Cyber clauses no longer optional for charter operations

For a few years, cyber risk in marine was treated as a future problem. That phase is over. Three incidents in the last twelve months — two superyacht charters and one shipyard — have produced real claims, real coverage disputes, and real precedent.

The pattern is the same in each: an onboard navigation or operational system was compromised, an incident followed, and the standard marine policy declined the cyber-causation portion of the claim under a CL380 or similar exclusion. In two of the three, the operator was left funding forensics and defence out of pocket while coverage was litigated.

The standard cyber attack exclusion was drafted in a different era, when 'cyber' meant a targeted state-level attack on infrastructure. Modern policies need either a cyber buy-back that restores affirmative cover for the specific casualty, an affirmative cyber endorsement on the hull and P&I sections, or a dedicated cyber policy that aligns with — not duplicates — your marine cover.

Most charter programmes we audit have none of those. When the incident hits, the CL380 exclusion is the first thing an adjuster raises, and it is legitimately hard to argue against without a buy-back on file.

They are an exposure. Whether they are covered depends on wording most operators have never read. GDPR and equivalent claims from charter guests whose personal data leaks from onboard systems are a real category now — we have seen guest privacy claims settle in six figures, and the underlying data flows are almost always through the yacht's own network before they touch the management company.

Most yacht policies have zero affirmative cover for this. A stand-alone cyber policy with a media liability and privacy section is the practical fix, and it can usually be arranged for less than a single mid-size claim would cost.

The bridge is one threat surface. The propulsion management system, the integrated alarm system, the access control gates at the marina — all operational technology, all increasingly exposed, and almost none of them explicitly addressed in standard marine wording.

OT cover is the gap that will define the next round of marine cyber claims. If your wording only names 'navigation systems,' you have a coverage argument waiting to happen the day a propulsion controller is hit.

Ask your broker for a one-page summary of how cyber is actually treated in your current programme — affirmative cover, exclusions, buy-backs, and any stand-alone policies. If they cannot produce one, that is your answer.

SRMG writes those one-pagers as part of a pre-season review process, and pairs them with a placement plan when gaps are material. Available on request; usual turnaround is under two weeks.