As cyberattacks become more sophisticated and more frequent, South African businesses face escalating risk – not only to their data, but to their physical assets and operational continuity.

Automation and digitalisation are creating opportunities for growth and efficiency, but they are also opening up new vulnerabilities, including the risk of physical damage and business interruption caused by cyber incidents.

The recent escalation of cyberattacks linked to the conflict in the Middle East has underscored the geopolitical dimension of cyber-property risk. State-sponsored actors and hacktivist groups have increasingly targeted critical infrastructure such as power grids and industrial facilities, demonstrating how regional conflicts can rapidly amplify cyber-physical threats and insurance exposures globally.

Many organisations underestimate the threat and find themselves uninsured or underinsured. Traditional insurance policies often fall short of providing comprehensive coverage for these incidents. To protect themselves, businesses must adopt customised insurance solutions alongside robust risk mitigation strategies that specifically address cyber-related property damage and business interruption.

How a cyberattack can cause physical damage

Cyberattacks targeting operational technology are affecting a growing number of organisations across every sector. It is no longer a matter of if, but when. By one estimate, the number of sites globally experiencing physical operational impairments due to cyberattacks surged 146% in 2024, rising from 412 in 2023 to 1 015. Most of these attacks affected multiple physical locations.

In Africa, the cyber insurance market is expanding rapidly but remains underpenetrated. The Middle East and Africa cyber insurance market was valued at approximately US$283-million in 2024 and is projected to grow significantly. Despite limited specific loss data, cybercrime has been estimated to reduce Africa’s GDP by more than 10%, equating to losses in excess of $4-billion, with ransomware and digital transformation driving increased risk exposure. Many African businesses still operate without adequate cyber insurance or mature cybersecurity controls, highlighting a critical protection gap that mirrors the challenges faced by South African companies.

The following examples demonstrate how threat actors can cause physical damage to different types of organisations.

Mines: A cyberattack on a mine can disrupt critical safety systems, including gas detectors, ventilation controls and emergency shutdown mechanisms. Operational disruptions of this kind may allow hazardous conditions to go unnoticed, increasing the risk of accidents or injuries. Communication systems may also be compromised, delaying emergency responses or evacuations. Production processes are vulnerable, too – attacks targeting operational technology such as automated drilling equipment, conveyor belts or processing systems can lock operators out or manipulate data, causing costly downtime, operational inefficiency or equipment damage.
Manufacturing: In manufacturing, cyberattacks can target equipment, critical infrastructure and management systems, potentially halting production entirely. Malicious code may manipulate or disable the control systems that operate machinery, leading to mechanical failures or malfunctions. Environmental control systems regulating temperature and humidity can also be disrupted. Safety systems may be compromised, increasing the risk of accidents if monitoring or emergency controls are tampered with or disabled. The result can be substantial financial losses due to lost output and repair costs.
Power grids: Cyberattacks on electricity grids can target physical infrastructure, smart buildings and the control systems responsible for power generation, transmission and distribution. Cybercriminals can manipulate control systems, resulting in equipment malfunctions, overloads or failures in transformers, circuit breakers and substations. This can cause physical damage to critical components such as turbines, generators and switchgear. Disruption of safety mechanisms may trigger cascading failures or fires, further damaging infrastructure. Prolonged outages can cause secondary damage, including degradation of backup systems and equipment impairment due to overheating. Repairs are costly and time consuming, and can lead to extended power outages affecting large populations and industries.

There are numerous real-world examples of cyberattacks causing significant disruption across industries. In 2021, a cyberattack on a US fuel pipeline halted oil flow, while an attack on a German steel mill disrupted operations and caused severe damage to its blast furnace. In another case, a former hospital employee infected the facility’s machines with malware, compromising the heating, ventilation and air-conditioning system. The manipulation endangered patient safety, underscoring the urgent need to address the specific risks of cyberattacks and insider threats in healthcare settings.

The consequences of attacks of this kind have included payment of ransoms; loss of access to design tools on engineering workstations; loss of visibility through human-machine interfaces or alarm systems; loss of historical data; disruption of quality assurance systems; inaccessibility of analytics tools; compromise of supervisory control and data acquisition (Scada) functions; inability to authenticate users; reputational damage; and the compromise of smart infrastructure, autonomous systems and real-time monitoring.

It is worth noting that physical consequences and business interruption can also arise from non-malicious cyber events, such as the global technology outage triggered by the CrowdStrike software update in 2024.

A major uninsured liability

Despite the rising threat of physical damage caused by cyberattacks, physical cyber risk remains one of the most substantial uninsured liabilities on the balance sheets of many South African companies. A decade ago, coverage for physical cyber risk was often included within property insurance policies. As the insurance market has evolved, however, most existing property policies now exclude cyber-related risks.

The cyber insurance market has responded by introducing risk assessments and specialised products to close this protection gap. These products are available either through exclusionary buybacks or on an affirmative basis, specifically covering cyber-physical risk.

How to protect uninsured property cyber risk

Marsh can help organisations safeguard themselves by conducting a comprehensive gap analysis of their property insurance programmes to identify and address coverage gaps. We quantify the potential financial impact of cyber property damage and business interruption risk, enabling clients to optimise insurance coverage and strengthen risk management strategies – including employee training and the enhancement of cyber tools and security controls.

With the current market favouring buyers, now is an ideal time to explore securing specialised cyber property damage coverage to protect assets and operations. For more information, please contact your Marsh risk advisor.