Shipping/Cargo Risk

Merchant ships in Ukraine have been hit, and insurers are either not offering coverage for vessels sailing the Black Sea, or demanding huge premiums to do so. The Black Sea is a critical region for agricultural and oil traders, with Ukraine and Russia accounting for more than a quarter of the global trade in wheat and about one-fifth of corn. The Ukrainian ports have now been overtaken by Russia so any ships and their cargo there are in jeopardy. All of the disruptions and lack of cargo movement will only serve to further hamper the supply chain having already been impeded by Covid-19 related disruptions.

Cyber Risk

Cyber attacks were already on the rise before the Russian invasion of Ukraine, but AM Best believes an escalating conflict may also increase the risk of a systemic cyberattack, and could cause substantial losses, noting,"heightened risk perception could lead to higher prices in an already hardening cyber market." Most affected will be those writing large energy and infrastructure risks, business that has historically been highly profitable. There may also be recovery implications for foreign insurers that have reinsurance with Russian carriers, per AM Best.

Further increasing the potential for cyber claims is the lack of many insurers to address the policy's position on cyber in non-cyber policies, known as 'silent cyber' policies. The NotPetya attack on Merck gave rise to litigation against their insurer Ace, with Merck alleging that NotPetya spread to 40,000 computers, resulting in losses totaling more than $1.4 billion. Merck's 'all risks' property insurance policies with ACE specifically provided coverage for loss or damages resulting from destruction or corruption of computer data and software; however ACE denied coverage relying on a "War or Hostile Acts" exclusion to coverage, asserting that such attack was an instrument of the Russian Government and part of its ongoing hostilities against Ukraine. As described, the exclusion extended to any other cause or event contributing concurrently or in any other sequence to the loss.

In response to the Ace denial, Merck argued that the facts demonstrate that NotPetya "was not an official state action, but rather was a form of ransomware, and moreover that even if it was instigated by Russia to harm Ukraine, the exclusion would still not apply." The court ruled in favor of Merck, declaring that the War or Hostile Acts exclusion does not apply under the exclusion's plain meaning and relevant case law. See Is a Russian Cyber Attack an Excluded Act of War? The Merck decision has already had a significant impact on insurance underwriting. Jennifer Rothstein, who heads cyber insurance and legal business development for computer security firm BlueVoyant said that carriers have recently been working with brokers to clarify coverage and refine the questions asked as part of the underwriting process. In the meantime, premiums are going up, and the criteria insurers use to determine whether to take on risks are becoming stricter. It will behoove insurers to better clarify what is and is not covered, and for agents and policyholders to take note of war exclusions with respect to cyber warfare.

Nation-state attacks are malicious cyberattacks that originate from a particular country and are an attempt to further that country's interests. One example of how smaller companies can be vulnerable to such attacks is the recent case of a Toyota Motor Corporation supplier cyberattack that brought a halt to Toyota's domestic production in Japan. A lot of smaller companies and sub-companies are not as technologically advanced, and there aren't enough IT people to keep up within these smaller companies, according to Takamichi Saito, professor and Director of the Cybersecurity Lab at Tokyo's Meiji University. When an attacker can't aim directly at a larger corporation, they may aim for one or more suppliers.

On February 23, 2022 Microsoft's Threat Intelligence Center detected a never-before-seen piece of "wiper" malware that appeared aimed at the country's government ministries and financial institutions. The virus code would erase, or 'wipe' data on network computers. Microsoft termed the malware "FoxBlade" and immediately set to work picking apart the malware and in just three hours they had notified Ukraine's top cyberdefense authority and updated the Microsoft detection systems to block the code. This story has a happy ending, but not all small businesses will be as well prepared.

War Risk

While war is not an insurable risk under traditional insurance, war risk insurance has actually been around since 1914, when the War Risk Insurance Act was passed by the United States Congress to ensure its availability for shipping vessels and individuals during WWI. In general, war risk insurance provides coverage on losses resulting from events such as war, invasions, insurrections, riots, strikes, and terrorism. Details on War Risk Insurance can be found in Title 46 of the U.S. Code, Chapter 539. Many reinsurers submitted 48 hours notifications on cancellation of war risk insurance for Ukraine, beginning on Feb 11, 2022.

Political Risk

Instability in a country can happen without warning, leaving investors, lenders, and contractors unprepared and out of pocket. In the political upheaval, businesses may not be able to operate and their assets may be damaged, none of which would be covered by a standard insurance policy. Political risk insurance helps organizations conducting business around the world protect their assets and financial interests from monetary losses due to specified political risks.These can be from such losses as being unable to convert currency, government interference, and political violence including terrorism. Political risk insurance is designed to protect a business against arbitrary government actions such as confiscation, expropriation and nationalism; selective discrimination; forced divestiture; license cancellation and breach of contract. It can include coverage for loss or damage to physical assets as a result of violence, abandonment of assets or abandonment of the foreign operations as a result of political violence. It can cover the exposures of importers or exporters in differing scenarios, such as ceasing operations where exports are crucial to the business; or loss of products that only have value if exported. As has happened with the banking and investment restrictions, political risk can respond when restrictions on foreign exchange prevents remittances relating to dividends, shareholder loan payments, intercompany payables, and sale proceeds. Some coverage may be available to project lenders to protect investors against the failure of sovereign governments to meet their debt obligations due to political violence. Political risk insurance for contractors may provide coverage to construction, engineering, and other contracting firms against associated losses due to political upheaval or government action.

Implications in the U.S.

Direct implications in the U.S. thus far are the inability to conduct financial transactions between the U.S. and Russia due to a freeze on Russian banks and financial institutions, the lack of Russian imports and exports, and companies being unable to continue business operations between the U.S. and Russia. The standard insurance policies will not cover loss or damage arising out of any of these factors. For example, an upscale restaurant regularly offers imported Russian caviar and Russian vodka on their menu. Because they either cannot get the imported items or they selectively choose not to serve these items, these are not direct physical losses that would be covered under a standard open perils policy. If the items could not be imported, this could perhaps be covered if the restaurant has a political risks insurance policy. Simply choosing not to offer a product is a business decision, not a fortuitous loss.

It is possible that the restaurant may have reduced patronage due to their renowned Russian atmosphere and Russian food and drink selections, resulting in a loss of business income. This also would not be covered under the standard business interruption coverage, as there was no direct loss or damage to the restaurant or its products that caused the reduced patronage. Again, there may be some coverage under a political risks insurance policy.

It is not inconceivable that some businesses may be rioted against or vandalized should the business owner or their operations be of Russian nationality or show support to Russia in this conflict. Should that happen, there is coverage for riot and vandalism loss or damage under the ISO Commercial Property Special Causes of Loss form CP 10 30 10 12.

If a business operates with funds wired from Russia and is unable to continue operations or pay their employees due to the banking freeze, there would be no coverage for this business income loss under the standard ISO property policies, as the banking freeze is not a covered cause of loss, as governmental action is excluded. A political risks insurance policy or trade credit insurance may provide some coverage for this type of loss.

For further reading:

Insurance Implications from Invasion of Ukraine by Russia