US court rules in favor of pharma giant Merck in a $1.4B legal dispute with insurers who claimed an “Act of War” exclusion to deny coverage for NotPetya losses
Context & Ripple Effects
Merck had already disclosed that NotPetya disrupted its manufacturing, research, and sales operations and generated substantial quarterly costs, making insurance recovery central to the incident’s financial aftermath. Other victims were also confronting war-exclusion denials for NotPetya claims, including Mondelez’s separate $100M coverage lawsuit.
The ruling favors Merck’s effort to recover under its policy despite insurers’ Act of War defense. The dispute was later resolved through an undisclosed Merck-insurer settlement, showing that the coverage fight continued beyond the court decision.
First-order effects
- Merck gains a court-backed position in its $1.4B claim, while the insurers’ use of the Act of War exclusion fails in this dispute.
- The decision shifts the immediate leverage in Merck’s coverage negotiations toward Merck, before the parties’ later undisclosed settlement.
Second-order effects
- Insurers defending NotPetya-related denials face stronger pressure from other policyholders whose claims were similarly tied to war-exclusion language.
- Mondelez and other companies pursuing recovery for state-linked cyber incidents gain a closely related coverage outcome to cite in their own disputes with insurers.
Third-order effects
- Cyber-insurance disputes are increasingly testing whether traditional war exclusions can allocate losses from malware that crosses borders and disrupts commercial operations.
- If comparable rulings persist, insurers will have incentives to make cyber-war exclusions and coverage triggers more explicit rather than rely on broad legacy language.
The trend: NotPetya litigation is pushing cyber insurance toward clearer contractual treatment of state-linked cyberattacks and systemic operational losses.