Merck Wins Cyber-insurance Lawsuit Related To NotPetya Attack (therecord.media) 20
A New Jersey court has ruled in favor of Merck in a lawsuit the pharmaceutical company filed against its insurer, Ace American, which declined to cover the losses caused by the NotPetya ransomware attack. From a report: The NotPetya incident, which took place in June 2017 and impacted thousands of companies all over the world, destroyed data on more than 40,000 Merck computers and took the company months to recover. Merck estimated the damage at $1.4 billion, a loss caused by production outage, costs to hire IT experts, and costs of buying new equipment to replace all affected systems. At the time, the company had a $1.75 billion "all-risk" insurance policy, which included coverage for software-related data loss events. However, Ace American refused to cover the losses, citing that the NotPetya attack was part of Russian hostilities against Ukraine and, as a result, was subject to the standard "Acts of War" exclusion clause that is present in most insurance contracts. Merck sued Ace American in November 2019 and argued in court that the attack was not "an official state action," hence the Acts of War clause should not apply.
Acts of War (Score:2)
Re: Acts of War (Score:2)
Re: Acts of War (Score:2)
Re: (Score:1)
You are wrong, and the court is wrong, too.
Re: (Score:1)
Do you understand what you just said? The court said it was not a state action. So it was not Russia. But in fact some homeless guy somewhere. But nice try bending logic, you must be a democrat.
No, that's not what the court said. It simply said the exclusion clause was not written in a way that included this particular act. And it said it was an easy decision.
---
“Given the plain meaning of the language in the exclusion, together with the foregoing examination of the applicable caselaw, the court unhesitatingly finds that the exclusion does not apply,” Judge Thomas J. Walsh wrote in an opinion justifying the ruling.
The judge argued that despite knowing that cyber-attacks can be acts
Re:Acts of War (Score:4, Informative)
Very interesting, with more and conflicts being "undeclared wars", I wonder it will do to the insurance landscape.
In this case, it's causing insurance companies to update their clauses. Ace American could have, but didn't. From TFA:
Merck’s lawyers said that the exclusion clause contained language that limited the Acts of War to official government agencies and did not specifically mention cyber-related events; and, as a result, the clause should not apply to their customer.
In a ruling last month, spotted by Lexology, the New Jersey Superior Court has sided with Merck and its strict interpretation of the Acts of War clause.
“Given the plain meaning of the language in the exclusion, together with the foregoing examination of the applicable caselaw, the court unhesitatingly finds that the exclusion does not apply,” Judge Thomas J. Walsh wrote in an opinion justifying the ruling.
The judge argued that despite knowing that cyber-attacks can be acts of war, Ace American also did not move to update the language in its exclusion clauses.
“Certainly they had the ability to do so,” Judge Walsh said about Ace American. “Having failed to change the policy language, Merck had every right to anticipate that the exclusion policy applied only to traditional forms of warfare.”
The case, while not a matter of mainstream news, has had a huge impact on the insurance business, and several insurers in recent years have moved to update the language of their Acts of War exclusion clauses, with the latest being Lloyd’s, which updated its language just days before the court’s ruling.
Re: (Score:1)
Re: Acts of War (Score:2)
The ruling here specifically picks a part the contract failing to outline cyber attacks as acts of war and this the using the clause has no basis.
The case would be different if the language was included and likely a more difficult ruling but it doesn't mean it would be in favor of the insurance company. We would have to wait and see.
Re: (Score:2)
Presumably, we’ll stop buying coverage as it comes meaningless, and the insurers will adapt, and the game will continue.
Dangerous! This creates a (Score:2)
I can see really invasive/costly insurance company IT security audits coming soon to all business near you.
That is fine (Score:3)
Re: (Score:2)
Re: (Score:2)
And it may even get worse. I wonder if people with insurance policies like for Cars and Homes could be effected due to the rush of these companies to update policies.
For example, self driving Autos. What if a "cyber" attack occurs that breaks these autos, will all damages need to be covered by the owner if someone is injured or killed ? Or a house burns down due to an IOT being attacked ?
Re: (Score:2)
Appeal filed in 3...2...1... (Score:3)
Litigation takes forever to resolve because when one party doesn't like the outcome, they tend to appeal if only to slow down the entire process. When a case is held up on appeal, it can take months for the appellate court to even get around to deciding whether or not they wish to hear the appeal in the first place.
Too bad somebody won (Score:3)
This is like watching a fight between a wife beater and a child molester. No matter who loses, you can't be happy there's a winner.
Whaaaatttt? (Score:2)
Ace American refused to cover the losses, ...
An insurance company tried to weasel out of paying a claim? /sarcasm