In a significant ruling, the New Jersey Superior Court Appellate Division affirmed that Merck & Co., Inc. is entitled to insurance coverage for losses stemming from a major cyberattack known as NotPetya. The court's decision, issued on May 1, 2023, impacts not only Merck but also sets a precedent for how insurance claims related to cyber incidents may be interpreted in the future.
The case, Merck & Co., Inc. v. Ace American Insurance Company, Docket No. A-1879-21/A-1882-21, arose after Merck's global computer network was severely damaged by the NotPetya malware in June 2017. The malware, which spread rapidly and infected thousands of Merck's computers, caused significant disruptions to the company's operations, including manufacturing and research activities. Merck sought coverage under its property insurance policies, but the insurers denied the claim, citing a "Hostile/Warlike Action" exclusion in the policies.
Merck, a multinational pharmaceutical company based in New Jersey, filed a lawsuit against multiple insurers and reinsurers, seeking a declaratory judgment that it was entitled to coverage for the losses incurred due to the cyberattack. The trial court ruled in favor of Merck, stating that the exclusion did not apply to the circumstances of the case. The insurers appealed the decision, leading to the recent ruling by the appellate division.
The court determined that the insurers failed to demonstrate that the NotPetya cyberattack constituted a "hostile" or "warlike" action as defined in the policy exclusion. The opinion, delivered by Judge Currier, emphasized that the exclusion was not applicable under the circumstances. The court stated, "the Insurers did not demonstrate the exclusion applied under the circumstances of this case, namely, that this cyberattack was a 'hostile' or 'warlike' action as contemplated under the exclusion."
Merck's insurance program for the period from June 1, 2017, to June 1, 2018, included twenty-six "all risks" property policies, which provided coverage for physical loss or damage to property. The policies included specific clauses for computer systems and electronic data, ensuring coverage for losses due to malicious acts. The insurers argued that the NotPetya attack was orchestrated by actors associated with the Russian government, thus falling under the exclusion. However, the court found that the exclusion required a clear military action, which was not present in this case.
The ruling is significant as it clarifies the interpretation of insurance exclusions related to cyberattacks. The court highlighted that the language of the exclusion had not been updated to reflect the evolving nature of cyber threats, stating, "Despite this, Insurers did nothing to change the language of the exemption to reasonably put this insured on notice that it intended to exclude cyber attacks." This suggests that insurers may need to reevaluate their policy language in light of modern risks.
The court's decision could have far-reaching implications for other companies facing similar situations. As cyberattacks become increasingly common and sophisticated, the interpretation of insurance policies will be crucial for businesses seeking to recover losses. The ruling reinforces the principle that exclusions must be clearly defined and cannot be broadly interpreted to deny coverage without specific language supporting such an interpretation.
Looking ahead, the insurers in this case may consider appealing the decision to a higher court. However, the appellate division's ruling sets a strong precedent for how courts may handle similar cases in the future, particularly in the context of cyber-related claims. The outcome of this case underscores the importance of clear communication and understanding between insurers and policyholders regarding coverage for emerging risks.