Merck & Co.’s recent settlement of a longstanding coverage issue involving a 2017 cyberattack has ramifications for other disputes about the application of traditional war exclusions to cyber-related losses perpetrated by foreign governments, McGuireWoods Atlanta partner Shelby Guilbert and associate Shelby Peek wrote in a Jan. 24, 2024, article in Law360. The issue initially was addressed on McGuireWoods’ Pro Policyholder blog.
The authors analyzed Merck & Co. v. ACE American Insurance Co., which involved over $1.4 billion in losses stemming from a NotPetya cyberattack that damaged tens of thousands of Merck computers. The dispute concerned whether the insurance policies’ “hostile/warlike” exclusion applied to the attack, which some intelligence agencies have attributed to Russian government attempts to destabilize Ukraine.
The New Jersey Superior Court rejected the insurers’ attempt to deny coverage based on the war exclusion and ruled in Merck’s favor, holding that the war exclusion did not apply to cyberattacks, and the case was appealed to the New Jersey Supreme Court. Although the case settled before oral arguments, the New Jersey Superior Court’s rejection of a broad interpretation of traditional war exclusions for cyberattacks is causing the insurance industry to add new exclusions to restrict cyber coverage for attacks perpetrated by nation-states or state-based actors, the authors wrote.
“As the wording of these exclusions continues to evolve in response to changing understandings of the nature of warfare itself, corporate policyholders evaluating their readiness for a cyber event should review their various lines of insurance holistically to reduce the risk of unanticipated gaps in coverage,” Guilbert and Peek wrote.