Merck, Insurers Reach NotPetya Settlement
Pharmaceutical giant Merck has reached a settlement with insurers over the company’s losses resulting from the NotPetya malware campaign in 2017. The insurers denied Merck’s $700 million claim by invoking acts of war exclusions. Last spring, a New Jersey state appellate court upheld a lower court ruling that the acts of war exemption does not apply. A day before the insurers were scheduled to present arguments before the New Jersey Supreme Court last week, some of the insurers asked the court to dismiss their appeals. Terms of the settlement have not been made public.
Make sure you’re current on what your cyber insurance will and will not cover, and adjust accordingly. Before you let your legal team convinces you they can get the desired outcome regardless of the Insurance Company’s position, consider that Merck’s been working this settlement since 2017 and you may not be able to survive that long waiting on remuneration.
We now have case law on what is or isn’t considered ‘acts of war’ when it comes to cyber events. Next up will be determining the legal definition of 'nation-state-backed cyberattacks' and how they affect insurance coverage. One can expect that the insurance industry will further refine exclusion policies, as well as increase the cost of coverage because of the settlement.
Read more in
Gov Infosecurity: Insurers Drop Bid to Exclude Merck's $1.4B NotPetya Claims
Infosecurity Magazine: Merck Settles With Insurers Over $700m NotPetya Claim