War exclusion does not apply in Merck malware insurance dispute, court finds

Insurers cannot use a war exclusion to deny Merck & Co. Inc. coverage for the losses it suffered in the NotPetya malware attack in 2017, a New Jersey court has found.

On Dec. 6, 2021, Judge Thomas Walsh of the Superior Court of New Jersey granted Merck's motion for a partial summary judgment that a "hostile/warlike action" exclusion in its policies is inapplicable to the long-running coverage dispute, court filings published Jan. 13, 2022, show.

Merck and International Indemnity Ltd., a Merck-owned "captive" insurer that covers some of the group's risks, sued 33 insurers and reinsurers, including 13 Lloyd's of London syndicates, in 2018 after they refused to pay out for the more than $1.4 billion in damage the company estimates it incurred in the malware attack. Merck made the claims under $1.75 billion of property insurance that provided cover for, among other things, loss or damage resulting from destruction or corruption of computer data and software.

The insurers argued that the policies' hostile/warlike action exclusions applied because the NotPetya attack was part of Russia's hostilities against Ukraine.

Seven countries, including the U.S. and the U.K., blamed the attack on Russia. The White House described NotPetya as "part of the Kremlin's ongoing effort to destabilize Ukraine" in a February 2018 statement.

In his order, the judge said the court reached a decision that the exclusion does not apply "unhesitatingly" given the "plain meaning" of the exclusion and preceding case law. Walsh listed several cases that had centered on war and hostile acts exclusions and said that no court had applied such an exclusion "to anything remotely close to the facts herein." He added that, despite the increase in cyberattacks from private sources and nation states, Merck's insurers did nothing to change the language to indicate it intended to exclude such attacks. As a result, "Merck had every right to anticipate that the exclusion applied only to traditional forms of warfare," the order said.

Lawyers have previously warned of the difficulties of using war exclusions to deny coverage in cyberattack-related cases.

In a similar coverage dispute, Zurich American Insurance Co., part of Zurich Insurance Group AG, is relying on a "hostile or warlike action" exclusion in a bid to avoid NotPetya-related claims brought by food company Mondelez International Inc. under a property policy.

NotPetya hit thousands of companies around the world, and Property Claim Services has previously estimated the attack could cost the insurance industry more than $3 billion.