Dive Brief:
- Merck reached a settlement with its insurance providers in the closely watched dispute in a New Jersey Supreme Court case over $1.4 billion in claims stemming from the NotPetya cyberattack.
- The pharmaceutical company reached a last-minute agreement with insurance providers just prior to oral arguments, Bloomberg Law reported, citing stipulations filed with the court Wednesday. Terms of the settlement were not disclosed.
- About $700 million in claims under the company’s “all risks” property insurance policies were under dispute related to the original $1.4 billion. A state appellate court ruled in May that insurance providers would not be able to deny coverage under the war-exclusions coverage, as the particular language did not apply to the circumstances in this case.
Dive Insight:
The Merck case was heavily scrutinized by insurance industry and cybersecurity experts alike, given the surge in nation-state and criminal ransomware cases linked to various conflicts around the world, including Russia's invasion of Ukraine and, more recently, the Israel-Hamas war.
The NotPetya attacks damaged more that 40,000 Merck computers after infected accounting software was downloaded. The attack led to major disruptions of Merck’s operations, including sales, manufacturing and research and development.
The Ukraine conflict and the rise in malicious attacks against critical infrastructure providers in the U.S. have raised concerns about potential catastrophic financial impacts.
“War exclusions have been in focus lately, not just due to the NotPetya incident – but from an escalation and recognition of the potential catastrophic damage state actors and a cyber war could create,” Sridhar Manyem, senior director of industry research and analytics at AM Best, said via email. “Notwithstanding the Merck settlement, this focus is likely to continue.”
Some insurers may use war exclusions language to limit risks, while others may see it as “an opportunity to offer separate covers with conservative limits,” Manyem said.
“Cyber risk remains among the greatest global risks for insurers and the industry,” Claire Howard, SVP of the legal division and general counsel at the American Property Casualty Insurance Association, said in a statement. “Insurers rely on proper application of an insurance contract exclusion for losses caused by ‘hostile or warlike action in time of peace or war’ to protect against aggregated and uninsurable risk.”
Howard said the exclusion is essential to the ability of the insurance market to underwrite cyber risk and help policyholders defend against these attacks, while building resilience.
Snack foods giant Mondelez settled an insurance case involving more than $100 million in claims related to the NotPetya attacks in 2022.
A spokesperson for Merck did not return a request for comment.
