NJ Panel Set to Make Wartime Exclusion Decision

On February 8, 2023, a New Jersey appellate panel heard oral arguments in Merck’s lawsuit seeking coverage from its insurers for $1.4 billion in losses stemming from the 2017 NotPetya cyberattack. Initially, NotPetya was believed to be a piece of ransomware similar to that of WannaCry. Now, it is widely attributed to a Russian cyber-attack on Ukraine. Unlike other typical ransomware attacks, NotPetya deletes the files it infects. No decryption key can recover the lost files.

The dispute centers around the wartime exclusions in Merck’s all-risk property policy. Merck’s insurers argued that the wartime exclusion excludes cyber-attacks from coverage, even though the provision has traditionally only been applied to physical warfare.

During oral arguments, the panel expressed skepticism of the insurers’ position, but it remains unknown how the panel will rule. The growing propensity of cyber-attacks makes the panel decision in this case of great interest. A finding that the wartime exclusions apply to cyberattacks could severely limit policies purportedly covering cyber security events.

The case is Merck & Co Inc., et al. v. Ace American Ins. Co., et al., Case No. A-001879-21-T02, Superior Court of New Jersey, Appellate Division.