Hunton Insurance Recovery Blog

The Supreme Court of New Jersey recently agreed to hear ACE American Insurance Company’s appeal of an Appellate Division decision finding that a war exclusion in a property insurance policy did not preclude coverage for Merck & Co., Inc.’s claim stemming from a 2017 cyberattack. We previously reported about this case here.   

The Superior Court of New Jersey Appellate Division recently upheld a lower court’s finding that the war exclusion in a property insurance policy did not preclude coverage for Merck’s claim stemming from a 2017 cyberattack. The decision is appropriately being heralded as a huge win for policyholders and an affirmance of New Jersey’s longstanding history of protecting policyholders’ reasonable expectations. We previously blogged about developments relating to the war exclusion and the Merck case when it was initially heard by the Appellate Division.

Update: On May 1, 2023, the New Jersey appeals court affirmed the trial court's decision that a war exclusion did not bar $1.4 billion in coverage for Merck’s losses stemming from the NotPetya attack.

On June 27, 2017, the skies over New Jersey were clear and the ground steady. But Merck & Co., a New Jersey-based pharmaceutical company, was under attack. Malware ripped through its computers, damaging 40,000 of them and causing over $1.4 billion in losses.

Merck was not the sole target.^[1] Dubbed “NotPetya,” the virus tore through the US economy,^[2] and did an estimated $10 billion in damage. The US Department of Justice charged six Russian nationals, alleged officers of Russia’s Intelligence Directorate (the GRU), for their roles in the NotPetya attack, among others. The attackers’ goal, according to the DOJ, was:

With the circumstances in Ukraine intensifying and companies either shutting down or suspending operations in the region, the question arises about whether the sparingly used war exclusion will become more relevant as policyholders seek to recover losses. Economic effects of the conflict are spreading. Some companies may have to close operations entirely, some partially, and others may have their supply chains severely disrupted. The US government has warned companies to protect themselves against cyberattacks. The impact on policyholders, however, may take different forms, potentially implicating their business interruption, contingent business interruption, cyber, shipping and cargo, and political risk insurance coverages. Other coverages could be implicated as well.

Innovation and developments in technology bring both opportunities and challenges for the retail industry, and Hunton Andrews Kurth has a sophisticated understanding of these issues and how they affect retailers. On January 23, 2020, our cross-disciplinary retail team, composed of over 200 lawyers, released our annual Retail Industry Year in Review. The 2019 edition, Spotlight on Technology, provides an overview and analysis of recent developments impacting retailers, as well as what to expect in 2020 and beyond. Topics discussed include: braille gift cards as the next wave ...

In a significant win for policyholders, the Ninth Circuit rejected an insurer’s argument that the common meaning of “war” applied when interpreting a war exclusion, instead of the customary usage of the term, pursuant to Cal.  Civ. Code 1644, and revived NBC Universal’s attempt to recover at least $6.9 million in costs incurred to relocate the production of a television show from Jerusalem during the 2014 Israeli-Palestinian conflict. Universal Cable Prods., et al., LLC v. Atl. Specialty Ins. Co., 2019 WL 3049034, at *10 (9th Cir. July 12, 2019).

The City of Baltimore is the latest victim of increasingly common ransomware attacks. On May 7, 2019, unidentified hackers infiltrated Baltimore’s computer system using a cyber-tool named EternalBlue, developed originally by the United States National Security Agency to identify vulnerabilities in computer systems. However, the NSA lost control of EternalBlue, and since 2017, cybercriminals have used it to infiltrate computer systems and demand payment in exchange for relinquishing control. For instance, in Baltimore, the hackers have frozen the City’s e-mail system and disrupted real estate transactions and utility billing systems, among many other things. The hackers reportedly demanded roughly $100,000 in Bitcoin to restore Baltimore’s system. The city has refused to pay.

In an article appearing in CyberInsecurity News, Hunton insurance recovery partner, Michael Levine, comments on Zurich American Insurance Company’s attempt to invoke a so-called “war exclusion” as a basis for not paying business income losses suffered by snack food giant Mondelez International.  As Levine expains, so-called “war exclusions” have rarely been invoked and only then, in times of clear military or state-sponsored activity.  The Mondelez case will therefore focus on whether a computer attack was indeed an act of war and, importantly, whether and how Zurich ...