US drug giant Merck says NotPetya cyberattack cost ~$310M in Q3, affecting its global manufacturing, research, and sales operations, may cost ~$300M more in Q4
The NotPetya cyberattack has cost the American pharmaceutical giant Merck more than $135 million in sales and $175 million …
Context & Ripple Effects
Merck's disclosure lands two months after other NotPetya victims quantified their damage: shipping giant Maersk flagged $200M-$300M in lost Q3 revenue and FedEx put TNT Express losses around $300M. What distinguishes Merck is scope — a single worm reaching global manufacturing, research, and sales at a pharma company whose output depends on continuous production.
The financial wound is only half the story. The related coverage shows the same event triggering a years-long insurance war: Mondelez's $100M claim lawsuit opened the front, Merck later won its own $1.4B dispute against insurers invoking an 'Act of War' exclusion, and the matter ended in an undisclosed settlement. This Q3 earnings note is where that chain begins.
First-order effects
- Merck absorbs roughly $310M in Q3 costs across manufacturing, research, and sales operations, and warns of up to ~$300M more in Q4 — a direct hit to production and revenue that investors will price into guidance.
Second-order effects
- Merck joins Maersk and FedEx as named claimants pushing insurers to pay out on state-sponsored attack losses, setting up the 'warlike action' exclusion battles that Mondelez and Merck itself later litigate.
Third-order effects
- If insurers keep denying claims via Act of War exclusions while states launch destructive worms, catastrophic cyber risk becomes structurally uninsurable through standard policies — forcing corporates to self-insure or demand new policy forms, as the Merck and Mondelez cases test.
The trend: State-sponsored destructive malware is turning corporate cyberattacks into balance-sheet events whose losses get fought over in court between victims and insurers rather than absorbed quietly.