On 1 May 2023, the Appellate Division in New Jersey published its decision in the long-running dispute between Merck and insurers regarding its property insurance programme.
Insurers had contended that losses associated with NotPetya in 2017 were not covered due to the exclusion for “hostile or warlike action in time of peace or war…” (Merck & Co. Inc. v. Ace American Insurance Company and Others NJ App. Div., Nos. A-1879-21and A-1882-21).
Insurers following this case will recall that the judge at first instance, in a sparsely reasoned judgment, held that the omission of any reference to cyber was critical. Insurers and the insured were aware that cyber attacks of various forms have become more common. Despite this, insurers had done nothing to change the language of the exclusion to put the insured on notice that it extended to cyber attacks. The judge concluded that insurers’ failure to change the language entitled Merck to view the exclusion as applicable only to traditional forms of warfare.
After more detailed analysis, the Appellate Division reached a similar conclusion. Judge Currier noted: “The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will.” He concluded: “…terms similar to “hostile or warlike action” by a sovereign power are intended to relate to actions clearly connected to war or, at least, to a military action or objective.”
Thus the suspicion that NotPetya was to be attributed to Russia in its ongoing conflict with the Ukraine, even if proved, would not be sufficient. The court noted that while the attack caused property damage, there was no evidence that it caused bodily injury or death. Nor was the fact that the attack spread to at least 64 countries (including Russia) a critical consideration
The exposure of insurers who had not yet settled the litigation is in the region of $700 million. Despite the substantial sum at stake, we anticipate that any further appeal will be challenging to launch, both procedurally and on the merits. This is likely to mark the end of this dispute.
One thing which insurers can take from this decision is that the effort expended over the last three years to develop new clauses on war and cyber operations has been necessary. State sponsored cyber attacks targeting another state are not sufficient for traditional war exclusions to apply, even when leading to substantial losses. There has to be a connection with war or military action. If insurers wish to exclude state-backed cyber operations absent these elements, specific drafting is required to achieve this outcome.
