It’s been reported that pharmaceutical giant Merck & Co. Inc. and its insurers have reached an agreement over the $1.4 billion in losses Merck alleged it suffered from the NotPetya cyberattack in 2017.
Bloomberg Law reported last week that Merck struck an 11th-hour settlement with its insurers on January 3rd, 2024, which avoided a New Jersey Supreme Court review of the insurance dispute just before the court was set to hear oral arguments during an appeal.
In 2017, the Russia-linked NotPetya malware was delivered into an accounting software developed by a Ukrainian firm, which was used by Merck and other companies. Merck reported that more than 40,000 of its machines and its global network were infected in the attack, which Merck says led to $1.4 billion in losses.
US based Merck filed an insurance claim under its “all risks” coverage for the NotPetya attack. However, as the attack was later attributed to Russia’s military intelligence operations, Merck’s insurers argued that the losses were barred by a war exclusion in the policy, leading to a long dispute.
In 2022, the New Jersey court ruled in favour of Merck, finding that the exclusion did not apply to malware and cyberattacks and was intended to apply only to physical acts of warfare between two or more countries. This decision was upheld in appellate court in 2023 and the company was granted a $1.4 billion payout.
Eight of the insurers appealed this ruling and disputed around $700 million in claims.
The New Jersey Supreme Court was set to hear oral arguments during an appeal of the court’s affirmation of the previous ruling, but this has now been avoided after a settlement between Merck and its insurers was reached, bringing an end to the dispute.
As reported by Bloomberg Law, the terms of the settlement are confidential, but the outcome does highlight the complexities surrounding war exclusions at a time of heightened geopolitical tensions.
