Insurers Say Cyberattack That Hit Merck Was Warlike Act, Not Covered

Richard Vanderford reports on another attempt by insurers to avoid having to cover costs involved in a cyberattack by applying the common war exclusion:

The costly NotPetya cyberattack, which the U.S. blamed on Russia, should be considered a “cyber nuclear attack,” insurers argued as they urged judges to overturn a legal win by Merck & Co. in a dispute that could have broad ramifications for business insurance.

Merck, which had an estimated $1.4 billion in losses after NotPetya invaded its computer systems in 2017, suffered the collateral damage of a warlike act not covered by insurance, lawyers for a group of carriers told judges Wednesday in a state appeals court in Trenton, N.J.