A New Jersey appeals court ruled last week that an exclusion for ‘hostile/warlike action’ in insurance policies covering "all risks" didn’t bar a pharmaceutical company’s claim for damages in a cyberattack.
The New Jersey Superior Court’s Appellate Division ruled for Merck & Co. Inc. on May 1.
Merck’s computer and network systems were infected with NotPetya malware in June 2017 through accounting software made by a Ukrainian company. Merck said the malware caused more than $1.4 billion in losses.
The insurance defendants had contended that the exclusion for ‘hostile/warlike action’ applies when a government or a sovereign power takes action that reflects ill will or an intent to harm. In this case, the NotPetya virus was linked to the Russian Federation, the insurers said.