Following a recent appellate division decision from the New Jersey Superior Court, insurers of traditional property and liability policies will likely consider whether to exclude catastrophic state-backed cyber attacks in insurance policies that otherwise would cover cyber-attacks. The exclusion would likely include liability for losses arising from both war- and non-war-related state-backed cyber attacks. The exclusion could be called a “nation state” exclusion.”
The court held that insurers could not rely on the war exclusion in a property policy to avoid covering $1.4 billion in damages Merck suffered in a NotPetya cyber-attack in 2017.
The damages were suffered when Merck downloaded infected accounting software from a Ukrainian firm that was hit with malware. A massive disruption in sales, manufacturing, research and development followed when 40,000 computers in the Merck network were impacted.
The lower court had held that the exclusion of damages caused by hostile/warlike action by a government or sovereign power in times of war or peace requires evidence of military action. The hostile/warlike action exclusion was included in each of the policies involved.
The court explained that the policy exclusion specifically stated, excluded losses must be “caused by hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack by any government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval, or air forces; or by military, naval, or air forces; or by an agent of such government, power, authority, or forces.”[1]
This was contrary to underwriters’ position that damage caused by any unfriendly action of any nature undertaken by a “nation-state” falls under the plain meaning of the hostile/warlike action exclusion.
On appeal insurers argued that the trial court should have granted summary judgment because the exclusion “is clear and unambiguous, and it plainly applies to the NotPetya attack.”[2]
Because the attack was launched by Russia and meant to disrupt and destabilize Ukraine, insurers argued that it was clearly a warlike or hostile action that should be excluded.
The appeals court agreed with the lower court and explained, “The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will.”[3]
After examining the few cases that have considered the hostile/warlike exclusion, the appeals court explained that similar exclusions have never been applied outside the context of a clear war or concerted military action.
“Contrary to the insurers’ contentions, these cases demonstrate a long and common understanding that terms similar to ‘hostile or warlike action’ by a sovereign power are intended to relate to actions clearly connected to war or, at least, to a military action or objective,” the opinion states.[4]
“Therefore, in addition to the plain language interpretation of the exclusion requiring the inapplicability of the exclusion, the context and history of this and similarly worded exclusions and the manner in which similar exclusions have been interpreted by courts all compel the conclusion that the exclusion was inapplicable to bar coverage for Merck’s losses.”[5]
Although the ruling is specific to New Jersey, , the case will likely impact how insurance companies will attempt to avoid providing coverage for these potential types of losses because there are so few U.S. cases examining the hostile/warlike exclusion and the very large potential losses that can be caused by a cyber attack. Underwriters do not look at a $1.4 billion loss without looking at ways to avoid such catastrophic exposures in the future.
Willis Towers Watson hopes you found the general information provided in this publication informative and helpful. The information contained herein is not intended to constitute legal or other professional advice and should not be relied upon in lieu of consultation with your own legal advisors. In the event you would like more information regarding your insurance coverage, please do not hesitate to reach out to us. In North America, Willis Towers Watson offers insurance products through licensed entities, including Willis Towers Watson Northeast, Inc. (in the United States) and Willis Canada Inc. (in Canada
