The two cases could have ripple effects not just for the insurance industry but for companies seeking coverage for hacks, according to John Reed Stark, a cybersecurity consultant.Ĭompanies often don’t know what their insurance covers until they’re facing a cyber incident, Stark said. The Mondelez case is ongoing in the Illinois Circuit Court for Cook County. will likewise test whether its insurer Zurich Insurance Group Ltd. “This will hasten the urgency of those conversations,” Wolff said of the Merck case.Īnother similar case involving Mondelez International Inc. That’s made insurance underwriters ramp up their scrutiny of cyber policies, with insurers narrowing coverage for ransomware-related losses at companies that fail to demonstrate sufficient cyber defenses, the report said. has surged as ransomware payments drive up claims, according to a recent report from broker Marsh McLennan. The question of whether a cyberattack counts as an act of war is one piece of a broader insurance industry “reckoning,” according to Josephine Wolff, an associate professor of cybersecurity policy at Tufts University.
“Fortunately, many cyber insurance policies on the market still contain narrow war exclusions and appropriate exceptions that should preserve coverage for the vast majority of cyber incidents,” DeField said. Some non-cyber policies, such as property policies, have been revised since the NotPetya attacks to add robust cyber exclusions, DeField added, though war exclusions tend to make an exception for acts of cyberterrorism. Both types of policies often contain exclusions barring coverage for war or warlike action.Ĭourts typically have applied such exclusions to traditional forms of warfare, which is why insurers’ initial denial of coverage for Merck’s cyber losses “raised the alarm” that insurers may be trying to broaden the exclusion’s reach, DeField said in an email. The New Jersey court was considering coverage under an all-risk property insurance policy, rather than under a cyber-specific policy. “The Merck decision is an important win for policyholders, especially in the current cyber threat landscape,” said Andrea DeField, a partner in the insurance coverage practice at Hunton Andrews Kurth LLP. The ruling noted that insurers didn’t change the war language to put companies like Merck “on notice” that cyberattacks wouldn’t be covered, despite a trend of attacks by countries like Russia hitting private sector companies. 13 that Merck’s insurers can’t claim the war exclusion because its language is meant to apply to armed conflict.
New Jersey Superior Court Judge Thomas J. The 2017 malware attack was attributed to Russia’s military intelligence agency, deployed as part of a conflict with Ukraine. The multinational pharmaceutical company sued its insurers who had denied coverage for NotPetya’s impacts to its computer systems, citing a policy exclusion for acts of war.
Merck & Co.‘s victory in a legal dispute with insurers over coverage for $1.4 billion in losses from malware known as NotPetya is expected to force insurance policies to more clearly confront responsibility for the fallout from nation-state cyberattacks.
0 kommentar(er)
