A recent event that received surprisingly little media attentionserves as a reminder of a lurking cyber risk that is different inkind and scale than more widely and frequently reportedprivacy-related data breaches.

Between July 29 and September 14, 2016, a series of fires and explosions occurred atpetrochemical plants and pipelines in Iran. Although Iraniangovernment officials initially denied that the fires were caused bya cyber attack, they later acknowledged that Iran's petrochemicalindustry has been the target of cyber attacks, and the head of acyber security firm specializing in protecting industrial systemsstated that he was "100 percent" sure that the fires were theresult of hacking.

Unlike more common data breaches, which result in disclosure ofprivate information to an unauthorized third party, these cyberattacks were simply intended to cause damage more like large-scalevandalism. Costs associated with data breaches are generallycovered under cyber insurance. But what about a cyber attack thatcauses physical damage and business interruption on a catastrophicscale? That is not the type of loss ordinarily covered by mostcyber insurance policies. Such losses may, however, be coveredunder the broad language of a company's traditional propertypolicies.