The Cyber Insurance Dispatch: March 25, 2026

The US-Iran conflict arrived in cyber insurance this week via Handala's devastating wiper attack on Stryker, forcing a live market test of Lloyd's war exclusion wording LMA5567 and exposing the gap between what policyholders assume is excluded and what the clause actually requires.

Away from the geopolitical noise, Conning's new study finds that underwriting discipline has strengthened meaningfully but flags systemic accumulation risk and pricing pressure as structural threats to long-term scalability—while the UK's new cybersecurity strategy adds pressure on underwriters to rethink compliance-based risk assessment.

On the product front, Brit launched C360 with an "any one claim" SME structure and Spektrum Labs embedded Limit's wholesale marketplace directly into its resilience platform, signaling a market actively building for the next chapter even as it navigates the current one.

Treaty cyber programmes don’t underperform because demand isn’t there.

They underperform because most carriers and brokers lack the insight to make cyber risk tangible and measurable.

For brokers, that means low engagement and poor conversion.

For underwriters, it means limited visibility, higher losses and exposure that’s harder to control.

In a soft market, that gap is holding back growth and performance.

DynaRisk analysed what high-performing white-label and embedded cyber programmes are doing differently.

This guide breaks down:

• Why most cyber programmes stall

• What top performers do differently

• How intelligence is improving conversion, visibility and portfolio performance

Download here

Stryker was hit with a wiper attack on March 11, 2026. The attack, claimed by Handala, a group linked by Palo Alto Networks' Unit 42 to Iran's Ministry of Intelligence and Security, is the first significant live test of Lloyd's state-backed cyber attack exclusion mandate since it took effect in March 2023. After the NotPetya/Merck litigation exposed the inadequacy of legacy war exclusion language for cyber incidents, the Lloyd's mandate and the adoption of LMA5567 wording were the market's structured response. Stryker is now asking whether that response was sufficient or whether it simply shifted the ambiguity from one clause to another.

Handala claimed responsibility for wiping more than 200,000 systems, servers, and mobile devices across 79 Stryker offices globally, and exfiltrating 50 terabytes of data. Stryker, a $22B+ medical device manufacturer whose equipment (surgical robots, orthopedic implants, imaging systems) is deployed in operating rooms worldwide, including NHS facilities, confirmed the disruption. Handala presents publicly as a hacktivist collective, but Unit 42 assesses it as an operational front for Iran's MOIS, specifically designed to allow Iran plausible deniability over its cyber operations.

The Lloyd's 2022 mandate required all standalone cyber policies to include an exclusion for losses from state-backed cyber operations, effective March 2023. The most widely adopted wording, LMA5567, does not blanket-exclude state-linked incidents. It applies a threshold: the exclusion only triggers when an operation causes a "major detrimental impact on the functioning of a state due to direct or indirect effects on the availability, integrity, or delivery of an essential service."

The problem is that "major detrimental impact" is not defined anywhere in the clause. Marsh's deputy cyber practice leader has stated publicly: "We still don't have an explanation for that." This creates a live question around Stryker: Does an attack that disrupts the global supply chain of the world's largest surgical equipment manufacturer, affecting hospital operations and NHS equipment availability, meet that threshold? The argument can be made either way, and without a definition in the wording, it will likely be made in court.

Even assuming LMA5567's threshold is met, triggering the exclusion requires formal attribution to a state actor something insurers have historically been unable to obtain quickly or cleanly.

Handala claims responsibility openly, but operates under a hacktivist persona specifically designed to obscure Iranian state involvement. Unit 42 has assessed Handala as an MOIS front. But no formal US government determination has been issued regarding the Stryker attack. Without an official government or court-validated attribution, insurers face a difficult choice: pay under the policy while a coverage dispute winds through litigation, or deny and risk the reputational and legal exposure of a wrongful denial.

This is structurally the same challenge that complicated NotPetya claims before Merck's court victories forced the industry's hand. LMA5567 was supposed to solve the attribution problem. But it specifies no attribution authority: the insurer, the government, or a court. That gap is now exposed.

The Merck/NotPetya dispute (ultimately settled confidentially in January 2024) established that the legacy war exclusion language used in property policies, written for kinetic warfare, did not apply to state-backed cyberattacks in the way insurers hoped. That ruling accelerated the Lloyd's mandate. LMA5567 was specifically designed for cyber, written with state-linked operations in mind.

The difference now: LMA5567 is purpose-built for this scenario. Insurers have a structurally stronger argument than they did in Merck. But the wording's undefined thresholds and absent attribution authority mean coverage disputes will still end up in court. The question is whether the outcome favors the insured, as Merck did, or the insurer. Healthcare clients with Stryker-adjacent exposure should not assume either way.

Till next time,