Some companies attacked in 2017's NotPetya ransomware plague have been denied insurance coverage over “war exclusion” clauses
New York Times : Tweets: @jckichen , @nytimesbusiness , @nicoleperlroth , @nytimesbusiness , and @puiwingtam Tweets: @jckichen : This is why the language we use to talk about what seem like abstract concepts (i.e. “cyberwar") is important: there's real world impact. Massive swaths of industry are betting on cyber insurance as a hedge against further infosec investment. That may prove to be a bad choice. http://twitter.com/... @nytimesbusiness : “You have insurers who are sitting on insurance policies that were never underwritten or understood to cover cyber risk.” http://www.nytimes.com/... Nicole Perlroth / @nicoleperlroth : McCain, @LindseyGrahamSC @GenMhayden sharply criticized the Obama administration for calling the North Korean cyberattack on Sony “cybervandalism” instead of"cyberwar." But their decision was highly calculated. They wanted to avoid this exact scenario: http://www.nytimes.com/... @nytimesbusiness : Mondelez, which owns consumer food brands like Trident and Ritz crackers, thought insurance would cover damage from the NotPetya cyberattack in 2017. But the insurer invoked a “war exemption” to deny the claim. http://www.nytimes.com/... Pui-Wing Tam / @puiwingtam : When a cyberattack is classified as a part of a war, insurers may not cover the costs of a breach. So who pays when businesses are hit by a cyberattack blamed on a foreign government?@satariano @nicoleperlrothhttps://t.co/ qqjKupTToU
Context & Ripple Effects
NotPetya began with NSA cyberweapons leaked through the Shadow Brokers and went on to cause an estimated $10B+ in worldwide damage after hitting Ukrainian targets first, per Wired's accounting of the attack. In January, Mondelez opened the legal front by suing its insurer over a refused $100M claim — the first major battle over who pays for state-sponsored cyberattack losses.
The New York Times report widens the frame: denial-by-war-exclusion is not one disputed claim but a pattern across NotPetya victims, exposing policies that were never underwritten for cyber risk at all.
First-order effects
- Mondelez and other attacked companies are left carrying their own NotPetya losses while litigation decides whether 'warlike action' covers an attack they were collateral victims of.
- Insurers holding pre-cyber-era policies face a wave of contested claims they argue were never priced to cover state-sponsored destruction.
Second-order effects
- Cyber insurance reprices around the ambiguity: the later ransomware surge brought higher costs and stricter requirements just as demand grew, and by 2022 insurers were still failing both to reduce customers' exposure and to pay out on state-sponsored attacks falling short of war.
- Merck's eventual undisclosed settlement shows the likely resolution path — private negotiated payouts rather than clean precedent — leaving other policyholders to litigate or settle case by case.
Third-order effects
- If war exclusions hold against leaked-state-weapon attacks, cyber insurance stops functioning as a hedge against nation-grade risk, pushing large firms back toward direct security investment instead of transferring that risk to carriers.
- The deeper structural problem is attribution: when government-built weapons circulate outside government control, the legal line between act of war and ordinary crime becomes unresolvable by policy language alone, inviting regulatory or statutory definition of what cyberwar coverage means.
The trend: State-built cyberweapons escaping into criminal campaigns are forcing insurers to redraw the war/crime boundary, eroding cyber insurance's reliability as a corporate hedge.