N.J. Appeals Court Rules War Exclusion Doesn’t Apply to NotPetya Attack

Insurers may not use a war exclusion to deny coverage to Merck & Co. for a 2017 cyberattack blamed on the Russian military, a panel of the New Jersey Appellate Division ruled.

The panel affirmed a decision by the Union County Superior Court that a “Hostile/Warlike Action” exclusion in the pharmaceutical giant’s property insurance policies does not apply to the NotPetya ransomware attack that damaged Merck’s computers. The ruling allows Merck to proceed with its claim against eight insurance carriers for $699,475,000 in disputed coverage.

“Coverage could only be excluded here if we stretched the meaning of ‘hostile’ to its outer limit in an attempt to apply it to a cyberattack on a noncombatant firm that provided accounting software updates to various noncombatant customers, all wholly outside the context of any armed conflict or military objective,” the Appellate Division’s opinion says. “But that approach would conflict with our basic construction principles requiring a court to narrowly construe an insurance policy exclusion.”

Peter Halprin, an insurance recovery attorney with the Pasich law firm in New York, said the decision shows that insurers have a duty to draft clear and unambiguous exclusions, and courts will not rewrite exclusionary language.

“The Court reiterated key insurance policy interpretation principles, including the importance of all risk coverage, the breadth of coverage provisions, and the narrow construction of exclusionary language,” he said in an email.

Merck and other companies that did business in Ukraine used a third-party application called M.E. Doc to transmit tax and financial information to the Ukrainian government. Hackers used a backdoor within the software to implant the NotPetya malware, which encrypted data within Merck’s computer network and demanded a ransom payment.

The virus rapidly infected 40,000 computers within Merck’s network, reaching 64 countries. A cyber consultant for insurers, Kroll Cyber Security, reported that the attack was likely orchestrated by the Russian Federation.

Merck sent a notice of loss to the 26 carriers in its insurance tower. It filed suit after most responded with reservation of rights letters that noted the hostile and warlike acts exclusion.

Merck’s insurers appealed after the Union County court ruled that the war exclusion does not apply. Merck settled with many of its carriers, but eight holdouts remained by the time the Appellate Division ruled on the appeal. Ace American, Allianz, Liberty Mutual and Lloyd’s syndicates were among those that kept up the fight.

The American Property and Casualty Insurance Association stepped into the fray with an amicus brief supporting the insurers, while policyholder advocates filed their own friend-of-the-court briefs in support of Merck.

The insurers argued that the exclusion was clear and ambiguous: No coverage exists for damage caused by hostile or warlike acts by a sovereign power, in this case the Russian Federation.

The appellate panel, however, said the exclusion does not apply unless there is some military action.

“The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will,” the opinion says.