I Think The Panel Will Ultimately Decide That This WAS Covered; Not An "Act of War": Re Merck's NotPetya Malware Infection Of 2017

We covered this at length in real time, about six years ago now. And it certainly cost over a billion for Merck to effectively remediate it, and restore full and secured service on its networks. It did look to have been launched by actors affiliated with Russian interests, but that was never proved -- and shipping companies were likely the primary targets, not the pharma giant (nor the food company, Mondelēz). Both were likely just in the collateral damage path.

In a correctly reasoned trial court opinion, the judge ruled that Merck was covered by its business interruption insurance policy for most of the damages. But the insurers have appealed, saying this was an act of war, and thus is excluded under decades old policy language. Two problems (at least): (i) there is no state of war between any nation (even remotely implicated) and the US then, or right now; and (ii) the damage essentially all took place on US-based computers (over 80% of the total). Inside a secure, peaceful bucolic corporate campus. Nothing like an "act of war" -- by any official government or sovereign power.

In any event, here is that most recent appeal of a loss by insurers story -- and a bit:

. . .The costly NotPetya cyberattack, which the U.S. blamed on Russia, should be considered a “cyber nuclear attack,” insurers argued as they urged judges to overturn a legal win by Merck & Co. in a dispute that could have broad ramifications for business insurance.

Merck, which had an estimated $1.4 billion in losses after NotPetya invaded its computer systems in 2017, suffered the collateral damage of a warlike act not covered by insurance, lawyers for a group of carriers told judges Wednesday in a state appeals court in Trenton, N.J.

“NotPetya was massive,” said Philip C. Silverberg, a lawyer representing several of Merck’s insurers. “It was a virtual cyber nuclear attack.”

The legal dispute between the Rahway, N.J.-based pharmaceutical company and its insurers centers on what is known as a war exclusion, a relatively common clause in many policies that says insurers don’t have to pay out if the loss traces back to warlike hostilities. Even the home and auto insurance policies of many Americans deny coverage if a foreign power bombs their dwelling or vehicle, a provision that insurers include to protect themselves from the runaway losses that a wide-scale conflict could bring. . . .

The insurers appealed after a lower court judge sided with Merck in 2021. That judge found that based on the plain meaning of the policy language, the exclusion didn’t apply. Groups representing businesses of all kinds, from hospitals to manufacturers to restaurants, have come forward to back Merck, arguing that they depend on having reliable coverage. . . .

Chicago-based Mondelez International Inc. sued insurer Zurich American Insurance in 2018 over NotPetya costs that the snack maker said surpassed $100 million, but that case ended in a settlement. Details of that agreement weren’t disclosed. . . .

This will be interesting, and of course we will report the decision, when handed down. But I expect we will hear that Merck was covered. Onward, into the sunshine -- and the physics mystery posed by the image in the masthead. Smiling, on a Friday when we will see Martin Shkreli's defense of the FTC's assertion that he has violated his life-time ban by trying to start something he calls "Druglike". How droll.

नमस्ते