Merck Won $699 Million of NotPetya Cover When a Court Read “Warlike Action” to Mean War

NotPetya reached Merck & Co. on June 27, 2017, through a poisoned update to Ukrainian accounting software, and disabled about 10,000 machines in 90 seconds and more than 40,000 in all. Merck put its loss at about $1.4 billion and claimed under 26 all-risk property policies with $1.75 billion in limits. Most insurers denied coverage on Aug. 20, 2018, citing an exclusion for hostile or warlike action by a government or sovereign power. Merck had sued them 18 days earlier in Union County, New Jersey.

On Dec. 6, 2021, Judge Thomas J. Walsh granted Merck partial summary judgment on the exclusion. The ruling became public in January 2022. The Appellate Division affirmed on May 1, 2023, and the New Jersey Supreme Court agreed to hear the insurers’ appeal in July. In early January 2024 the parties told the court they had settled on confidential terms. Eight insurers remained, and the amount in dispute was $699,475,000.

The exclusion’s language dated from an era of armies. The trial court found that the insurers had done nothing to change it despite years of known cyber risk, and that a reasonable policyholder would read warlike action to mean something involving military force. The appeals court agreed that the exclusion required military action and did not reach a cyberattack on an accounting-software vendor and its commercial customers, whoever instigated it. Attribution to Russia, which the insurers’ consultant Kroll had asserted with high confidence, was never decided. The courts held it did not matter.

Merck claimed under all-risk property cover, which promised to pay for loss or damage including to electronic data. Mondelez made the same argument against Zurich over the same attack, filed at 22-1031, and settled mid-trial. The cases established that a property policy written without a cyber exclusion covered a cyber loss, and that a war exclusion written for war did not remove it.

The insurers lost the words and rewrote them. Lloyd’s of London required state-backed cyberattack exclusions in standalone cyber policies from March 2023, filed at 22-0816, with attribution mechanisms written into the clause. The Merck rulings are why those clauses exist: the old exclusion did not do what the market thought it did, and the settlement, whatever its terms, was cheaper than a supreme court ruling saying so.