Cyber operations are becoming an increasing part of armed conflict. This article assesses whether cyber operations against data during an armed conflict could amount to a war crime in the Statute of the International Criminal Court. It unpacks the plausibility of computer data being included in the categories of ‘object’ and ‘property’ in the Statute, showing there is no doctrinal and jurisprudential unanimity in either case. However, the Court can and should take a wide view of when tangible objects are affected in a legally relevant way by attacks on or through data. Considering this question forces us to reflect about the proper interpretation of the Statute in light of the principle of legality, and about whether and how the Statute will be able to ‘keep up’ with new forms of warfare.