Insurance
Home›Insurance›Health Insurance›Iran hacking charges spotlight limits of cyber war exc…
Iran hacking charges spotlight limits of cyber war exclusions
The DoJ alleges the IRGC-linked Mabna campaign hit 144 universities, at least 42 private companies, and five government agencies, driving renewed scrutiny of cyber policy wording.
A federal indictment unsealed Tuesday charges 17 members of an Iran-based hacking group with a state-directed campaign targeting American universities, private companies, and government agencies, pushing cyber insurance brokers and underwriters back to the wording of cyber war exclusions, according to Insurance Business. The Justice Department said a 14-count superseding indictment names members of Mabna Institute for intrusions into 144 US universities, at least 42 private-sector companies, and five government agencies, with the activity running until at least December 2017. The DoJ alleges Mabna stole more than 31 terabytes of academic data and intellectual property, and it said private-sector victims faced more than $20 million in investigation and remediation costs. Insurance Business noted that many of the intrusions were reportedly conducted on behalf of the Islamic Revolutionary Guard Corps, with stolen academic data also sold through two websites in Iran. The case arrives as Iranian-linked cyber activity has intensified in the wake of Operation Epic Fury in February, raising questions about how cyber war exclusions apply to state-linked operations. In the Lloyd's market, the most widely adopted clause is LMA5567, mandated across standalone cyber policies from March 2023, Insurance Business said. The article added that the clause does not broadly exclude state-linked incidents, with coverage excluded only when a cyber operation causes a "major detrimental impact" on a state's essential services or security capabilities, which it said is a high bar for corporate-targeted intrusions. The outlet argued that attacks similar to those described in the indictment could trigger policy response if victims meet attribution and notification requirements.