What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Merck won an appellate ruling that its insurers could not use the policies’ hostile- or warlike-action exclusion to bar coverage for losses from the 2017 NotPetya attack. But the New Jersey court did not award Merck $1.4 billion: that figure is the approximate amount of losses Merck said it suffered. The decision affirmed a coverage ruling under the wording and circumstances of this case, not a universal rule for cyberattacks.
Did Merck win its $1.4 billion insurance claim?
In the coverage dispute, yes: on May 1, 2023, the New Jersey Appellate Division affirmed a trial court’s partial summary judgment for Merck. It held that the insurers had not shown that the hostile/warlike-action exclusion applied to the facts before the court. The ruling addressed whether the exclusion barred coverage; it was not a new damages award of $1.4 billion.
Insurance Journal reported that Merck’s claimed losses were approximately $1.4 billion. The company sought coverage under 26 all-risks property policies in its 2017–2018 insurance program. The Appellate Division described the program as having $1.75 billion in total limits above a $150 million deductible. Those policy figures describe the program, not an amount the appellate court ordered insurers to pay in its decision. Insurance Journal’s May 2, 2023 report; New Jersey Appellate Division opinion.
What happened in the NotPetya attack?
In June 2017, NotPetya malware spread through an update associated with M.E. Doc, accounting software used by companies operating in Ukraine. According to the New Jersey Courts’ published summary, more than 40,000 machines on Merck’s network were infected, and the malware reached at least 64 countries, disrupting the company’s global operations. The Appellate Division opinion; New Jersey Courts’ case summary.
Merck filed an insurance claim under its all-risks property policies. Insurers denied coverage, relying on exclusions for hostile or warlike action. The resulting dispute was about how that exclusion applied to this loss—not a general lawsuit to determine whether NotPetya was an act of war under international law.
Why did the court reject the insurers’ war-exclusion argument?
The Appellate Division read the exclusion in the context of the policy and applied New Jersey rules for interpreting insurance exclusions. It concluded that the clause required military action. The insurers argued for a broad reading of “hostile” that could encompass government action reflecting ill will, but the court found that reading did not fit the policy language in the circumstances presented.
The opinion emphasized that the attack affected a non-military company and commercial users of accounting software. It said the insurers had not carried their burden to show that the exclusion applied. As the court put it, “The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action.” New Jersey Appellate Division opinion, May 1, 2023.
Did the court decide that NotPetya was not an act of war?
No. The court resolved an insurance-policy question: whether these insurers had established that this exclusion barred coverage for these losses. It did not make a categorical finding about NotPetya’s status as an act of war, nor did it define when all state-sponsored cyberattacks qualify under war exclusions.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The opinion expressly limited its discussion to the record and policy before it: “We have addressed the exclusion in terms of the presented circumstances before us.” The court declined to set the precise boundary for cyberattacks that might fall within such exclusions. New Jersey Appellate Division opinion.
What happened after the Appellate Division ruling?
The trial court granted partial summary judgment for Merck on December 6, 2021. The insurers appealed, and the Appellate Division affirmed on May 1, 2023. The New Jersey Supreme Court granted leave to appeal on July 19, 2023, then dismissed the appeal by order on January 26, 2024. The court tracker records a dismissal by order, not a later merits opinion in the case. Appellate Division opinion; New Jersey Supreme Court appeal tracker.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can an insurer deny a cyberattack claim under a war exclusion?
It depends on the policy wording and the facts established in the claim. Merck’s result does not prevent insurers from invoking war or hostile-action exclusions in other cyber incidents. It shows that, in this dispute, the insurers did not establish that the exclusion applied under the court’s interpretation of the specific wording and record.
When assessing another cyber-insurance dispute, the questions that matter include:
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Best Value
- What exactly does the war or hostile-action exclusion say?
- Does it expressly address cyber operations?
- How does the exclusion interact with the policy’s coverage grant and other exclusions?
- What connection between the attack and military action is established by the evidence?
- What did the court actually decide, and at what procedural stage?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
