A War Exclusion Now Reaches Sabotage Nobody Has Attributed, and Operators May Carry the Loss
A London court applied a war exclusion to the Nord Stream blasts without identifying the saboteur, while Germany logs sabotage in the hundreds. Boards of infrastructure operators, insurers and lenders should test whether hybrid attack losses are really covered.
Produced using Shaping Tomorrow’s six-stage process for converting external change into decision-ready intelligence.
Scanned and filtered by AI. Stress-tested and judged by humans.
The consensus reading of Europe’s sabotage wave is a security story: more arrests, more drones, tighter vetting. Beneath it sits a balance-sheet problem. On 06/07/2026 the Commercial Court held that the €580 million Nord Stream claim fell inside a war exclusion, although the identity of the perpetrator remained uncertain (Stewarts Law, 19/08/2026). If the same reasoning reaches arson, substation attacks and drone strikes run through proxies, the loss may stay with the asset owner. Our reading is that the 2027 renewal round is where this first shows. Boards should check what their property policies say about an attack that a government calls hostile and no court has attributed.
Signal Identification
A regulatory pivot arriving through case law. The exclusion covered loss “directly or indirectly” caused by war, and the court held that war only needed to be a significant cause (Stewarts Law, 19/08/2026). Sabotage that governments call state-linked but cannot prove has no settled insurance home: war exclusions come into play once an attack is tied to a hostile state (Insurance Business, 25/09/2026).
What's Changing
The Nord Stream lines ruptured in the Swedish and Danish economic zones after explosions in September 2022 (National Archives, 06/07/2026). The court held that the Russia-Ukraine war only needed to be a significant cause of the loss, and found that threshold met despite uncertainty about the perpetrator (Stewarts Law, 19/08/2026). The pipelines were not in an active war zone, yet the loss was held sufficiently connected to the wider conflict (Stewarts Law, 19/08/2026).
The attack surface is growing on land. German authorities recorded 165 suspected sabotage cases since the start of 2026, and 747 drone incidents involving 1,068 drones from January to the end of August, according to a Federal Criminal Police Office assessment (hromadske, 04/09/2026). Police recorded hundreds of sabotage acts against critical infrastructure in 2025 (Clean Energy Wire, 29/10/2026). Two grid substations were targeted within 24 hours in early September (Insurance Business, 03/09/2026), and Warsaw treats a fire at a Polish ground station that helps keep Ukraine online as deliberate sabotage (Insurance Business, 25/09/2026).
Governments are responding with controls, not cover. On 28/10/2026 Berlin announced two ordinances to protect critical infrastructure, citing hybrid attacks and insider sabotage (Die Bundesregierung, 28/10/2026), extending vetting of staff at critical sites (Clean Energy Wire, 29/10/2026). Neither source says who bears the loss when an attack succeeds.
The court dropped three tests, and German incident counts keep rising
Source basis: Stewarts Law for the tests the court applied; hromadske, relaying a Federal Criminal Police Office assessment, for the counts. Circle area is proportional; the counts cover different things and periods and are not additive.
Disruption Pathway
Our reading is that the pathway has three stages. Through the 2027 renewals, insurers and brokers test the Nord Stream reasoning against wordings that use “directly or indirectly” language (Stewarts Law, 19/08/2026). A first contested claim follows an attack where the state link is suspected but unproven, such as an arrest outside a German defence firm, which does not fit cleanly within standard war exclusion language (Insurance Business, 03/09/2026). The market then answers with clauses or specialist cover; demand has already moved towards political violence cover in London (Insurance Business, 25/09/2026).
Stress concentrates at grid nodes, subsea and satellite links, and defence-supplier sites. The January 2026 arson at Berlin’s Lichterfelde cable bridge left about 45,000 households and 2,200 businesses without power for up to four days, and the claiming group’s relationship to state direction remains under investigation (Insurance Business, 03/09/2026). Two adaptations follow. Operationally, owners add vetting and physical protection, as Berlin is extending (Die Bundesregierung, 28/10/2026). Financially, boards and lenders move sabotage into the plan as a retained loss or separately bought cover, and write it into covenants.
Why This Matters Now
Chief financial officers, treasurers, risk managers, project-finance lenders and boards of grid, pipeline, telecoms and defence-supply operators hold this decision. Their insurance programmes, covenants and continuity plans assume sabotage is an insured peril. That was a fair assumption for property policies (Insurance Business, 03/09/2026), but it now depends on attribution and characterisation, which a minister’s verdict does not settle (Insurance Business, 25/09/2026). Owners should ask brokers for a written position on how the war exclusion would apply to a sabotage loss with a suspected but unproven state link, size a retained-loss case for a multi-day outage, and check covenants that assume the cover.
Decision-action posture for this signal: Prepare: wording reviews, retained-loss cases and specialist quotes can be done now, while capital commitments wait for a contested claim or a published market clause.
Counter-Argument
The strongest objection is that Nord Stream is a poor template. It was a pipeline policy during an active war, and Stewarts expects insurers to rely on it where wordings refer to loss caused “directly or indirectly” by war (Stewarts Law, 19/08/2026). Standard property policies have historically treated sabotage as covered (Insurance Business, 03/09/2026), and state involvement in land attacks is often unproven: German prosecutors did not publicly identify the client of paid arson plots, and state complicity needs evidence of recruitment, financing or coordination (Robert Lansing Institute, 30/10/2026). A minister’s verdict is not a coverage decision (Insurance Business, 25/09/2026).
The causal test is the point. It needs a significant cause, not a named perpetrator, and the court found it met with the perpetrator unknown (Stewarts Law, 19/08/2026). Our reading is that arson by hired foreign nationals for a foreign client sits closer to that test than to vandalism, because proxies leave room to deny state involvement (Robert Lansing Institute, 30/10/2026). Whether property wordings carry the same reading is untested. That uncertainty is the exposure.
Implications
This is durable change with uncertain timing. The inflection window runs from the 2027 renewals to the first contested sabotage claim on land assets. Operators that document their wordings, retained-loss capacity and attribution assumptions before then gain a usable position; those that assume cover lose bargaining room once a claim is disputed. The judgment is the canonical record of how the Commercial Court read the exclusion (National Archives, 06/07/2026).
Early Indicators to Monitor
- An insurer or reinsurer cites the Nord Stream judgment to decline or cut a European infrastructure sabotage claim, reported in the specialist press before 31 December 2027.If this happens: The reading has moved from case law into claims practice; the posture moves from Prepare to Decide on retained loss and wording.
- A market body or major insurer publishes a clause on state-linked sabotage for property or energy policies before 30 June 2027.If this happens: Wordings are changing; ask for the clause and a buy-back at renewal, and re-price exposed sites.
- Berlin or another government formally attributes a further infrastructure attack to a state, in an official statement, before 30 June 2027.If this happens: More losses will arrive carrying a state label; test asset schedules against war exclusion language.
- HM Treasury or Pool Re announces a review of state-linked sabotage within the scheme’s scope before 31 December 2027.If this happens: A state backstop may follow; hold large specialist-cover commitments until the scope is known.
- A second European government adopts insider-vetting or sabotage-protection rules for critical infrastructure before 30 June 2027.If this happens: The controls are becoming general; extend the exposure map beyond Germany.
Disconfirming Signals
- The Nord Stream judgment is overturned or narrowed on appeal before 31 December 2027.
- A court or tribunal holds a state-linked sabotage loss on land property covered under an all-risks policy before 31 December 2027.
- Major insurers state publicly that they will not rely on war exclusions for sabotage with unproven attribution.
- Pool Re or a European terrorism scheme extends cover to state-linked sabotage before 31 December 2027.
- German police report fewer suspected sabotage cases in the first half of 2027 than in the same period of 2026.
Strategic Questions
- Should we buy specialist political violence cover for sabotage now, or wait for the market to settle its wording?
- Do we ask brokers for a written war exclusion position at this renewal, or after a contested claim?
- Which of our current activities looks least wise if this signal lands?
Keywords
Nord Stream ruling; war exclusion; hybrid threats; state-linked sabotage; unattributed attack; property all-risks insurance; Pool Re; critical infrastructure protection; political violence cover; grey-zone aggression; retained loss
Bibliography
Source tiers: Tier 1, governments, regulators and intergovernmental bodies. Tier 2, think-tanks, academic institutes, major consultancies and quality data providers. Tier 3, quality journalism and specialist trade press. Tier 4, vendor, company and practitioner sources, used only as directional corroboration.
- Tier 1 Nord Stream AG v Lloyd’s Insurance Company SA & Anor [2026] EWHC 1685 (Comm). The National Archives (Find Case Law) (06/07/2026).
- Tier 1 Schutz der kritischen Infrastruktur wird verstärkt (German-language source). Die Bundesregierung (28/10/2026).
- Tier 2 Nord Stream ruling broadens the reach of war exclusions. Stewarts Law LLP (19/08/2026).
- Tier 2 Russia’s Sabotage Campaign in Europe: The Belarusian Connection, Attacks on Critical Infrastructure, and the Risk of Expanding Hybrid Warfare Against NATO. Robert Lansing Institute (30/10/2026).
- Tier 3 Now it’s arson: Germany’s infrastructure incidents are now an insurance underwriting question. Insurance Business (Insurance News) (03/09/2026).
- Tier 3 Poland says Starlink station hit by sabotage, blames Russia. Insurance Business (Insurance News) (25/09/2026).
- Tier 3 Germany records 165 suspected sabotage cases and more than 1,000 suspicious drones in 2026. hromadske (04/09/2026).
- Tier 3 Germany to expand security vetting of critical infrastructure staff to curb sabotage risk. Clean Energy Wire (29/10/2026).