Is a Russian Cyber Attack an Excluded Act of War?

The Superior Court of New Jersey, Law Division, recently held that a malware attack incident was not an act of war as excluded by the traditional war exclusions in the applicable property policies. The case is Merck & Co. Inc. vs. Ace American Insurance Co. et al, N.J. Super. Ct., No. L-002682-18, summary judgment 1/13/22.

Pharmaceutical giant Merck & Co. sued insurers over coverage for $1.4 billion losses from malware known as NotPetya in a cyber-attack occurring in 2017. Merck sued its insurers after they denied coverage for NotPetya’s impacts to the pharma company’s computer systems, citing the “acts of war” exclusion in the property policies. The malware attack was attributed to Russia’s military intelligence agency, deployed as part of a conflict with Ukraine.