Image credit: shutterstock.com/g/gorodenkoff
Merck and its insurance companies have settled their lawsuit involving a 2017 cyber attack. The litigation involved a dispute about whether a war exclusion applied to a NotPetya cyber attack.
On June 27,2017, a malware attack, that was traced back to Russian’s GRU (aka KGB) triggered a worldwide event that is estimated to have caused over $10B in economic losses. This attack was aimed at disrupting the Ukrainian economy, and hit many companies including Merck, Mondelez, and Maersk.
Merck had insurance limits of $1.75B and claimed damages of $1.4B from this attack. Half of Merck’s insurers argued that the war exclusion in the policy excluded coverage.
In May 2023, a New Jersey appellate court ruled that the war exclusion did not apply to the claim. The appellate court ruled that the language in the war exclusion did not apply as,
“Coverage could only be excluded here if we stretched the meaning of ‘hostile’ to its outer limit in an attempt to apply it to a cyberattack on a noncombatant firm that provided accounting software updates to various noncombatant customers, all wholly outside the context of any armed conflict or military objective.”
The case was appealed to the Supreme Court of New Jersey, and oral arguments were scheduled for the beginning of January 2024. The parties have since reached a settlement and the details have not yet been disclosed.
It’s important to note that this ruling applies to property policies, not standalone cyber insurance policies. These exposures are currently being addressed on standalone policies and insureds are encouraged to work with their brokers to ensure that they are properly covered.
If you have questions about your insurance policies and want to make sure you are properly protected, reach out to TSIB and speak with one of our Risk Consultants. 
TSIB’s Risk Consultants are currently servicing the following locations:
East Coast: New York City, NY; Bergen County, NJ; Fairfield County, CT; Philadelphia, PA
Texas: Austin, San Antonio, Houston, Dallas
California: Orange County, Los Angeles County, Riverside County, San Bernardino County, San Diego County
