Insurance coverage for cyber security issues continues to be a hot topic in courts across the United States. Most recently, the New Jersey Supreme Court agreed to hear an appeal in Merck & Co. v. Ace Am. Ins. Co. after the appellate division held that the trial court was correct in finding that the standard war exclusion does not apply to cyberattacks.
Merck had 26 “all-risks” property insurance policies from the defendants, which they claim covers any losses from cyberattacks. The 2017 malware attack, known as NotPetya, extended to 64 countries, and was thought to have been organized by actors working for or on behalf of the Russian Federation. NotPetya impacted 40,000 Merck computers, and Merck is alleging $1.4 billion in damages as a result.
The insurers argued that the war exclusion applied because of the possible relationship between the creators of the ransomware attack and Russia. However, the trial court and superior court held that the exclusion only applied to a traditional war involving “hostilities between armed forces of two or more nations or states.”
While the New Jersey Supreme Court has taken up the issue of the application of the war exclusion, courts across the United States are still grappling with whether a cyber attack can constitute direct physical loss sufficient to trigger a property insurance policy in the first place. Most recently, in EMOI Services, LLC v. Owners Insurance Company, the Ohio Supreme Court held that there was no direct physical loss as a result of a ransomware attack.
HKR will continue to monitor this important issue and report on any further developments. If you have any questions or would like additional information, please contact any member of HKR’s team.