Court Rejects Merck Insurers' Attempt to Refuse Coverage for NotPetya Damages

An appellate court this week officially shot down an argument by insurers for Merck & Co. that they are not liable for the pharmaceutical giant's $1.4 billion in losses following a 2017 cyberattack because the incident fell under exclusions for acts of war.

The New Jersey appellate court judges said that in order for a cyberattack to fall under any type of war exclusions it must involve military action, the Wall Street Journal reported.

The Russia-backed NotPetya malware was found to be behind the cyberattack, and since Merck's Ukraine operations were initially targeted, insurers claimed the breach was an extension of military hostilities following Russia's invasion of Ukraine.

"The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action," the judges explained in their ruling, the WSJ reported. "Coverage could only be excluded here if we stretched the meaning of 'hostile' to its outer limit."