The appellate division of New Jersey Superior Court has upheld a state trial court opinion that the war exclusion in drugmaker Merck & Co.’s all-risk property insurance policies does not apply in the case of the cyber attack the company suffered in 2017.

The appeals court affirmed that insurers could not use the policy exclusion to avoid covering about $1.4 billion in damages Merck said it suffered from a spring 2017 cyber attack known as NotPetya.

The appeals court agreed with the lower court’s decision issued in January 2022 that the plain language of the exclusion does not support the insurers’ position. It found that the exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action.

The hostile/warlike action exclusion was included in each of the 2017-2018 policies involved. It excludes loss or damage “caused by hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack by any government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval, or air forces; or by military, naval, or air forces; or by an agent of such government, power, authority, or forces.”

While insurers conceded the word “warlike” in the exclusion might not be applicable, they asserted the word “hostile” should be read in the broadest possible sense, as meaning “adverse,” “showing ill will or a desire to harm,” “antagonistic,” or “unfriendly.” They contended that any action that “reflects ill will or a desire to harm by the actor” falls within the hostile/warlike action exclusion, as long as the actor was a government or sovereign power, in this case the Russian Federation.

As the American Property Casualty Insurance Association explained the insurers’ position, damage caused by any unfriendly action of any nature undertaken by a “nation-state” falls under the plain meaning of the hostile/warlike action exclusion.

The insurers asserted that the trial court should have granted them summary judgment because the exclusion “is clear and unambiguous, and it plainly applies to the NotPetya attack.” The war exclusion applied to the NotPetya attack because it was attributed to Russia and was meant to be deployed to disrupt and destabilize Ukraine, insurers maintained.

Language and History

However, the appeals court found that the plain language and history of the exclusion do not support the insurers’ interpretation. “The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will,” the court wrote.

In considering the history of the war exclusion, which has been included in policies for more than a century, the court found that the few applicable cases reaffirm that similar exclusions have never been applied outside the context of a clear war or concerted military action.

“Contrary to the insurers’ contentions, these cases demonstrate a long and common understanding that terms similar to ‘hostile or warlike action’ by a sovereign power are intended to relate to actions clearly connected to war or, at least, to a military action or objective,” the opinion states. “Therefore, in addition to the plain language interpretation of the exclusion requiring the inapplicability of the exclusion, the context and history of this and similarly worded exclusions and the manner in which similar exclusions have been interpreted by courts all compel the conclusion that the exclusion was inapplicable to bar coverage for Merck’s losses.”

Remaining Insurers

More than 30 insurers were involved in the case at the start. However, many have since resolved their claims with Merck, leaving eight remaining defendants. Merck’s property insurance program included the “all risks” property policies in a three-layer structure, with $1.75 billion in total limits above a $150 million deductible. The remaining eight insurers’ policies insured percentages of coverage in one, two or all three of the layers. In total, they were disputing $699,475,000 in coverage or just under 40% of Merck’s total coverage for the policy period.

Ruling a Warning

The consumer group United Policyholders, which submitted a brief in support of the war exclusion not applying to cyber attacks, called the appeals court decision “an important win for policyholders who continue to seek (and pay substantial premiums for) certainty with respect to their insurance coverage in the face of these oft-uncertain cyberattacks.”

While the ruling is specific to New Jersey, when the lower court issued its January 2022 decision, Moody’s Investor Service said it was a warning to property/casualty insurers and reinsurers about cyber coverage embedded in traditional policies.

Later in 2022, food and beverage company Mondelez International settled its lawsuit against Zurich American Insurance Co. in Illinois over its $100 million NotPetya claims.

In August 2022, a Lloyd’s market bulletin said insurers must exclude state-backed cyber attacks in standalone (or affirmative) cyber policies. The exclusion should include liability for losses arising from both war- and non-war-related state-backed cyber attacks.

The Russian invasion of Ukraine has increased the risk of cyber attacks and further testing of the effectiveness of “war exclusion” and “hostile act exclusion” language. Larger insurers have taken significant pricing and underwriting actions in response to rising cyber claims in recent years, including tightened contract language, which should help mitigate underwriting losses in the current uncertain environment, Fitch Ratings reported.