Civil Law and National Critical Infrastructure Cyberwarfare Damage Claims in Europe

1. Introduction

National critical infrastructure cyberwarfare damage claims concern civil claims arising when a cyberattack affects infrastructure that is essential to a State or society, such as:

• electricity and energy networks;
• hospitals and healthcare systems;
• telecommunications;
• banking and payment systems;
• water and sewage systems;
• transport and airports;
• ports;
• government digital infrastructure;
• satellites and space-related infrastructure;
• cloud and data-centre facilities.

The difficult legal question is often who must compensate the victim when a cyber operation causes physical, financial, contractual, or data-related damage.

European law does not have one single comprehensive private-law regime called “cyberwarfare liability.” Instead, claims may arise under national civil/tort law, contract law, cybersecurity legislation, data-protection law, product liability, insurance law, public-authority liability, and human-rights principles.

A major complication is attribution. A cyberattack may be conducted by a private criminal group, a State, a State-sponsored group, or an unidentified actor. Establishing the identity of the attacker is not necessarily the same thing as proving the civil liability of a particular defendant.

2. Meaning of Critical Infrastructure Cyberwarfare Damage

A useful distinction is:

Cyberattack

A cyberattack may involve:

• ransomware;
• malware;
• denial-of-service attacks;
• destructive malware;
• unauthorized access;
• supply-chain compromise;
• manipulation of industrial-control systems;
• theft or destruction of data.

Cyberwarfare

Cyberwarfare generally refers to cyber operations connected with armed conflict or State-level strategic operations.

Not every serious cyberattack legally amounts to an “armed attack” or act of war. The legal classification depends on the circumstances and applicable international law.

Civil damage claim

A civil claim may seek compensation for:

1. physical damage;
2. business interruption;
3. loss of profits;
4. restoration costs;
5. contractual losses;
6. personal injury;
7. death;
8. data-related damage;
9. reputational harm;
10. environmental damage;
11. cybersecurity remediation expenses.

3. European Legal Framework

A. National civil liability law

European States retain their own rules concerning:

• negligence;
• unlawful acts;
• causation;
• foreseeability;
• contributory negligence;
• strict liability;
• damages;
• limitation periods.

For example, French, German, Italian, Spanish and Dutch civil-law systems use different formulations of fault, causation and damages.

Therefore, the first question is normally:

Which country's substantive civil law governs the claim?

4. EU Cybersecurity Framework

The EU has progressively strengthened cybersecurity obligations for operators of essential and important infrastructure.

The NIS/NIS2 framework is particularly important for:

• energy;
• transport;
• health;
• digital infrastructure;
• banking;
• financial-market infrastructure;
• public administration;
• water;
• digital providers and other critical sectors.

However, cybersecurity legislation does not automatically create a private damages claim for every cyber incident.

A claimant generally still has to establish:

duty → breach → causation → legally recoverable damage.

5. GDPR and Cyberattacks

Where a cyberattack involves personal data, the GDPR may become relevant.

Article 82 GDPR provides a framework for compensation for material and non-material damage resulting from infringement of the GDPR.

This creates an important distinction:

Cybersecurity failure + personal-data infringement = potentially separate data-protection compensation claim.

Thus, a hospital attacked by ransomware could potentially face:

• contractual claims;
• negligence claims;
• regulatory proceedings;
• GDPR claims;
• employment claims;
• insurance disputes.

6. Cybersecurity Duty of Care

A critical infrastructure operator may be expected to implement appropriate security measures.

Possible failures include:

• inadequate access controls;
• failure to patch critical systems;
• insufficient network segmentation;
• poor authentication;
• inadequate backup systems;
• failure to monitor suspicious activity;
• inadequate incident-response planning;
• failure to protect industrial-control systems;
• inadequate third-party/vendor security.

The existence of a cyberattack does not automatically establish negligence.

The claimant must normally show that the defendant's security measures were legally inadequate in the circumstances.

7. Causation

Causation is one of the most difficult elements.

Suppose:

State-sponsored hackers attack an electricity operator → malware enters through a contractor → electricity supply fails → factory production stops.

Several questions arise:

1. Was the operator negligent?
2. Was the contractor negligent?
3. Did the attacker break the chain of causation?
4. Was the loss foreseeable?
5. Were adequate backup systems available?
6. Did the claimant mitigate the loss?
7. Was the interruption too remote?

European civil-law systems generally require a sufficiently established causal connection between the wrongful conduct and the damage.

8. Force Majeure and Act of War

Defendants may argue:

“The cyberattack was an unforeseeable act of war or force majeure.”

This is not automatically successful.

Courts may examine:

• foreseeability;
• preventability;
• contractual allocation of risk;
• applicable statutory rules;
• whether reasonable cybersecurity measures were available;
• whether the event was genuinely beyond the defendant's control.

A sophisticated cyberattack can therefore raise a force-majeure issue without automatically eliminating liability.

9. State Liability

When the alleged wrongdoer is a government or public authority, different principles arise.

Possible claims concern:

• failure to protect infrastructure;
• failure to maintain public cybersecurity;
• unlawful governmental interference;
• inadequate emergency response;
• failure to investigate;
• failure to protect life and property.

European human-rights jurisprudence is particularly important where cyber incidents threaten:

• life;
• physical integrity;
• private life;
• property;
• access to essential services.

10. Six Important European Cases

Because direct reported European judgments specifically concerning State-sponsored cyberwarfare damage compensation remain relatively limited, some authorities below are analogous cybersecurity, data-protection, infrastructure, or State-liability cases. They are useful for understanding the civil-liability principles that would be applied to cyberwarfare damage.

Case 1 — C-340/21, VB v Natsionalna agentsia za prihodite (CJEU, 2023)

Facts

The Bulgarian National Revenue Agency suffered a cyberattack in which personal data were unlawfully disclosed.

A claimant sought compensation for alleged non-material damage resulting from the cybersecurity incident.

Legal issue

Whether fear of misuse of personal data following a cyberattack can constitute compensable damage under the GDPR.

Principle

The CJEU addressed the relationship between:

• unauthorized disclosure;
• security measures;
• risk of misuse;
• non-material damage;
• compensation under Article 82 GDPR.

The Court emphasized that the assessment must consider whether security measures were appropriate in the circumstances.

Importance

This is highly relevant to critical infrastructure cyber incidents because public authorities and essential-service operators frequently process large amounts of personal data.

Key lesson:

A cyberattack does not automatically establish liability; the adequacy of security measures and actual compensable damage remain important.

Case 2 — C-687/21, Deutsche Wohnen v Staatsanwaltschaft Berlin (CJEU, 2023)

Facts

The case concerned administrative liability for GDPR infringements and the conditions under which an undertaking could be held responsible.

Principle

The CJEU examined the conditions for imposing liability and sanctions under the GDPR, including the relationship between organizational responsibility and fault.

Relevance to critical infrastructure

Critical infrastructure operators often operate through complex corporate structures.

For example:

parent company → infrastructure subsidiary → cybersecurity provider → cloud provider.

The case demonstrates the importance of identifying the legally responsible entity rather than simply assuming that the largest organization in the chain is liable.

Case 3 — C-300/21, Österreichische Post AG v UI (CJEU, 2023)

Facts

A data subject claimed compensation following unlawful processing of personal data.

The issue concerned whether an infringement of GDPR itself automatically produces a right to compensation.

Principle

The CJEU clarified that an infringement of the GDPR does not automatically mean that compensation is payable without damage.

There must be:

1. an infringement;
2. damage;
3. a causal connection between the infringement and the damage.

Importance

This principle is particularly important after a cyberwarfare incident.

A claimant cannot simply say:

“There was a cyberattack, therefore compensation is automatically due.”

The claimant generally must establish the legally relevant damage and causation.

Case 4 — C-340/21, Natsionalna agentsia za prihodite — adequacy of security measures

The same CJEU litigation is particularly important for another reason: it addressed whether a cyberattack itself demonstrates that the technical and organizational measures were inadequate.

Principle

A successful cyberattack does not automatically prove that an organization breached its security obligations.

Courts must examine:

• the state of technology;
• implementation of security measures;
• risks involved;
• costs of implementation;
• nature of the personal data;
• likelihood and seriousness of risks.

Critical-infrastructure application

Suppose a national electricity operator suffers a sophisticated zero-day attack.

The fact that the attack succeeded would not by itself prove negligence.

The claimant would need to demonstrate that the operator failed to take security measures reasonably required in the circumstances.

Case 5 — Öneryıldız v Turkey, ECtHR Grand Chamber (2004)

Facts

A methane explosion occurred at a municipal rubbish dump in Istanbul, killing members of a family living nearby.

Principle

The European Court of Human Rights examined the State's positive obligations concerning dangerous infrastructure and known risks.

The Court recognized that public authorities can have obligations to take preventive measures where they know or ought to know about serious risks to life.

Cyberwarfare relevance

Although this was not a cyber case, the principle is highly relevant to critical infrastructure.

For example:

If authorities know that a hospital, nuclear facility, electricity grid or water system faces a serious cyber risk, failure to take reasonable preventive measures could potentially engage State responsibility where protected rights are seriously endangered.

Important distinction

The case concerns State obligations under the ECHR, not a general rule imposing automatic civil damages for cyberattacks.

Case 6 — Budayeva and Others v Russia, ECtHR (2008)

Facts

The case concerned deaths and property damage caused by mudslides in an area exposed to known natural hazards.

Principle

The ECtHR examined whether public authorities had taken reasonable preventive measures against a known and foreseeable danger.

Cyber-infrastructure relevance

The analogy is useful for situations where a government knows that essential infrastructure faces serious technological risks.

For example:

• repeated warnings concerning a vulnerable power grid;
• known vulnerabilities in emergency communication systems;
• known vulnerabilities in hospital networks.

The legal question becomes whether reasonable protective measures were available and whether authorities failed to take them.

Case 7 — López Ostra v Spain, ECtHR (1994)

Facts

The applicant lived near a waste-treatment facility that caused serious environmental pollution.

Principle

The ECtHR recognized that serious environmental interference can affect rights protected under Article 8 ECHR.

Cyberwarfare analogy

A cyberattack can sometimes cause consequences beyond data loss.

For example:

cyberattack → water-treatment failure → contamination → serious interference with private and family life.

The case therefore helps demonstrate how infrastructure failures can develop into human-rights issues when they substantially affect individuals' homes, health or private life.

Case 8 — Guerra and Others v Italy, ECtHR (1998)

Facts

Residents lived near a chemical factory presenting serious risks.

The applicants complained about the authorities' failure to provide important information concerning the danger.

Principle

The case is important for the relationship between:

• dangerous industrial activities;
• governmental information;
• environmental risk;
• private and family life.

Cybersecurity relevance

For critical infrastructure, similar questions may arise regarding:

• disclosure of serious cyber risks;
• emergency warnings;
• public information;
• notification of affected individuals;
• transparency following an infrastructure attack.

Again, this is an analogical authority, not a cyberwarfare judgment.

11. Case-Law Table

12. Supply-Chain Cyberattack Liability

Modern critical infrastructure is rarely operated by one entity.

A typical chain might be:

Government authority → infrastructure operator → IT supplier → cloud provider → cybersecurity vendor → subcontractor

A cyberattack may enter through any layer.

Civil litigation may therefore involve:

• contractual warranties;
• indemnity clauses;
• limitation clauses;
• professional negligence;
• product liability;
• service-level agreements;
• cybersecurity obligations;
• insurance coverage.

The claimant must identify the contractual and statutory relationship applicable to each defendant.

13. Cybersecurity Vendor Liability

Suppose a cybersecurity company promises:

“24/7 protection against cyber intrusion.”

A sophisticated attack subsequently causes infrastructure shutdown.

Possible questions include:

• What exactly did the contract promise?
• Was the service merely reasonable security monitoring?
• Was prevention guaranteed?
• Were known vulnerabilities reported?
• Did the customer ignore warnings?
• Was the attack outside the agreed scope?
• Does the contract contain a liability cap?

The answer depends heavily on the contract and governing national law.

14. Government Infrastructure and Civil Claims

A public authority may potentially face claims where:

• it negligently operates infrastructure;
• it ignores known cybersecurity vulnerabilities;
• it fails to maintain emergency systems;
• it unlawfully interferes with private property;
• its conduct causes physical injury or death.

But public-authority liability varies substantially between European legal systems.

Some States use specialized public-law liability regimes, while others apply concepts derived from ordinary civil liability.

15. Physical Damage Caused by Cyber Operations

This is particularly important.

Consider:

malware enters a railway control system → signals malfunction → collision occurs.

The resulting claim may involve:

• personal injury;
• death;
• property damage;
• railway operator liability;
• manufacturer liability;
• software-provider liability;
• cybersecurity negligence;
• insurance.

Similarly:

cyberattack → hospital equipment disabled → patient injury.

The legal analysis may involve medical liability, product liability, contractual liability and cybersecurity duties simultaneously.

16. Pure Economic Loss

Cyberwarfare frequently produces economic losses without physical damage.

Examples:

• loss of business;
• payment-system interruption;
• trading losses;
• lost contracts;
• restoration expenses;
• lost data;
• business interruption.

European legal systems differ considerably in their treatment of pure economic loss.

Therefore, the claimant must determine:

Does the applicable national law recognize this category of loss in the particular circumstances?

17. Insurance Claims

Cyberwarfare frequently creates insurance disputes.

Typical questions include:

Was the event covered?

The policy may cover:

• cyberattack;
• malware;
• ransomware;
• business interruption.

But it may exclude:

• war;
• hostile acts;
• State-sponsored attacks;
• terrorism;
• infrastructure failure.

Attribution problem

Insurance disputes can become extremely difficult because proving that an attack was conducted by a particular State may be difficult.

A policy may also use different definitions of:

• cyberterrorism;
• war;
• hostile act;
• cyberattack.

18. Force Majeure

A defendant may argue that the attack constitutes force majeure.

Typical requirements in civil-law systems may include concepts such as:

• externality;
• unforeseeability;
• irresistibility or unavoidable character.

However, the precise test varies by jurisdiction.

A critical issue is:

Could reasonable cybersecurity measures have prevented or reduced the damage?

If the defendant had ignored known vulnerabilities, the force-majeure argument may become more difficult.

19. Contributory Fault

The claimant's own conduct may reduce compensation.

Examples:

• failure to install security updates;
• sharing passwords;
• ignoring security warnings;
• using unsupported software;
• failing to maintain backups;
• failure to isolate compromised systems.

Civil-law systems may therefore reduce damages where the claimant contributed to the loss.

20. Damages

Possible heads of damages include:

Direct losses

• repair costs;
• system restoration;
• replacement hardware;
• emergency cybersecurity services.

Consequential losses

• business interruption;
• lost profits;
• contractual penalties;
• supply-chain losses.

Personal losses

• injury;
• death;
• psychological harm where legally compensable.

Data-related losses

• material damage;
• non-material damage;
• privacy-related harm.

Property losses

• destruction of machinery;
• damage to buildings;
• damage caused by malfunctioning infrastructure.

21. Cyberwarfare and the Concept of “Act of War”

A particularly difficult question is whether:

State-sponsored cyber operation = war

The answer is not automatically yes.

International law distinguishes between:

• cyber espionage;
• cybercrime;
• politically motivated cyber operations;
• cyber operations associated with armed conflict;
• uses of force;
• armed attacks.

The classification can affect:

• insurance;
• force majeure;
• State responsibility;
• jurisdiction;
• contractual liability.

22. Private Defendant vs State Actor

This distinction is essential.

If a private company caused the loss

The claim may involve:

• negligence;
• contract;
• product liability;
• professional liability.

If a criminal group caused the loss

The criminal group may be difficult to identify or recover against, but other defendants could potentially be examined for independent negligence.

If a foreign State conducted the operation

Issues of:

• State responsibility;
• sovereign immunity;
• jurisdiction;
• attribution;
• international law

become much more significant.

23. Sovereign Immunity

A State accused of conducting a cyber operation may invoke sovereign immunity in domestic proceedings.

Therefore:

Identifying the foreign State as the alleged attacker does not necessarily mean that a European private court can simply award damages against it.

Jurisdiction and immunity must be considered separately from the merits of the underlying claim.

24. Jurisdiction and Applicable Law

Cyberattacks are inherently cross-border.

Example:

Attacker: Russia
Infrastructure: Germany
Cloud provider: Ireland
Victim company: France
Insurer: Netherlands

Several legal systems may potentially be involved.

European private international law therefore becomes important, including:

• Brussels I Recast;
• Rome I;
• Rome II;
• GDPR territorial rules;
• national procedural rules.

The court must determine:

1. jurisdiction;
2. applicable substantive law;
3. contractual versus tortious classification;
4. limitation period;
5. recoverable damages.

25. Evidence in Cyberwarfare Litigation

Evidence is often the most difficult practical issue.

Important evidence includes:

• server logs;
• network traffic;
• malware samples;
• forensic reports;
• threat-intelligence reports;
• access records;
• emails;
• security alerts;
• penetration-testing reports;
• vulnerability assessments;
• backup records;
• incident-response reports.

Courts may need expert evidence to determine:

What happened, how it happened, and whether the defendant's conduct contributed to the damage.

26. Standard of Proof

The claimant normally needs to establish the relevant facts under the applicable procedural law.

Important questions include:

• Who accessed the system?
• How did the attacker enter?
• Was there a known vulnerability?
• Was the vulnerability patched?
• Did the defendant receive warnings?
• Could the damage have been prevented?
• Was the loss caused by the cyberattack or by a later independent event?

Attribution to a foreign government may require particularly sophisticated evidence.

27. NIS2 and Civil Liability

NIS2 significantly strengthens cybersecurity governance and incident-reporting obligations for covered entities.

But an important exam point is:

Regulatory non-compliance and civil liability are related but not necessarily identical.

A breach of cybersecurity legislation may provide important evidence of failure to meet a required standard, but the claimant still needs to establish the requirements of the relevant civil claim.

28. Critical Infrastructure Sectors

Cyberwarfare damage litigation may arise in:

Energy

• electricity grids;
• gas pipelines;
• oil infrastructure;
• renewable-energy control systems.

Healthcare

• hospitals;
• emergency systems;
• medical databases;
• medical devices.

Transport

• airports;
• railways;
• ports;
• traffic-control systems.

Finance

• banks;
• clearing systems;
• payment networks.

Water

• water treatment;
• sewage;
• pumping systems.

Telecommunications

• mobile networks;
• internet infrastructure;
• satellite communication.

29. Important Legal Issues — Exam Format

A critical-infrastructure cyberwarfare claim can be analysed through the following sequence:

1. Identify the infrastructure

↓

2. Identify the cyber incident

↓

3. Identify the defendant

↓

4. Determine the applicable law

↓

5. Establish duty

↓

6. Establish breach

↓

7. Establish causation

↓

8. Prove damage

↓

9. Consider force majeure

↓

10. Consider contributory negligence

↓

11. Consider insurance

↓

12. Determine jurisdiction

↓

13. Determine available remedies

30. Difference Between Cybercrime and Cyberwarfare Claims

31. Key Legal Principles

Principle 1 — Attack ≠ automatic liability

The occurrence of a cyberattack does not itself establish civil liability.

Principle 2 — Security measures matter

Courts may examine whether reasonable technical and organizational measures were implemented.

Principle 3 — Damage must be established

The claimant generally needs legally recognizable damage.

Principle 4 — Causation is essential

The claimant must connect the defendant's conduct with the loss.

Principle 5 — Attribution is separate

Identifying the cyber attacker and establishing the defendant's civil liability are different questions.

Principle 6 — Public authorities have special obligations

Where life or fundamental rights are threatened, ECtHR jurisprudence concerning positive State obligations can become relevant.

Principle 7 — Cross-border litigation is normal

Cyber infrastructure frequently crosses several jurisdictions.

Principle 8 — Insurance wording matters

War, hostile-act and cyber exclusions can materially affect recovery.

32. Short Case-Law Revision Notes

33. Ultra-Basic Keywords

For quick examination revision:

Cyberwarfare → Critical Infrastructure → Cyberattack → NIS2 → GDPR → Security Measures → Duty of Care → Breach → Causation → Damage → Force Majeure → Attribution → State Responsibility → Sovereign Immunity → Insurance → Jurisdiction → Compensation.

34. Conclusion

National critical infrastructure cyberwarfare damage claims in Europe lie at the intersection of civil liability, cybersecurity regulation, data protection, insurance, public-authority liability and international law.

The central civil-law question is not simply:

“Who launched the cyberattack?”

It is:

“Which legally responsible person or organization owed the relevant duty, whether that duty was breached, whether the breach caused legally compensable damage, and which legal system governs the claim?”

The CJEU's GDPR jurisprudence, particularly VB v Natsionalna agentsia za prihodite and Österreichische Post, provides important principles concerning cybersecurity, damage and causation. The ECtHR authorities such as Öneryıldız, Budayeva, López Ostra and Guerra provide analogous principles concerning State preventive obligations, dangerous infrastructure, information and protection of fundamental rights.

Thus, European civil liability for cyberwarfare damage is best understood as a multi-layered system, rather than as a single standalone cyberwarfare tort.