Civil Law And National Critical Infrastructure Cyberwarfare Damage Claims In Europe

Lawgratis • October 3, 2026

Civil Law and National Critical Infrastructure Cyberwarfare Damage Claims in Europe

National critical infrastructure cyberwarfare damage claims concern civil claims arising when a cyberattack affects infrastructure that is essential to a State or society, such as:

electricity and energy networks;

hospitals and healthcare systems;

banking and payment systems;

water and sewage systems;

transport and airports;

government digital infrastructure;

satellites and space-related infrastructure;

cloud and data-centre facilities.

The difficult legal question is often who must compensate the victim when a cyber operation causes physical, financial, contractual, or data-related damage .

European law does not have one single comprehensive private-law regime called “cyberwarfare liability.” Instead, claims may arise under national civil/tort law, contract law, cybersecurity legislation, data-protection law, product liability, insurance law, public-authority liability, and human-rights principles .

A major complication is attribution. A cyberattack may be conducted by a private criminal group, a State, a State- group, or an unidentified actor. Establishing the identity of the attacker is not necessarily the same thing as proving the civil liability of a particular defendant.

2. Meaning of Critical Infrastructure Cyberwarfare Damage

A useful distinction is:

A cyberattack may involve:

denial-of-service attacks;

supply-chain compromise;

manipulation of industrial-control systems;

theft or destruction of data.

Cyberwarfare generally refers to cyber operations connected with armed conflict or State-level strategic operations.

Not every serious cyberattack legally amounts to an “armed attack” or act of war . The legal classification depends on the circumstances and applicable international law.

A civil claim may seek compensation for:

business interruption;

environmental damage;

cybersecurity remediation expenses.

3. European Legal Framework

A. National civil liability law

European States retain their own rules concerning:

contributory negligence;

For example, French, German, Italian, Spanish and Dutch civil-law systems use different formulations of fault, causation and damages.

Therefore, the first question is normally:

Which country's substantive civil law governs the claim?

4. EU Cybersecurity Framework

The EU has progressively strengthened cybersecurity obligations for operators of essential and important infrastructure.

The NIS/NIS2 framework is particularly important for:

digital infrastructure;

financial-market infrastructure;

public administration;

digital providers and other critical sectors.

However, cybersecurity legislation does not automatically create a private damages claim for every cyber incident .

A claimant generally still has to establish:

duty → breach → causation → legally recoverable damage.

5. GDPR and Cyberattacks

Where a cyberattack involves personal data, the GDPR may become relevant.

Article 82 GDPR provides a framework for compensation for material and non-material damage resulting from infringement of the GDPR.

This creates an important distinction:

Cybersecurity failure + personal-data infringement = potentially separate data-protection compensation claim.

Thus, a hospital attacked by ransomware could potentially face:

regulatory proceedings;

6. Cybersecurity Duty of Care

A critical infrastructure operator may be expected to implement appropriate security measures.

Possible failures include:

inadequate access controls;

failure to patch critical systems;

insufficient network segmentation;

inadequate backup systems;

failure to monitor suspicious activity;

inadequate incident-response planning;

failure to protect industrial-control systems;

inadequate third-party/vendor security.

The existence of a cyberattack does not automatically establish negligence .

The claimant must normally show that the defendant's security measures were legally inadequate in the circumstances.

Causation is one of the most difficult elements.

State- hackers attack an electricity operator → malware enters through a contractor → electricity supply fails → factory production stops.

Several questions arise:

Was the operator negligent?

Was the contractor negligent?

Did the attacker break the chain of causation?

Was the loss foreseeable?

Were adequate backup systems available?

Did the claimant mitigate the loss?

Was the interruption too remote?

European civil-law systems generally require a sufficiently established causal connection between the wrongful conduct and the damage.

8. Force Majeure and Act of War

Defendants may argue:

“The cyberattack was an unforeseeable act of war or force majeure.”

This is not automatically successful.

contractual allocation of risk;

applicable statutory rules;

whether reasonable cybersecurity measures were available;

whether the event was genuinely beyond the defendant's control.

A sophisticated cyberattack can therefore raise a force-majeure issue without automatically eliminating liability.

When the alleged wrongdoer is a government or public authority, different principles arise.

Possible claims concern:

failure to protect infrastructure;

failure to maintain public cybersecurity;

unlawful governmental interference;

inadequate emergency response;

failure to investigate;

failure to protect life and property.

European human-rights jurisprudence is particularly important where cyber incidents threaten:

access to essential services.

10. Six Important European Cases

Because direct reported European judgments specifically concerning State- cyberwarfare damage compensation remain relatively limited, some authorities below are analogous cybersecurity, data-protection, infrastructure, or State-liability cases . They are useful for understanding the civil-liability principles that would be applied to cyberwarfare damage.

Case 1 — C-340/21, VB v Natsionalna agentsia za prihodite (CJEU, 2023)

The Bulgarian National Revenue Agency suffered a cyberattack in which personal data were unlawfully disclosed.

A claimant sought compensation for alleged non-material damage resulting from the cybersecurity incident.

Whether fear of misuse of personal data following a cyberattack can constitute compensable damage under the GDPR.

The CJEU addressed the relationship between:

unauthorized disclosure;

compensation under Article 82 GDPR.

The Court emphasized that the assessment must consider whether security measures were appropriate in the circumstances.

This is highly relevant to critical infrastructure cyber incidents because public authorities and essential-service operators frequently process large amounts of personal data.

A cyberattack does not automatically establish liability; the adequacy of security measures and actual compensable damage remain important.

Case 2 — C-687/21, Deutsche Wohnen v Staatsanwaltschaft Berlin (CJEU, 2023)

The case concerned administrative liability for GDPR infringements and the conditions under which an undertaking could be held responsible.

The CJEU examined the conditions for imposing liability and sanctions under the GDPR, including the relationship between organizational responsibility and fault.

Relevance to critical infrastructure

Critical infrastructure operators often operate through complex corporate structures.

parent company → infrastructure subsidiary → cybersecurity provider → cloud provider.

The case demonstrates the importance of identifying the legally responsible entity rather than simply assuming that the largest organization in the chain is liable.

Case 3 — C-300/21, Österreichische Post AG v UI (CJEU, 2023)

A data subject claimed compensation following unlawful processing of personal data.

The issue concerned whether an infringement of GDPR itself automatically produces a right to compensation.

The CJEU clarified that an infringement of the GDPR does not automatically mean that compensation is payable without damage.

a causal connection between the infringement and the damage.

This principle is particularly important after a cyberwarfare incident.

A claimant cannot simply say:

“There was a cyberattack, therefore compensation is automatically due.”

The claimant generally must establish the legally relevant damage and causation.

Case 4 — C-340/21, Natsionalna agentsia za prihodite — adequacy of security measures

The same CJEU litigation is particularly important for another reason: it addressed whether a cyberattack itself demonstrates that the technical and organizational measures were inadequate.

A successful cyberattack does not automatically prove that an organization breached its security obligations.

the state of technology;

implementation of security measures;

costs of implementation;

nature of the personal data;

likelihood and seriousness of risks.

Critical-infrastructure application

Suppose a national electricity operator suffers a sophisticated zero-day attack.

The fact that the attack succeeded would not by itself prove negligence.

The claimant would need to demonstrate that the operator failed to take security measures reasonably required in the circumstances.

Case 5 — Öneryıldız v Turkey, ECtHR Grand Chamber (2004)

A methane explosion occurred at a municipal rubbish dump in Istanbul, killing members of a family living nearby.

The European Court of Human Rights examined the State's positive obligations concerning dangerous infrastructure and known risks.

The Court recognized that public authorities can have obligations to take preventive measures where they know or ought to know serious risks to life.

Cyberwarfare relevance

Although this was not a cyber case , the principle is highly relevant to critical infrastructure.

If authorities know that a hospital, nuclear facility, electricity grid or water system faces a serious cyber risk, failure to take reasonable preventive measures could potentially engage State responsibility where protected rights are seriously endangered.

Important distinction

The case concerns State obligations under the ECHR , not a general rule imposing automatic civil damages for cyberattacks.

Case 6 — Budayeva and Others v Russia, ECtHR (2008)

The case concerned deaths and property damage caused by mudslides in an area exposed to known natural hazards.

The ECtHR examined whether public authorities had taken reasonable preventive measures against a known and foreseeable danger.

Cyber-infrastructure relevance

The analogy is useful for situations where a government knows that essential infrastructure faces serious technological risks.

repeated warnings concerning a vulnerable power grid;

known vulnerabilities in emergency communication systems;

known vulnerabilities in hospital networks.

The legal question becomes whether reasonable protective measures were available and whether authorities failed to take them.

Case 7 — López Ostra v Spain, ECtHR (1994)

The applicant lived near a waste-treatment facility that caused serious environmental pollution.

The ECtHR recognized that serious environmental interference can affect rights protected under Article 8 ECHR.

A cyberattack can sometimes cause consequences beyond data loss.

cyberattack → water-treatment failure → contamination → serious interference with private and family life.

The case therefore helps demonstrate how infrastructure failures can develop into human-rights issues when they substantially affect individuals' homes, health or private life.

Case 8 — Guerra and Others v Italy, ECtHR (1998)

Residents lived near a chemical factory presenting serious risks.

The applicants complained the authorities' failure to provide important information concerning the danger.

The case is important for the relationship between:

dangerous industrial activities;

governmental information;

private and family life.

Cybersecurity relevance

For critical infrastructure, similar questions may arise regarding:

disclosure of serious cyber risks;

notification of affected individuals;

transparency following an infrastructure attack.

Again, this is an analogical authority , not a cyberwarfare judgment.

12. Supply-Chain Cyberattack Liability

Modern critical infrastructure is rarely operated by one entity.

A typical chain might be:

Government authority → infrastructure operator → IT supplier → cloud provider → cybersecurity vendor → subcontractor

A cyberattack may enter through any layer.

Civil litigation may therefore involve:

contractual warranties;

professional negligence;

service-level agreements;

cybersecurity obligations;

The claimant must identify the contractual and statutory relationship applicable to each defendant.

13. Cybersecurity Vendor Liability

Suppose a cybersecurity company promises:

“24/7 protection against cyber intrusion.”

A sophisticated attack subsequently causes infrastructure shutdown.

Possible questions include:

What exactly did the contract promise?

Was the service merely reasonable security monitoring?

Was prevention guaranteed?

Were known vulnerabilities reported?

Did the customer ignore warnings?

Was the attack outside the agreed scope?

Does the contract contain a liability cap?

The answer depends heavily on the contract and governing national law.

14. Government Infrastructure and Civil Claims

A public authority may potentially face claims where:

it negligently operates infrastructure;

it ignores known cybersecurity vulnerabilities;

it fails to maintain emergency systems;

it unlawfully interferes with private property;

its conduct causes physical injury or death.

But public-authority liability varies substantially between European legal systems.

Some States use specialized public-law liability regimes, while others apply concepts derived from ordinary civil liability.

15. Physical Damage Caused by Cyber Operations

This is particularly important.

malware enters a railway control system → signals malfunction → collision occurs.

The resulting claim may involve:

railway operator liability;

manufacturer liability;

software-provider liability;

cybersecurity negligence;

cyberattack → hospital equipment disabled → patient injury.

The legal analysis may involve medical liability, product liability, contractual liability and cybersecurity duties simultaneously.

16. Pure Economic Loss

Cyberwarfare frequently produces economic losses without physical damage.

payment-system interruption;

restoration expenses;

business interruption.

European legal systems differ considerably in their treatment of pure economic loss .

Therefore, the claimant must determine:

Does the applicable national law recognize this category of loss in the particular circumstances?

Cyberwarfare frequently creates insurance disputes.

Typical questions include:

Was the event covered?

The policy may cover:

business interruption.

State- attacks;

infrastructure failure.

Insurance disputes can become extremely difficult because proving that an attack was conducted by a particular State may be difficult.

A policy may also use different definitions of:

A defendant may argue that the attack constitutes force majeure.

Typical requirements in civil-law systems may include concepts such as:

irresistibility or unavoidable character.

However, the precise test varies by jurisdiction.

Could reasonable cybersecurity measures have prevented or reduced the damage?

If the defendant had ignored known vulnerabilities, the force-majeure argument may become more difficult.

19. Contributory Fault

The claimant's own conduct may reduce compensation.

failure to install security updates;

ignoring security warnings;

using unsupported software;

failing to maintain backups;

failure to isolate compromised systems.

Civil-law systems may therefore reduce damages where the claimant contributed to the loss.

Possible heads of damages include:

replacement hardware;

emergency cybersecurity services.

business interruption;

contractual penalties;

psychological harm where legally compensable.

privacy-related harm.

destruction of machinery;

damage caused by malfunctioning infrastructure.

21. Cyberwarfare and the Concept of “Act of War”

A particularly difficult question is whether:

State- cyber operation = war

The answer is not automatically yes.

International law distinguishes between:

politically motivated cyber operations;

cyber operations associated with armed conflict;

The classification can affect:

State responsibility;

contractual liability.

22. Private Defendant vs State Actor

This distinction is essential.

If a private company caused the loss

The claim may involve:

professional liability.

If a criminal group caused the loss

The criminal group may be difficult to identify or recover against, but other defendants could potentially be examined for independent negligence.

If a foreign State conducted the operation

State responsibility;

become much more significant.

23. Sovereign Immunity

A State accused of conducting a cyber operation may invoke sovereign immunity in domestic proceedings.

Identifying the foreign State as the alleged attacker does not necessarily mean that a European private court can simply award damages against it.

Jurisdiction and immunity must be considered separately from the merits of the underlying claim.

24. Jurisdiction and Applicable Law

Cyberattacks are inherently cross-border.

Attacker: Russia Infrastructure: Germany Cloud provider: Ireland Victim company: France Insurer: Netherlands

Several legal systems may potentially be involved.

European private international law therefore becomes important, including:

GDPR territorial rules;

national procedural rules.

The court must determine:

applicable substantive law;

contractual versus tortious classification;

25. Evidence in Cyberwarfare Litigation

Evidence is often the most difficult practical issue.

Important evidence includes:

threat-intelligence reports;

penetration-testing reports;

vulnerability assessments;

incident-response reports.

Courts may need expert evidence to determine:

What happened, how it happened, and whether the defendant's conduct contributed to the damage.

26. Standard of Proof

The claimant normally needs to establish the relevant facts under the applicable procedural law.

Important questions include:

Who accessed the system?

How did the attacker enter?

Was there a known vulnerability?

Was the vulnerability patched?

Did the defendant receive warnings?

Could the damage have been prevented?

Was the loss caused by the cyberattack or by a later independent event?

Attribution to a foreign government may require particularly sophisticated evidence.

27. NIS2 and Civil Liability

NIS2 significantly strengthens cybersecurity governance and incident-reporting obligations for covered entities.

But an important exam point is:

Regulatory non-compliance and civil liability are related but not necessarily identical.

A breach of cybersecurity legislation may provide important evidence of failure to meet a required standard, but the claimant still needs to establish the requirements of the relevant civil claim.

28. Critical Infrastructure Sectors

Cyberwarfare damage litigation may arise in:

renewable-energy control systems.

traffic-control systems.

internet infrastructure;

satellite communication.

29. Important Legal Issues — Exam Format

A critical-infrastructure cyberwarfare claim can be analysed through the following sequence:

1. Identify the infrastructure

2. Identify the cyber incident

3. Identify the defendant

4. Determine the applicable law

7. Establish causation

9. Consider force majeure

10. Consider contributory negligence

11. Consider insurance

12. Determine jurisdiction

13. Determine available remedies

30. Difference Between Cybercrime and Cyberwarfare Claims

31. Key Legal Principles

Principle 1 — Attack ≠ automatic liability

The occurrence of a cyberattack does not itself establish civil liability.

Principle 2 — Security measures matter

Courts may examine whether reasonable technical and organizational measures were implemented.

Principle 3 — Damage must be established

The claimant generally needs legally recognizable damage.

Principle 4 — Causation is essential

The claimant must connect the defendant's conduct with the loss.

Principle 5 — Attribution is separate

Identifying the cyber attacker and establishing the defendant's civil liability are different questions.

Principle 6 — Public authorities have special obligations

Where life or fundamental rights are threatened, ECtHR jurisprudence concerning positive State obligations can become relevant.

Principle 7 — Cross-border litigation is normal

Cyber infrastructure frequently crosses several jurisdictions.

Principle 8 — Insurance wording matters

War, hostile-act and cyber exclusions can materially affect recovery.

32. Short Case-Law Revision Notes

33. Ultra-Basic Keywords

For quick examination revision:

Cyberwarfare → Critical Infrastructure → Cyberattack → NIS2 → GDPR → Security Measures → Duty of Care → Breach → Causation → Damage → Force Majeure → Attribution → State Responsibility → Sovereign Immunity → Insurance → Jurisdiction → Compensation.

National critical infrastructure cyberwarfare damage claims in Europe lie at the intersection of civil liability, cybersecurity regulation, data protection, insurance, public-authority liability and international law .

The central civil-law question is not simply:

“Who launched the cyberattack?”

“Which legally responsible person or organization owed the relevant duty, whether that duty was breached, whether the breach caused legally compensable damage, and which legal system governs the claim?”

The CJEU's GDPR jurisprudence, particularly VB v Natsionalna agentsia za prihodite and Österreichische Post , provides important principles concerning cybersecurity, damage and causation. The ECtHR authorities such as Öneryıldız , Budayeva , López Ostra and Guerra provide analogous principles concerning State preventive obligations, dangerous infrastructure, information and protection of fundamental rights.

Thus, European civil liability for cyberwarfare damage is best understood as a multi-layered system , rather than as a single standalone cyberwarfare tort.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Legal Framework for Cyberwarfare Damage Claims in Europe The articles discuss the complexities of civil claims arising from cyberattacks on national critical infrastructure in Europe. Key sectors affected include energy, healthcare, banking, and government digital infrastructure. The lack of a unified European legal framework complicates damage claims, as liability may stem from various national laws. Attribution of attacks remains a significant challenge, as cyber incidents may involve state actors or private groups. The EU's NIS/NIS2 framework aims to enhance cybersecurity obligations but does not automatically grant private damages claims. GDPR provisions may apply in cases involving personal data breaches. The articles highlight the need for businesses to understand their cyber liability insurance options to mitigate financial losses from such attacks. 1 sources 41

Civil Law And National Critical Infrastructure Cyberwarfare Damage Claims In Europe

The full story

Extracted Entities

Attack Types (5)

Industries (4)