Insurers Must Pay Merck's $1.4B Losses For NotPetya

Uploaded on 2023-05-09 in FREE TO VIEW, BUSINESS-Services-Financial

Merck's insurers can't use an "act of war" clause to deny the pharmaceutical giant an enormous payout to clean up its NotPetya infection, a court has ruled and Merck may now be entitled to a large insurance payout from the high-profile NotPetya cyber attack provided an appeals court ruling stands.

The appellate court in New Jersey has ruled that insurance companies must pay more than $1.4 billion to cover losses incurred when Merck’s systems became infected with NotPetya malware in 2017. The court ruled that the war exclusions the insurance companies were invoking in a bid to deny coverage did not apply in the case of the cyber attack.

The case stemmed from a ransomware attack Merck suffered in June 2017 on the eve of Ukraine’s Constitution Day. The NotPetya malware was delivered into an accounting software developed by a Ukrainian company that was used by Merck and other companies, according to the court’s description of events. More than 40,000 machines in Merck’s global network were infected.

The U.S. government later attributed the attack to Russia’s military intelligence operations and charged six Russian officers in connection with the event.

Pointing to Russian military involvement, Merck’s insurers invoked the hostile/warlike action exclusion clause in their policies and refused to cover the company’s losses.An appellate court recently officially rejected an argument by the insurers for Merck & Co. that they are not liable for the pharmaceutical giant's $1.4 billion in losses following a 2017 cyber attack because the incident fell under exclusions for acts of war.

The New Jersey appellate court judges said that in order for a cyber attack to fall under any type of war exclusion it must involve military action.

The Russian-backed NotPetya malware was found to be behind the cyberattack, and since Merck's Ukraine operations were initially targeted, insurers claimed the breach was an extension of military hostilities following Russia's invasion of Ukraine. "The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action," the judges explained in their ruling. "Coverage could only be excluded here if we stretched the meaning of 'hostile' to its outer limit."

Covington & Burlington LLP: Law360: Dark Reading: Bloomberg: Fierce Pharma: SANS: The Register:

You Might Also Read:

Insurers Will Exclude Some Nation-State Cyber Attacks From Cover:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.