Cyber Risks and Business Interruption Insurance - Merck and International Indemnity v ACE (et al.)

On 6th December 2021, the New Jersey Superior Court granted partial summary judgment (attached) in favour of Merck and International Indemnity, declaring that the War or Hostile Acts exclusion was inapplicable to the dispute.

Merck suffered US$1.4 billion in business interruption losses from the Notpetya cyber attack of 2017 which were claimed against "all risks" property re/insurance policies providing coverage for losses resulting from destruction or corruption of computer data and software.

The parties disputed whether the Notpetya malware which affected Merck's computers in 2017 was an instrument of the Russian government, so that the War or Hostile Acts exclusion would apply to the loss.

The Court noted that Merck was a sophisticated and knowledgeable party, but there was no indication that the exclusion had been negotiated since it was in standard language. The Court, therefore, applied, under New Jersey law, the doctrine of construction of insurance contracts that gives prevalence to the reasonable expectations of the insured, even in exceptional circumstances when the literal meaning of the policy is plain.

The Court also noted that under New Jersey law, 'all risks' policies extended coverage to risks not usually contemplated by the parties unless a specific provision excluded the loss from coverage.

On this basis, the Court held that:

(i) "...no court has applied a war (or hostile acts) exclusion to anything remotely close to the facts" and

(ii) despite being "aware that cyber attacks...from private sources and sometimes nation-states have become more common... , Insures did nothing to change the language of the exemption to reasonably put this insured on notice that it intended to exclude cyber attacks".

The Court concluded that "Merck had every right to anticipate that the exclusion applied only to traditional forms of warfare" and not to cyber attacks such as Notpetya.

Comment

The New Jersey Superior Court's decision is heavily reliant on the doctrine of "reasonable expectations of the insured" under New Jersey law which construes insurance policies in favour of policyholders. It is doubtful whether the result would have been the same if the policies had been subject to English law.