Hacker Attacks as Force Majeure: Russian and International Courts Diverge on Liability for Cyber Incidents

In the early hours of November 2, 2026, the infrastructure of Russian hosting provider Beget came under a large-scale cyber attack. Websites stopped loading, virtual servers failed, email services collapsed, DNS resolution broke, and the management panel became unreachable. Thousands of clients experienced prolonged outages whose full recovery timeline remained uncertain.

The most notable development was legal. Beget formally notified customers of circumstances bearing the hallmarks of force majeure, citing paragraph 3 of Article 401 of the Russian Civil Code and existing contracts. The provider carefully avoided claiming that a court had already established force majeure, stating only that qualifying signs existed. For site owners facing lost orders and inaccessible corporate services, the distinction offered little practical relief.

Why a cyber attack does not automatically constitute force majeure

Article 401 allows a party to escape liability if it proves that proper performance was impossible due to extraordinary and unavoidable circumstances. Courts assess not only the fact of an attack but also its character: whether the event was extraordinary, whether it could have been prevented by a comparable market participant, and whether a direct causal link exists to the specific obligation.

Hosting providers face a particular challenge. DDoS attacks, ransomware, and infrastructure failures are well-known industry risks. Professional suppliers are expected to design systems with these threats in mind. Nevertheless, an attack of unusual scale or one exploiting a previously unknown vulnerability may still qualify as force majeure if the provider can demonstrate extraordinary circumstances and unavoidable consequences.

Russian court practice: when references to hackers failed

Russian arbitration courts have developed consistent reasoning: the mere fact of a cyber attack does not prove impossibility of performance. Judges examine the nature of the obligation, duration of the outage, actions taken by the affected company, and availability of alternative performance methods.

In cases A40-98900/2022 and A40-129508/2022, logistics operator IML failed to transfer funds under an agency agreement after a May 2021 attack damaged documentation and blocked accounting systems. Despite incident reports and a criminal case, the court held that the company had not proved attempts to restore records or use alternative payment methods. Security of its own information systems was deemed an ordinary business duty.

In A28-8461/2022, Energosbyt Plus sought penalties from a biochemical plant for late payment. The defendant blamed DDoS attacks on the state alcohol accounting system EGAIS in early May 2022. The court acknowledged the three-day disruption but noted that the payment deadline fell on May 11, after the attack ended. No causal link was established.

A rare successful recognition occurred in A15-1085/2022. A Dagestan state institution sought nearly 11 million rubles in penalties from a fuel supplier after card-system failures. The supplier proved a three-day DDoS attack and the appellate court accepted it as force majeure, though it also considered contract performance, proportionality of claims, and special rules for state contracts.

In A56-85885/2024, Timeweb defeated a 5.26 million ruble claim by Sanata after a 2023 outage. Courts found the contract did not impose a duty to protect client data against third-party actions and that the client had not purchased separate DDoS protection. The Supreme Court refused to review the case in June 2026.

In A40-293189/2022, Makhachkala International Airport sought 2.4 million rubles after its site was destroyed. The contract required DDoS protection, yet courts distinguished protection against traffic overload from guarantees against data destruction via other attack vectors. The Supreme Court declined review in March 2024.

International practice

Foreign courts apply similar scrutiny. In France, the Paris Court of Appeal in 2020 ordered Mise à Jour Informatique to pay 41,172 euros after ransomware Locky encrypted files belonging to Euro et Expertise Monétique. The provider had billed for backup services yet maintained no usable copies for months.

In Norway, a 2021 Ryuk attack on Nordlo Haugesund led to data loss for client Btec. The court rejected force majeure but limited damages to 8,280 kroner under standard contract terms capping liability at three months of service fees.

In the United States, Expeditors faced claims from iRobot after a 2022 ransomware incident. A 57-page business continuity plan did not prevent the court from leaving the force majeure question open for trial in March 2026.

In the Netherlands, a July 2025 attack on the public prosecutor’s systems via an unknown Citrix NetScaler vulnerability was recognized as force majeure because no patch existed and the agency acted reasonably to isolate systems.

What determines the outcome and what clients should do

Key factors include the technical mechanism of the attack, chronology of events, and documented protective measures. Even without force majeure recognition, clients must still prove breach of specific obligations and quantify losses. Standard hosting contracts often cap compensation at a few months of fees and exclude lost profits.

Clients are advised to document outage periods with independent monitoring, review contract versions in force at the time, submit timely claims, request technical explanations from providers, and maintain independent backups and domain control outside the primary infrastructure.