Pharmaceutical firm Merck recently won an appeal that could mean its insurers will have to pay up on a $1.4-billion judgment related to the NotPetya cyberattack in 2017. The New Jersey appellate division judges hearing the appeal judge noted that the plain definition of war applies to the various insurance policies and that a cyberattack against an accounting firm not engaged in hostilities, while criminal and based on ill-will, was not tantamount to an act of war.
As detailed in the judges’ decision, many of the original defendants settled their portion of the insurance claim with Merck. In a separate yet parallel case involving multinational food and beverage company Mondelez International and Zurich American Insurance, a settlement was also reached, missing the opportunity to have a telling effect and adjustment on how cyber insurance will be treated going forward.