Insurers duck NotPetya cyber war exclusion ruling, settle with Merck

Insurers have side-stepped what could have been a watershed ruling on cyber war exclusions, striking terms for settlement with pharma giant Merck before a US court ruled on the matter. 

Sides backed off from the court proceedings just before arguing an insurer-led appeal of a lower court ruling that war exclusions don't get them off the hook for the NotPetya attack, Bloomberg first reported from the case.  

No terms of any settlement were released, Bloomberg said of developments. 

At the time of the attack, Merck had coverage under 26 ‘all risks’ property insurance policies in a three-layer structure, with $1.75 billion in total limits above a $150 million deductible, appellate case documents showed. Parties disputed just under $700 million in coverage. 

The appellate court had determined that the NotPetya attack “is not sufficiently linked to a military action or objective as it was a non-military cyberattack against an accounting software provider.”

The court preferred to stand by “a long and common understanding” that phrasing in such war exclusions “are intended to relate to actions clearly connected to war or, at least, to a military action or objective.”

The case brought in a who's who of the insurance world. Units of Chubb, Allianz, Liberty Mutual, QBE, AXA, Generali, Hannover Re, Helvetia, Munich Re, 11 Lloyd's syndicates and others were listed as defendants and with units of Aspen, HDI, a Lloyd's syndicate, Zurich, Mapfre and VIG listed as defendants-appellants

The case also attracted a host of lobby groups from across industries and across the country to have their say. 

Insurance lobby group APCIA chimed in to support insurers that the lower court ruling be overturned. The full swathe of remaining amici opinions argued that the appellate court ruling that the war exclusion not apply.

Did you get value from this story?  Sign up to our free daily newsletters and get stories like this sent straight to your inbox.