Merck settles its cyberattack insurance dispute with insurers over denying coverage for NotPetya losses due to “Warlike Action”; the amount was not disclosed
Alex Ebert / Bloomberg Law :
Context & Ripple Effects
The settlement closes a dispute that followed Merck’s reported operational losses from NotPetya, which disrupted its manufacturing, research and sales operations. A court had already ruled for Merck in the $1.4B coverage fight over the war exclusion.
The case sits alongside other efforts to recover NotPetya losses, including Mondelez’s challenge to its insurer’s denial and Zurich’s later settlement with Mondelez. Together, those cases made policy wording—not just attribution of an attack—the central issue in cyber-loss recovery.
First-order effects
- Merck and its insurers end a long-running coverage dispute; the settlement amount is undisclosed, so the financial allocation cannot be assessed from the record.
- The resolution removes the immediate uncertainty around whether the insurers could rely on the “Warlike Action” exclusion for Merck’s NotPetya claim.
Second-order effects
- Insurers writing cyber and property policies have another reason to scrutinize war-related exclusions and the wording used for state-linked cyber incidents, particularly after the earlier Merck court ruling.
- Corporate policyholders facing comparable denials gain a further negotiated-resolution precedent, while insurers may seek clearer contractual limits rather than depend on broad exclusion language.
Third-order effects
- The NotPetya cases indicate that cyber-risk transfer increasingly turns on precise definitions of war, hostile acts and cyber events, not solely on the scale or suspected origin of an attack.
- If courts and settlements continue to constrain broad war exclusions, cyber insurance could move toward more explicit allocation of systemic attack risk between insurers and insured companies.
The trend: High-impact cyber incidents are pushing insurance coverage disputes toward clearer, more specialized language for state-linked and systemic digital losses.