Merck Awarded $1.4B Insurance Payout over NotPetya Attack

Court rules ‘War or Hostile Acts’ exclusion doesn’t apply to the pharma giant’s 2017 cyberattack.

Unsealed court records show pharmaceutical giant Merck was awarded a $1.4 billion payout last month on its property insurance policy, for losses the company suffered because of the 2017 NotPetya cyberattacks.

Merck’s cyber-insurance company, International Indemnity, was claiming the losses fell under the “War or Hostile Acts” exclusion. That’s because in Oct. 2020, the U.S. Department of Justice charged six Russian nationals with the NotPetya attacks with alleged ties to Russian military intelligence.

The Superior Court of New Jersey ruled the exclusion was “inapplicable.”

Merck’s $1.75 billion property insurance policy will have to cover the damage the NotPetya attacks did to the company’s 40,000 computers, totaling more than $1.4 billion, according to the court filing.

The ruling also explains that any “ambiguity” in the language of an insurance policy should, by legal precedent, be interpreted to meet the “reasonable expectations” of the policy holder.

Insurance Policy Language

Insurance companies are already tightening up policy language to stave off nation-state cybersecurity claims.

Lloyds of London recently took measures to hedge against cybersecurity claims, announcing last November that it will no longer cover “cyber-war”

Read More: