Cyber risks and the new captives

Read the PDF edition (2 pages)

Cyber risk has become the fastest growing new line of business for captives. Commercial cyber insurance is expensive, limits are small in relation to the potential losses of large groups and the conditions have been narrowed after a series of large claims. The attack with the malware known as NotPetya in June 2017 caused losses of several hundred million dollars each to several multinational groups, among them a large American pharmaceutical company and a global food group. Their insurers relied on war exclusions, arguing that the attack had been carried out by a state. Courts in New Jersey rejected that argument in the pharmaceutical case, whereas the dispute in the food case was settled in 2022.¹ Lloyd's has since required its syndicates to include clauses excluding state-backed cyber attacks in their policies.

Groups have responded by retaining a larger share of their cyber risks in their captives, where they can design the cover to their needs and build reserves over time. A captive can also coordinate the purchase of commercial cover above its retention and collect data on incidents across the group. Capital market instruments for cyber risk have appeared as well. In 2023 the first catastrophe bonds covering cyber risks were placed, among them transactions sponsored by Beazley and by Swiss Re, which tested the willingness of investors to accept a risk whose modelling is still young.² For the pharmaceutical groups of Basel, whose research data, production systems and supply chains depend on digital infrastructure, cyber risk ranks among the highest risks in their annual reports.

Notes

1. On the NotPetya attack of June 2017 and the coverage disputes Merck & Co. v. Ace American Insurance Co. (New Jersey Superior Court, Appellate Division, May 2023) and Mondelez International v. Zurich American Insurance Co. (settled 2022), see the reports of the courts and the trade press. To be verified. ↩
2. On the first cyber catastrophe bonds placed in 2023, among them transactions sponsored by Beazley and Swiss Re, and on the growth of cyber risks in captives, see the market data of Artemis, the publications of the sponsors and the surveys of the major captive managers. Status to be verified. ↩

For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of August 2025.