Mondelez International and Zurich American Insurance settled their dispute over NotPetya coverage on confidential terms in late October 2022, with reporting on Oct. 27 and the following week. Mondelez had sued in Cook County, Illinois, on Oct. 10, 2018, claiming more than $100 million under an all-risk property policy after the June 27, 2017, attack rendered about 1,700 servers and 24,000 laptops permanently unusable.
Zurich had denied the claim by letter on June 1, 2018, citing an exclusion for hostile or warlike action in time of peace or war by a government or sovereign power. The denial rested on the U.S. and U.K. governments’ February 2018 attribution of NotPetya to Russia. A Zurich spokesperson said the parties had mutually resolved the matter. Mondelez declined to comment.
The Case That Did Not Produce A Ruling
Mondelez was the first NotPetya war-exclusion case filed and the one the market watched. It settled with no decision on the exclusion. The ruling came instead from Merck’s parallel case in New Jersey, filed at 22-0121, where a court held in December 2021 that the exclusion required military action. By the time Mondelez settled, that ruling existed, Lloyd’s had issued the bulletin filed at 22-0816 requiring new state-backed exclusions, and Zurich’s prospects at trial had been shaped by both.
What Was Actually In Dispute
The policy was not cyber insurance. It was property cover that promised to pay for physical loss or damage, including to electronic data, programs and software. Whether malware that bricked 24,000 machines was physical damage, and whether an exclusion drafted for artillery reached it, were the questions. A 2021 ruling had already limited part of the claim to a $10 million sublimit. The rest went to trial in October 2022 and did not come back.
The file is graded medium because the settlement is confidential and the trial’s exact posture at settlement differs between reports. What is certain is that neither side wanted the ruling, and that the market got its answer from Merck instead.
Compiled from the complaint as hosted by The Register, and from contemporaneous reporting of the settlement, listed below. Settlement terms are confidential. Whether trial had begun or was near conclusion varies by source. Graded medium on that basis. Corrections: corrections@forensicpost.com.
- Mondelez and Zurich settle over NotPetyaThe Register
- Mondelez and Zurich reach settlement in NotPetya cyberattack insurance suitThe Record
- Mondelez, Zurich settle NotPetya cyber insurance suitCybersecurity Dive
- Zurich Invokes War Exclusion in Battle Over Coverage for NotPetya AttackHunton Andrews Kurth