Loading...
- Home
- Capabilities
- ACTIO® Hub
- About Us
- Connect with Us
- AP Library
September 28, 2026
Originally published in ACTIO E-Magazine Edition 30 (September 2026). Law as of September 2026.
Being insured does not mean being covered. A cyberattack on a vessel or port may engage hull and machinery or P&I insurance, but only if the policy wording allows it. Standard cyber exclusion clauses, notably CL380 and LMA5402, can leave cyber-related losses with the insured, and Indonesian law provides no integrated framework linking maritime cyber risk management to insurance coverage.
Cyber incidents in the maritime industry are no longer theoretical. The 2017 NotPetya ransomware attack forced A.P. Moller-Maersk to reinstall roughly 45,000 PCs and 4,000 servers at a reported cost of USD 250-300 million. Since then, COSCO (2018), CMA CGM (2020), the Port of Lisbon (2022), the Port of Nagoya (2023), and DP World Australia (2023) have each suffered incidents ranging from ransomware to unauthorised network intrusion.
Indonesia has had its own incidents. In October 2023, Pelindo, the state-owned port operator, reportedly suffered a data-exfiltration breach attributed to the BianLian group. In June 2024, Indonesia’s Temporary National Data Center (PDNS) was hit by a ransomware attack. Following the DP World Australia incident, Pelindo reportedly migrated some of its data away from government infrastructure, although this was never confirmed. The Pelindo incident did not fully disable a port’s operational technology in the way the Nagoya attack did, but it made plain that such a risk exists.
For insurers, carriers, shippers, and banks, the practical question is rarely whether a cyber incident could occur, but which legal instrument responds when it does, and whether the assured’s current policy covers cyber-related losses or excludes them.
Insurance transfers the financial consequences of an uncertain risk in exchange for a premium, but only for losses falling within the scope of the contractual agreement, subject to exclusions, conditions, and limitations. The IMO Guidelines on Maritime Cyber Risk Management expressly recognise risk transfer as one possible component of cyber risk management, alongside acceptance, avoidance, and mitigation. Insurance does not eliminate the underlying cyber risk.
Traditional marine insurance was developed for identifiable maritime perils. Shipowners typically hold hull and machinery insurance for physical loss of or damage to the vessel, and protection and indemnity (P&I) insurance for third-party liabilities such as cargo, collision, pollution, and personal injury. Cargo interests hold marine cargo insurance, and specialised covers include freight, charterers’ liability, war risk, and loss of hire.
A cyberattack causing physical damage to a vessel may potentially engage hull and machinery insurance, while resulting liabilities to third parties may potentially fall within P&I insurance, subject in each case to the applicable policy wording. If excluded, the assured may need standalone marine cyber insurance covering ransomware, system failures, data breaches, data loss, restoration costs, and interference with navigation or communications systems.
A cyber incident may also result from accidental system failure, human error, defective software, or negligent maintenance rather than a malicious attack. Although these events may produce similar consequences, insurers may treat them differently depending on the wording of the insuring agreement, exclusion, or endorsement.
Indonesia’s framework is dispersed across several regulatory domains and does not operate as a single integrated framework for maritime cyber risk. Article 246 of the Indonesian Commercial Code provides the foundation of insurance, with Articles 592-744 governing marine insurance policies, and the Insurance Law (Law No. 40 of 2014, as amended by Law No. 4 of 2023) strengthening the framework.
The Shipping Law imposes compulsory insurance obligations, including shipwreck removal and insurance for passenger safety, crew protection, and marine pollution, with criminal sanctions possible for failure to obtain required cover. Cyber-related obligations arise separately: the ITE Law (Law No. 11 of 2008, as amended by Law No. 1 of 2024) requires Electronic System Operators to operate systems reliably and securely, and the PDP Law (Law No. 27 of 2022) requires written notification of protection failures. OJK regulations impose risk management and cybersecurity obligations on financial institutions and insurers, including POJK No. 11/POJK.03/2022 for banks and POJK regulations on risk management, soundness, and governance for insurers and financial technology providers.
None of these instruments cross-references the others. Compliance with one regime does not determine consequences under another, and does not automatically establish insurance coverage. Conversely, the existence of insurance does not discharge the insured’s obligation to implement adequate cyber risk management.
Traditional marine policies were not designed with modern cyber incidents in mind, creating uncertainty about whether losses involving computer systems or cyberattacks fall within conventional cover. The market responded through standard clauses, mainly from the London market.
The Institute Cyber Attack Exclusion Clause (CL380, 2003) excludes losses arising from the use or operation of computers, computer systems, malicious code, or viruses “as a means for inflicting harm”. It is directed principally at malicious cyber activity and says nothing about non-malicious system failure, leaving uncertainty about technological failures.
Lloyd’s addressed this gap from 2020 by requiring affirmative cover-or-exclude clarity across first-party property policies. The LMA Marine Cyber Exclusion (LMA5402, 2019) is a broader exclusion covering both malicious and non-malicious cyber loss. The LMA Marine Cyber Endorsement (LMA5403, 2019) is the corresponding buy-back: it provides that indemnity otherwise recoverable shall not be prejudiced by the use or operation of a computer system where such use is not “as a means for inflicting harm”, recognising that certain non-malicious cyber-related losses may remain within conventional cover. The progression from CL380 to LMA5402 and LMA5403 shows a movement towards greater contractual specificity in allocating cyber-related losses.
Further complexity arises where a cyberattack is allegedly attributable to a state. The issue may extend beyond ordinary cyber exclusions to whether the event falls within a conventional war or hostile action exclusion. In Merck & Co., Inc. v ACE American Insurance Co., insurers sought to rely on a hostile or warlike action exclusion for the NotPetya attack. The court ultimately held that coverage depends upon the particular wording of the policy and the circumstances of the event.
Concerns about large-scale and state-backed cyber operations have since led to more specific cyber exclusion wording, including Lloyd’s Market Bulletin Y5381 on state-backed cyber-attack exclusions (2022). For maritime stakeholders, the implication is that even where insurance responds to certain cyber-related losses, significant incidents may fall outside conventional coverage depending on their nature and attribution.
The risk landscape is likely to grow more complex as the industry adopts Maritime Autonomous Surface Ships (MASS) and artificial intelligence. An attack against autonomous or AI-assisted systems may directly affect navigation, collision avoidance, propulsion, or other safety-critical functions, and may complicate the identification of causation where a loss results from an interaction between malicious interference, system malfunction, and autonomous decision-making. It remains an open question whether conventional marine insurance and existing cyber clauses can allocate risks arising from technologies that blur the distinction between cyber, operational, and navigational perils.
Does hull insurance automatically cover cyberattack damage?
No. Cover depends on the policy wording and any cyber exclusions or endorsements. A cyber event causing physical damage may potentially engage hull cover, but only if the wording allows it.
What is the difference between CL380 and LMA5402?
CL380 (2003) excludes losses from malicious computer use as a means of inflicting harm. LMA5402 (2019) is broader, excluding both malicious and non-malicious cyber loss.
What is LMA5403?
The Marine Cyber Endorsement that can buy back certain cover, preserving indemnity where computer use was not a means for inflicting harm.
Can a state-backed cyberattack be excluded as a war risk?
Possibly, depending on wording. In Merck v ACE, the court held that the warlike-action exclusion did not defeat cover on the facts, and that coverage turns on the particular wording and circumstances.
Does having insurance mean a company has managed its cyber risk?
No. Insurance transfers only the financial consequences of losses within the policy. It does not discharge the insured’s obligation to implement adequate cyber risk management measures.
Marine insurance remains a potentially valuable instrument for managing the financial consequences of maritime cyber risk, but its effectiveness depends entirely on the scope of risk actually transferred under the policy. Clear contractual wording on cyber-related losses lets parties identify gaps in protection before an incident occurs, rather than discovering the limits of cover only when a claim is made. For maritime stakeholders and their legal advisers, cyber risk management should therefore extend beyond technical safeguards and regulatory compliance to include a careful assessment of how cyber risks are allocated, retained, or transferred through insurance contracts.
