the insured to use the lawyers, forensic investigators, negotiators and communications firms pre-selected by the insurer. The consent clause prohibits the insured from incurring costs, admitting liability or settling without the insurer's consent. The hammer clause caps the insurer's exposure at the amount of a recommended settlement that the insured refuses. Finally, the related claims or single claim clause aggregates incidents arising from the same cause into one claim, subject to a single retention and a single limit, which may favor or disadvantage the insured depending on the structure.

Limits are expressed as an annual aggregate limit with sublimits per insuring agreement, and defense costs are usually within limits, so that defense spending erodes the capacity available for indemnity. For large risks, capacity is organized in towers of primary and excess layers written by different carriers, each in principle following the form of the primary. The consistency of the tower, notably as regards war exclusions, is a major placement issue.

D. Exclusions and the Decisive Question of State-Backed Attacks

Cyber policies contain the classic exclusions of liability and first-party insurance (intentional misconduct of senior management, bodily injury and property damage, which are left to traditional policies, contractual liability beyond legal liability, intellectual property outside media coverage, and betterment). To these are added risk-specific exclusions: failure of essential infrastructure (power grids, telecommunications, the internet, satellites), failure to patch a known vulnerability within a set period in some wordings, and, above all, the war and state-backed cyber attack exclusion.

This last exclusion was shaped by the NotPetya litigation. In Merck, the drugmaker's property insurers invoked a traditional hostile or warlike action exclusion; in 2023 the New Jersey Appellate Division refused to apply it, holding that the clause, designed for conventional warfare, did not reach cyber operations.¹³ The parties settled in January 2024 on the eve of argument before the New Jersey Supreme Court, leaving the appellate ruling intact.¹⁴ The parallel dispute between Mondelez and Zurich, concerning a claim of about USD 100 million under a property policy, settled mid-trial in October 2022 without creating precedent.¹⁵

The market responded through standard-setting. On November 25, 2021, the LMA published four model clauses, LMA5564 to LMA5567, graduating the exclusion of war and cyber operations.¹⁶ Lloyd's Market Bulletin Y5381 of August 16, 2022 then required all standalone cyber policies within risk codes CY and CZ to include, from March 31, 2023, an exclusion for state-backed cyber attacks, either separate from or combined with the war exclusion.¹⁷ The bulletin sets minimum requirements: excluding losses arising from war, whether declared or not; excluding state-backed attacks having a major detrimental impact on the functioning or security of a state; clarifying the treatment of computer systems located outside the affected state; and setting out a robust basis for attributing the attack to a state. The model clauses essentially rely on the determination of the government of the affected state for attribution.¹⁸ Bulletin Y5433 of June 2024 refined the regime and classified clauses into four types, the broadest (Type 4), which covers state-backed attacks conducted as part of a conventional war, being reserved for syndicates approved as "advanced" and to renewal business only.¹⁹

These clauses raise three legal difficulties that scholarship has yet to exhaust. The first concerns attribution: attributing a cyber attack to a state is a political act, often belated and sometimes never formalized, and there is a paradox in a private contract making coverage depend on a government's diplomatic position. The second concerns the notion of a "major detrimental impact" on a state's functioning, which is undefined and will require judicial or arbitral interpretation.²⁰ The third concerns the burden of proof: under general insurance law, the insurer invoking an exclusion must prove its conditions, which, applied to an attack attributed by intelligence services on the basis of classified evidence, poses a considerable evidentiary problem.

E. Silent Cyber and the Clarification of Traditional Policies

Silent or non-affirmative cyber refers to computer-risk exposure embedded in traditional policies (property, general liability, crime, marine, aviation) that neither expressly cover nor exclude it. Merck and Mondelez both concerned property policies. Prompted by the U.K. Prudential Regulation Authority, Lloyd's required that, for all policies incepting on or after January 1, 2020, cyber exposure be either expressly granted or expressly excluded.²¹ In property insurance, LMA5400 (Property Cyber and Data Exclusion) and its companion LMA5401 have become benchmarks. The result is a clearer boundary but also a heavier responsibility for brokers and risk managers, who must ensure that an exclusion inserted in a traditional policy is matched by dedicated cyber coverage.

III. Who Is Insured? Public Entities, Private Entities and Transnational Reach

A. A Product Designed First for the Private Sector

Cyber insurance developed for private businesses, and first for large North American companies exposed to class actions and notification duties. Financial institutions, healthcare providers, retailers and digital service companies are its leading buyers. Penetration remains low among small and medium-sized enterprises, particularly outside North America, as the converging estimates of major brokers show. Nothing in the contractual technique, however, confines this insurance to the private sector.

B. Insuring States, Administrations and Local Governments

Public entities can buy cyber insurance, and many do. In the United States, municipalities, school districts, public hospitals and utility districts are significant buyers, to the point that rising premiums led many local governments to form cyber risk pools, a development S&P Global Ratings regards as favorable.²² Insurers offer dedicated programs for public entity pools, on both a direct and a reinsurance basis.

The central state, by contrast, generally self-insures, for three reasons. The first is economic: the state's financial capacity and portfolio of risks make self-insurance rational. The second is legal: many national laws strictly regulate, or even preclude, insurance of the risks of the state and its central administrations. The third lies in the nature of the risk: attacks on states are frequently carried out by other states, which the exclusions discussed above precisely remove from coverage. Market cyber insurance thus faces a paradox: the entities most exposed to state-backed attacks are those it covers least.

Public policy accentuates this distinctiveness. In July 2025, the United Kingdom confirmed its intention to prohibit ransom payments by all public sector bodies, including local governments, and by operators of critical national infrastructure, and to create a payment prevention and reporting regime.²³ Several U.S. states, including North Carolina and Florida, already bar their public entities from negotiating with ransomware actors. For such entities, extortion coverage loses its purpose, and insurance refocuses on incident response, restoration and liability.

The question of catastrophic risk remains. A lively debate concerns public-private partnerships modeled on Pool Re for terrorism in the United Kingdom or the U.S. Terrorism Risk Insurance Program, in which the private market would absorb losses up to a threshold and the state would intervene above it.²⁴ The argument is familiar: absent an organized mechanism, the state remains the de facto insurer of last resort, without dedicated resources or rules.

C. The Transnational Reach of Coverage

Cyber risk ignores borders: a single incident affects systems, data and individuals located in several countries, and the attacker usually operates from a third jurisdiction. Cyber policies of the major carriers therefore offer worldwide territorial scope, subject to international sanctions. This contractual reach, however, meets three legal limits.

The first concerns licensing rules. Most states require that risks located in their territory be insured by locally licensed insurers, which in principle prevents a non-admitted foreign insurer from indemnifying a local subsidiary directly. International programs are therefore organized around a master policy and local policies issued by admitted insurers, which are reinsured by the program's lead carrier through fronting. Where a local policy cannot be issued or is insufficient, the master policy may indemnify the parent company for the financial loss represented by its subsidiary's claim under a financial interest clause, whose lawfulness must be verified country by country.

The second concerns international sanctions. London market policies include a sanction limitation and exclusion clause, whose reference version is LMA3100, relieving the insurer of any performance that would expose it to sanctions or prohibitions under United Nations resolutions or the sanctions regimes of the European Union, the United Kingdom or the United States. The clause takes on particular significance for ransom payments, discussed below.

The third concerns governing law and dispute resolution. London market policies are usually governed by English law with a jurisdiction or arbitration clause. Local policies are subject to the mandatory law of the issuing state, which may include substantive public policy provisions, such as the French mandatory complaint requirement discussed below. Practitioners must therefore reason simultaneously under several legal orders: that of the master policy, that of the local policy, and those of the countries where the data and affected individuals are located.

IV. The Specific Claims-Handling Process

A. Crisis Management Rather Than Loss Adjustment

Handling a cyber claim differs radically from handling a conventional property claim. In the latter, the insured reports a completed loss, the adjuster assesses it and the insurer pays. In cyber, the loss is an ongoing process at the time of notice: the attacker may still be in the system, data may still be leaking, operations may be interrupted, and every hour of delay aggravates the harm. The insurer therefore does not merely indemnify: it organizes, funds and partly directs the incident response through its panel vendors. Cyber insurance is, in this sense, as much a service as an indemnity.

This feature has two legal consequences. First, notice must be immediate: policies provide a 24/7 hotline and short notice periods, breach of which may lead to forfeiture or reduction of coverage depending on the governing law. Second, costs incurred before notice or without the insurer's consent, notably with non-panel vendors, are exposed to denial, which imposes on the insured, from the first minutes, a procedural discipline its IT department may not be familiar with.

B. The Phases of a Claim

Table 4. Typical Timeline of a Cyber Claim

The investigation phase is the heart of the file, because its findings condition everything else: the scope of affected data determines notifications; the date of first intrusion determines the application of the retroactive date; the attack vector determines a vendor's possible liability and the accuracy of security representations; and the identification of the attacker determines the application of the state-backed attack exclusion and the lawfulness of any payment. The forensic investigator is thus, without the title, the expert whose report governs coverage, which explains the care taken over the status of that report (Part VI.A).

C. Specific Features by Type of Attack

1. Ransomware

A ransomware claim engages the entire policy. After containment, the insured must choose between restoring from backups, where they exist and are clean, and paying the ransom, which guarantees neither a working decryptor nor the destruction of exfiltrated data. Market data show a growing share of victims refusing to pay.²⁵ Where payment is contemplated, it is negotiated by a specialist negotiator, under the direction of the breach coach and with the insurer's prior written consent, after verifying that the recipient is not on any sanctions list.

This verification is no formality. In 2021, the Office of Foreign Assets Control (OFAC) of the U.S. Treasury reiterated that facilitating a payment to a sanctioned person exposes the facilitator, including insurers, financial intermediaries and incident response firms, to civil penalties on a strict liability basis, and that prompt reporting to and cooperation with authorities are significant mitigating factors.²⁶ English counter-terrorist financing law and European sanctions regimes produce comparable effects. The insurability of the ransom itself varies by country: French law now permits it on condition that a complaint is filed within 72 hours (Part V.A), while other laws do not in principle prohibit it but subject it to sanctions and anti-money laundering rules.

In practice, the insurer usually reimburses a ransom paid by the insured, often in crypto-assets acquired through a specialist intermediary, rather than paying it directly. Payment traceability (wallets, transactions, exchanges with the attacker) must be carefully documented, since it serves both as proof of loss and as a basis for possible seizures: in June 2021, U.S. authorities recovered part of the ransom paid by a pipeline operator, illustrating the value of cooperating with investigators.

2. Data Breach

A data breach claim is dominated by notification duties and liability exposure. The investigation must determine precisely which data were affected, relating to which individuals and in which countries, since each jurisdiction imposes its own deadlines, thresholds and content requirements. Breach response coverage funds the identification of affected individuals, mailings, the call center and credit and identity monitoring. Liability coverage then responds to claims by data subjects, which take the form of class actions in the United States and increasingly of representative actions in Europe, and to claims by business customers under the confidentiality and security clauses of their contracts.

3. Funds Transfer Fraud and Social Engineering

Fraud through business email compromise or impersonation, now reinforced by voice or video deepfakes of executives, is among the most frequent causes of loss. It lies at the boundary between the cyber policy and the crime policy, and insurers often confine it to a sublimit, with pre-transfer verification conditions (call-back to a known number, dual authorization). Settlement depends on speed: the recall request to the remitting and receiving banks, the judicial freezing of beneficiary accounts and the criminal complaint determine the chances of recovery and, therefore, the final amount of the loss.

4. Business Interruption, Malicious or Not

Business interruption is often the largest and most disputed head of loss. Quantification requires reconstructing what the business would have earned absent the incident, deducting saved expenses, accounting for the ramp-up period and separating what is attributable to the incident from other causes. A forensic accountant is invariably involved, and disputes over the indemnity period, the margin to apply or extra expense are frequent. Where the interruption originates with a vendor, dependent coverage responds only if the vendor falls within the contractual definition (IT provider, named supplier) and the cause (malicious or not) is covered, as the July 2024 incident made plain.

D. The Coverage Position and Coverage Litigation

Alongside crisis management, the insurer investigates coverage. It usually issues a reservation of rights letter, funding urgent costs while reserving the right later to invoke an exclusion or forfeiture. Recurring grounds of dispute include prior knowledge of the incident, inaccurate security representations, the application of sublimits, the infrastructure exclusion, the war exclusion, the calculation of business interruption and the treatment of costs incurred outside the panel. Depending on the policy, these disputes are resolved through litigation, mediation or arbitration, the latter being common in the London market and in international programs.

V. Criminal Complaints, Authorities and Notification Duties

A. The Criminal Complaint: An Option in Principle, a Duty by Exception

A cyber attack almost always constitutes a criminal offense: unauthorized access to or presence in an automated data processing system, interference with its operation, introduction or alteration of data, extortion, fraud. Must a complaint be filed in order to be indemnified? In principle, no: most national laws do not make insurance recovery conditional on a criminal complaint, and the matter is left to the contract, which frequently requires one for crime and extortion coverages as proof of loss.

French law is the exception. The Law of January 24, 2023 on the orientation and programming of the Ministry of the Interior (LOPMI) introduced Article L. 12-10-1 into the French Insurance Code, under which, since April 24, 2023, payment of any indemnity for loss or damage caused by an attack on an automated data processing system is conditional on the victim filing a complaint with the competent authorities no later than 72 hours after becoming aware of the attack.²⁷ The provision applies only to legal persons and to natural persons acting in a professional capacity; it is mandatory and applies without being reproduced in the policy; and it covers all coverages indemnifying a malicious attack, not merely the ransom.²⁸ The French Treasury has clarified its application to international programs and to attacks occurring outside France.²⁹ Reform proposals concerning the 72-hour period have also been debated.³⁰

Beyond any legal duty, a complaint has strategic value: it dates and formalizes the incident, allows investigators to seek international cooperation and the freezing of assets, enables the victim to join the criminal proceedings as a civil party, prepares the insurer's subrogated recovery and, in the eyes of sanctions authorities, evidences good faith. It also has drawbacks: partial loss of control over communications, disclosure of sensitive technical material and the risk that the investigation will reveal the insured's own failings. The decision belongs to the breach coach, in consultation with the insurer.

B. Regulatory Notification Duties

Distinct from the criminal complaint, notification duties have multiplied, with deadlines incompatible with an improvised response. Table 5 summarizes the principal regimes.

Table 5. Principal Incident Notification Regimes

Two practical rules follow. First, deadlines run from awareness of the incident, not from completion of the investigation, so that notifications must be made on incomplete information and later supplemented. Second, the various notifications do not substitute for one another: a criminal complaint does not dispense with notification to the data protection authority, as the French authorities have made clear,³¹ and a regulatory notification does not constitute notice of claim to the insurer. Their consistency must be ensured by a single counsel, since any contradiction among them will be exploited in subsequent litigation.

VI. The Lawyer in a Cyber Claim: Coordination, Defense and Recovery

A. The Breach Coach as Conductor of the Response

The breach coach is the lawyer appointed in the first hours, usually from the insurer's panel, to direct the legal response to the incident. The breach coach retains the forensic investigators and other vendors, characterizes the incident legally, determines notification duties in each jurisdiction, drafts or approves notifications and communications, advises on the complaint and any payment, and serves as the interface with the insurer. In international matters, the breach coach relies on a network of local counsel who must answer, within hours, three decisive questions: must we notify, may data be transferred for the investigation, and may we pay.

The rationale for this structure is the protection of privilege. By having counsel retain the investigators, the insured seeks to shield their work under the attorney-client privilege and the work product doctrine. U.S. case law has shown the limits of that protection. In Capital One, the forensic report was held discoverable because it would have been prepared in any event for business purposes and had been widely circulated within the company.³² In Clark Hill, the same result was reached for a report used for remediation and shared beyond the legal team.³³ Best practices are now settled: a separate engagement entered into by counsel, a documented litigation purpose, separation of the legal investigation from operational remediation, and restricted circulation of the report. In civil law systems the question arises differently, since professional secrecy covers the lawyer's own correspondence and advice but not necessarily third-party reports, which calls for comparable discipline over document flows.

B. Defending the Insured

In defense, the lawyer acts on three fronts. Before data protection authorities and sector regulators, the task is to demonstrate the adequacy of security measures and of incident management, in order to prevent or reduce penalties, whose insurability is itself uncertain: many legal systems, including French law according to part of the scholarship, regard insurance of criminal and administrative penalties as contrary to public policy, which explains the "where insurable by law" wording of policies. Before civil courts, the task is to resist individual and class actions by data subjects, notably by contesting the existence of certain harm and causation. In contractual relationships, finally, the task is to manage claims by customers and partners under security, confidentiality and service-level clauses.

C. Recovery

Recovery is often neglected, although it determines the final economics of the loss. Subrogated to the insured's rights up to the amount paid, the insurer may pursue the vendor whose failure enabled or caused the incident: software publisher, managed service provider, hosting provider, security vendor. Such actions run up against the limitation of liability clauses of IT contracts, whose validity must be tested against gross negligence or essential obligation doctrines under the applicable law. The victim and its insurer may also act through criminal proceedings, as civil parties, and seek the seizure of identified assets, notably crypto-assets. Lastly, the insured sometimes has a claim against its broker where the coverage gap results from a breach of the duty to advise, a hypothesis that the growing complexity of exclusions makes less theoretical.

D. Coverage Counsel

The breach coach, who serves incident management, must be distinguished from coverage counsel, who advocates the insurer's or the insured's position on the scope of coverage. Combining both roles in a single firm is a source of conflicts of interest: the breach coach, often on the insurer's panel, must nonetheless serve the insured's interests in managing the crisis. Large insureds therefore negotiate the right to choose their own counsel, with fees aligned on panel rates. The insured's counsel must, for its part, ensure from the first days that decisions taken in urgency do not jeopardize coverage.

VII. Reinsurance of Cyber Risk and Transfer to Capital Markets

A. Reinsurance Structures

Cyber reinsurance was historically built on proportional quota share treaties, under which the insurer cedes a fraction of its premiums and losses. This choice reflected uncertainty over modeling: quota share allowed reinsurers to support market growth without pricing extreme losses in isolation. The average quota share cession has, however, fallen from about 57 percent to 45 percent over five years according to Howden Re, in favor of non-proportional structures on a per-risk, per-event or aggregate stop-loss basis.³⁴ Gallagher Re expects demand for excess-of-loss capacity to nearly double by 2030.³⁵ This shift reflects growing confidence in models and insurers' willingness to retain more of their attritional losses.

B. Legal Issues Specific to Cyber Treaties

The move toward per-event excess of loss places the definition of an event and the aggregation rules at the heart of the treaty. In natural catastrophe reinsurance, the notion of an event is framed by tested hours and geographic clauses; in cyber, one must define what constitutes a single event when thousands of insureds are hit by the same vulnerability exploited by several attackers over several weeks. The drafting of these clauses determines the scope of the cedent's protection, and their interpretation is one of the market's major potential battlegrounds.

The war and state-backed attack exclusions recur at treaty level: in 2023 the LMA published model clauses for cyber treaty reinsurance.³⁶ Any mismatch between the direct policy and the treaty creates basis risk for the cedent, which may pay a loss its reinsurer refuses to follow. The classic follow the settlements, claims cooperation and claims control clauses also take on new significance: a reinsurer with claims control rights may find itself involved in decisions on ransom payments or settlements with third parties. These mechanisms call for an analysis of the legal nature of the reinsurance treaty, a contract independent of the underlying policy yet bound to it by a community of fate whose extent is fixed by the treaty's terms.³⁷ In the London market, reinsurance disputes are overwhelmingly arbitrated, under practices largely shaped by ARIAS (UK).

C. Cyber Catastrophe Bonds

The transfer of extreme cyber risk to capital markets has become a reality. Following the first transactions in 2023, the cyber catastrophe bond market has grown: in the fourth quarter of 2025, about USD 450 million of cyber reinsurance limit was placed through cat bonds, the busiest quarter on record,³⁸ and Beazley's PoleStar Re 2026-1 issuance, priced at USD 300 million, is the largest cyber cat bond to date.³⁹ These instruments operate on an indemnity, per-occurrence trigger and sit in the upper layers of protection. They transpose to financial markets the questions of event definition and war exclusion, and expose their documentation to investors who lack the insurance market's culture. The Geneva Association stresses that the potential scale of extreme cyber losses exceeds the capacity of insurers and reinsurers alone, making this transfer a structural necessity.⁴⁰

VIII. A Moroccan Perspective and Emerging Markets

A. A Nascent Market Facing a Proven Threat

Morocco offers an illuminating case study of the challenges facing emerging markets. The threat is real: in April 2025, the National Social Security Fund (CNSS) suffered a cyber attack of unprecedented scale in the country, leading to the disclosure of personal data concerning nearly two million employees,⁴¹ followed by further attacks on public bodies. The episode highlighted the very issues examined in this Article: the liability of a public entity as data controller, the absence of a general breach notification duty, the remedies available to data subjects and the absence of insurance for the affected entity.

The Moroccan cyber insurance market remains embryonic. Coverage is available from certain insurers, often backed by international groups and largely reinsured abroad, but risk awareness and insurability conditions have yet to mature.⁴² In April 2025, at the Rendez-vous de Casablanca de l'Assurance, the Minister of Economy and Finance announced the development of a cyber risk insurance project,⁴³ and the Insurance and Social Welfare Supervisory Authority (ACAPS) has launched a program to support innovation in the sector.

B. The Applicable Legal Framework

The Moroccan legal framework contains the main building blocks of a cyber risk regime but falls short of international standards in several respects. Law No. 09-08 on the protection of individuals with regard to the processing of personal data imposes a security obligation on data controllers, under the supervision of the National Commission for the Control of Personal Data Protection (CNDP), but contains no general breach notification duty comparable to the GDPR's; a recast aligning it with international standards has been announced.⁴⁴ Law No. 05-20 on cybersecurity and its implementing decree establish, under the authority of the General Directorate of Information Systems Security (DGSSI), security and incident-reporting obligations for public administrations, public institutions and critical infrastructures. Since Law No. 07-03, the Criminal Code has punished offenses against automated data processing systems, and Morocco is a party to the Council of Europe Convention on Cybercrime, which facilitates international cooperation and gives real utility to a complaint lodged with the Crown Prosecutor.

On the insurance side, Law No. 17-99 enacting the Insurance Code establishes the principle that risks located in Morocco must be placed with licensed insurers, which channels international programs toward fronting, with a local policy issued by a Moroccan insurer and reinsured by the program's lead carrier or in the London market. Moroccan law has no equivalent of Article L. 12-10-1 of the French Insurance Code: a complaint is not a statutory condition of indemnity, though the policy may require one. Nor does it expressly recognize the claims-made clause, which creates an interpretive risk where a local policy is governed by Moroccan law. Payment of a ransom, finally, runs up against exchange control regulations, the anti-money laundering and counter-terrorist financing framework derived from Law No. 43-05, and the international sanctions regimes to which foreign reinsurers are exposed. Law No. 95-17 on arbitration and conventional mediation, for its part, offers a modern framework for resolving insurance and reinsurance disputes.

C. A Regional Hub in the Making

The low penetration of cyber insurance in Africa and the scale of digital flows between Europe, Morocco and sub-Saharan Africa open room for a regional hub for cyber underwriting, reinsurance and claims handling. That ambition requires a breach notification framework, supervisory guidance on cyber policies and ransom, local forensic and expert capacity, and lawyers able to act within hours in international matters on behalf of insurers, reinsurers and breach coaches in London, Paris or New York.

Conclusion and Proposals

Cyber insurance is both a success and a work in progress. A success, because a market of some fifteen billion dollars has been built in a decade around an intangible, adversarial and systemic risk, by inventing a form of insurance that organizes the crisis response as much as it indemnifies. A work in progress, because fundamental legal questions remain open: the attribution of attacks to states and the interpretation of the exclusions that depend on it, the definition of an event in reinsurance, the insurability of ransoms and penalties, the protection of investigative work product, the coordination of notification duties and the protection gap affecting public entities and emerging markets.

Four proposals may be advanced. First, the market should converge on an attribution mechanism for state-backed attacks that relies, absent government attribution within a set period, on an independent expert determination, so as not to leave the insured in uncertainty. Second, legislators would do well to harmonize the deadlines and points of contact for incident notifications, along the lines of the single reporting channel contemplated in the United Kingdom, so that a victim is not subjected to competing obligations in the first hours of a crisis. Third, the insurability of ransom payments deserves a clear position from each supervisory authority; the French solution of insurability conditioned on a complaint strikes a balance between compensating victims and cooperating with law enforcement. Fourth, states with nascent markets, Morocco foremost among them, would benefit from adding a breach notification duty to their data protection law, clarifying the status of the claims-made clause and exploring, with their insurers and reinsurers, a pooling mechanism for catastrophic cyber risk.

Cyber risk is set to become one of the defining risks of the century. Insurance and reinsurance law, which in earlier eras organized the pooling of maritime and then industrial risk, has the tools to address it, provided that it does not leave to policy wordings alone the task of answering questions that now belong to economic public policy and to the digital sovereignty of states.

Notes

1. Doctor of Law, Université Paris 1 Panthéon-Sorbonne; graduate of ESSEC, ISCAE and Université de Montréal; member of the Casablanca, Paris and Montréal Bars; contractual expert to the World Bank; he teaches banking and financial law at universities and business schools. For many years he represented Morocco's national reinsurer and several international reinsurers in claims settlement and arbitration. Author of Droit bancaire marocain (LexisNexis 2023) and La nature juridique du traité de réassurance [The Legal Nature of the Reinsurance Treaty], 3 MENA Bus. L. Rev. 67 (2018). The views expressed are the author's own. ↑
2. For the order of magnitude, see, e.g., Insurers Drop Bid to Exclude Merck's $1.4B NotPetya Claims, BankInfoSecurity (Jan. 2024), https://www.bankinfosecurity.com/insurers-drop-bid-to-exclude-mercks-14b-notpetya-claims-a-24040. ↑
3. Munich Re, Global Cyber Risk and Insurance Survey 2026, https://www.munichre.com/en/insights/cyber/global-cyber-risk-and-insurance-survey-2026.html (estimating roughly USD 15 billion in 2025 and roughly USD 28 billion in 2030). ↑
4. Verisk's PCS Designates CrowdStrike Outage as Cyber Catastrophe Event, Ins. J. (July 31, 2024), https://www.insurancejournal.com/news/national/2024/07/31/786319.htm; Guy Carpenter, as reported in Ins. J. (Aug. 19, 2024), https://www.insurancejournal.com/magazines/mag-features/2024/08/19/788753.htm. ↑
5. CrowdStrike Outage Losses Will Hit Healthcare, Banking Hard, GovInfoSecurity (July 2024), https://www.govinfosecurity.com/crowdstrike-outage-losses-will-hit-healthcare-banking-hard-a-25848. ↑
6. Regulation (EU) 2016/679, of the European Parliament and of the Council of 27 April 2016, art. 4(12), 2016 O.J. (L 119) 1. ↑
7. Munich Re, supra note 3. ↑
8. Swiss Re estimate reported in Cyber Risk Investments to Shape 2026 Insurance Market, Ins. Bus. Mag. (2025), https://www.insurancebusinessmag.com/ca/news/cyber/cyber-risk-investments-to-shape-2026-insurance-market--marsh-559561.aspx. ↑
9. Howden Re, as reported in Cyber Reinsurance Needs Diversification for Sustainable Growth, Ins. Bus. Mag., https://insurancebusinessmag.com/reinsurance/news/breaking-news/cyber-reinsurance-needs-diversification-for-sustainable-growth--howden-re-533718.aspx. ↑
10. Travelers Prop. Cas. Co. of Am. v. Int'l Control Servs., Inc., No. 22-cv-2145 (C.D. Ill. 2022) (stipulated rescission of the policy). ↑
11. Lloyd's, Cyber at Lloyd's, Presentation to the Federal Advisory Committee on Insurance, U.S. Dep't of the Treasury (Dec. 8, 2022), https://home.treasury.gov/system/files/311/Lloyd%26%23039%3Bs%20FACI%20Presentation%20on%20Cyber%20Insurance%20Dec.%208%202022.pdf. ↑
12. Guy Carpenter, supra note 4. ↑
13. Merck & Co. v. Ace Am. Ins. Co., 475 N.J. Super. 420 (App. Div. 2023). ↑
14. Merck Settles Coverage Dispute with Insurers over War Exclusion in NotPetya Attack, Ins. J. (Jan. 5, 2024), https://www.insurancejournal.com/news/national/2024/01/05/754582.htm. ↑
15. Mondelez and Zurich Reach Settlement in NotPetya Cyberattack Insurance Suit, The Record (Nov. 2022), https://therecord.media/mondelez-and-zurich-reach-settlement-in-notpetya-cyberattack-insurance-suit. ↑
16. LMA Bulletin LMA21-042-PD, Cyber War and Cyber Operation Exclusion Clauses (Nov. 25, 2021). ↑
17. Lloyd's Market Bulletin Y5381, State Backed Cyber-Attack Exclusions (Aug. 16, 2022); for analysis, see DAC Beachcroft, War Exclusions in Cyber Policies: An Overview, https://dacbeachcroft.com/en/What-we-think/War-exclusions-in-cyber-policies-an-overview. ↑
18. For an analysis of the LMA model clauses, see Lloyd's of London Requires Insurers to Add Exclusions to Limit Coverage for State-Backed Cyberattacks, Policyholder Pulse, https://www.policyholderpulse.com/lloyds-london-state-backed-cyberattacks/. ↑
19. DAC Beachcroft, State-Backed Cyber-Attack Exclusions: Lloyd's Issues New Market Bulletin (June 10, 2024), https://www.dacbeachcroft.com/es/what-we-think/statebacked-cyberattack-exclusions-lloyds-issues-new-market-bulletin; LMA clause classification, https://lmalloyds.com/?p=1049. ↑
20. See the observations of Andrew Hill (WTW) reported in Lloyd's Cyber War Exclusions: Confusing, Disruptive, but Necessary?, Ins. J. (May 22, 2023), https://www.insurancejournal.com/magazines/mag-features/2023/05/22/721424.htm. ↑
21. Lloyd's Market Bulletin Y5258 (July 4, 2019) and Y5277 (Jan. 2020), Providing Clarity for Lloyd's Customers on Coverage for Cyber Exposures. ↑
22. S&P Global Ratings, Cyber Risk Insights 2024, https://insight.spglobal.com/story/cyber-risk-insights-2024/page/9. ↑
23. Burges Salmon, UK Government Moves to Ban Ransomware Payments for Public Sector, https://www.burges-salmon.com/articles/102kyhv/uk-government-moves-to-ban-ransomware-payments-for-public-sector; Goodwin, The UK's Ransomware Strategy (Feb. 12, 2026), https://goodwinlaw.com/en/insights/publications/2026/02/alerts-technology-dpc-the-uks-ransomware-strategy. ↑
24. Lockton Re, Cyber Risk Pools and Public Private Partnerships: Time to Dive In? (Feb. 2025), as reported by Reinsurance News, https://www.reinsurancene.ws/gov-supported-cyber-risk-pool-would-encourage-greater-adoption-lockton-re/; Geneva Association work on systemic risk, as reported by Commercial Risk, https://www.commercialriskonline.com/uncapped-government-backstop-needed-for-uninsurable-cyber-and-climate-risk-geneva-association/. ↑
25. Coalition, 2026 Cyber Claims Report, as reported by Astra, https://getastra.com/blog/security-audit/cyber-insurance-claims-statistics. ↑
26. U.S. Dep't of the Treasury, Off. of Foreign Assets Control, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (Sept. 21, 2021). ↑
27. Code des assurances [C. assur.] [Insurance Code] art. L. 12-10-1 (Fr.), as introduced by Loi 2023-22 du 24 janvier 2023 d'orientation et de programmation du ministère de l'Intérieur, art. 5; see Jones Day, French Law Authorizes Insurability of Cyber-Ransoms Paid by Victims (Feb. 2023), https://www.jonesday.com/fr/insights/2023/02/french-law-authorizes-insurability-of-cyberransoms-paid-by-victims. ↑
28. Verspieren, Les 10 conséquences de la loi LOPMI pour l'assurance des risques cyber [Ten Consequences of the LOPMI Law for Cyber Risk Insurance], https://www.verspieren.com/fr/node/588. ↑
29. Direction générale du Trésor, FAQ sur l'obligation de dépôt de plainte en cas de cyberattaque [FAQ on the Duty to File a Complaint in the Event of a Cyber Attack]. ↑
30. Le délai de déclaration d'une cyberattaque devient la clé de l'indemnisation [The Deadline for Reporting a Cyber Attack Becomes the Key to Indemnification], L'Agefi (Jan. 9, 2026), reproduced by AMRAE. ↑
31. MEDEF, FAQ article 5 loi d'orientation et de programmation du ministère de l'Intérieur, https://www.medef.com/uploads/media/default/0020/01/15079-15077-faq-article-5-loi-dorientation-et-de-programmation-du-mi.pdf. ↑
32. In re Capital One Consumer Data Sec. Breach Litig., No. 1:19-md-2915, 2020 WL 2746826 (E.D. Va. May 26, 2020), aff'd, 2020 WL 3470261 (E.D. Va. June 25, 2020). ↑
33. Wengui v. Clark Hill, PLC, 338 F.R.D. 7 (D.D.C. 2021). ↑
34. Howden Re, supra note 9. ↑
35. Gallagher Re, as reported in Cyber's Great Contradiction: Surging Risk Meets Record-Low Pricing, Ins. Bus. Mag. ↑
36. DAC Beachcroft, LMA Publishes Model State-Backed Cyber War Exclusion Clauses for Cyber Treaty Reinsurance (Mar. 5, 2023). ↑
37. Abdelatif Laamrani, La nature juridique du traité de réassurance [The Legal Nature of the Reinsurance Treaty], 3 MENA Bus. L. Rev. 67 (2018). ↑
38. Cyber Cat Bond Innovation Premium Largely Eroded: Gallagher Securities, Artemis, https://www.artemis.bm/news/cyber-cat-bond-innovation-premium-largely-eroded-gallagher-securities/. ↑
39. Beazley Secures the Biggest Cyber Cat Bond So Far, as PoleStar Re 2026-1 Priced at $300m, Artemis, https://www.artemis.bm/news/beazley-secures-the-biggest-cyber-cat-bond-so-far-as-polestar-re-2026-1-priced-at-300m. ↑
40. Geneva Ass'n, Catalysing Cyber Risk Transfer to Capital Markets: Catastrophe Bonds and Beyond (Darren Pain, Dec. 2024), https://www.genevaassociation.org/node/20746. ↑
41. Données personnelles : peut-on poursuivre la CNSS ? [Personal Data: Can the CNSS Be Sued?], TelQuel (Apr. 15, 2025), https://telquel.ma/2025/04/15/hack-de-la-cnss-quels-recours-legaux-pour-les-victimes%E2%80%89_1927099. ↑
42. Cyberassurance : ce qu'en disent les professionnels du secteur [Cyber Insurance: What Industry Professionals Say], Médias24 (Apr. 26, 2025), https://medias24.com/2025/04/26/cyberassurance-ce-quen-disent-les-professionnels-du-secteur/. ↑
43. Id. ↑
44. On the planned recast of Law 09-08, see, e.g., BourseNews, Protection des données à caractère personnel : la CNDP entame sa mue [Personal Data Protection: The CNDP Begins Its Transformation]; and the CNDP's recommendation that businesses within the scope of the GDPR launch a compliance project, including breach notification. ↑

Abdelatif Laamrani