Cyber Insurance Claims Disputes: War Exclusion Legal Battles

The legal battles over cyber insurance war exclusions represent one of the most consequential insurance law developments of the 21st century. Several hundred billion dollars of cyber insurance coverage depends on how courts interpret whether state-sponsored cyber attacks—particularly those causing collateral damage to private commercial organizations—fall within or outside war exclusion clauses. The outcomes of NotPetya-related litigation have already shaped insurance policy language, while new cases arising from the Ukraine conflict continue to test the boundaries of these exclusions.

Merck v. ACE Insurance: The Landmark Case

Pharmaceutical giant Merck was severely impacted by NotPetya, suffering approximately $1.4 billion in damages from the wiper attack's destruction of IT systems globally. Merck filed claims against its insurers, including ACE Insurance (operating as Chubb), which denied coverage citing a war exclusion for "hostile or warlike action by a government or sovereign power." The New Jersey Superior Court ruled in Merck's favor in January 2022, determining that the war exclusion language—drafted in 1939 for conventional warfare—did not clearly encompass cyber attacks. Specifically, the court found that the exclusion language referenced physical hostile acts and did not provide fair notice that cyber attacks were excluded.

The Merck ruling was widely seen as a policyholder-favorable decision that created significant uncertainty for insurers who had assumed war exclusions would cover nation-state cyber attacks. Insurers responded by redrafting war exclusion language specifically to address cyber attacks—resulting in the Lloyd's 2022 mandate requiring explicit cyber war exclusion clauses. The Merck case subsequently settled, with terms not publicly disclosed, before any appellate ruling could clarify the legal standard.

Mondelez v. Zurich: Similar Dispute, Different Outcome

Confectionery company Mondelez International (maker of Oreo and other brands) suffered $188 million in NotPetya damages and filed a claim against its property insurer Zurich, which denied coverage citing the war exclusion. Unlike Merck, Mondelez's case proceeded under Illinois law and involved different policy language. The case settled in 2022, again without an appellate ruling clarifying the legal standard. The consistent pattern of pretrial settlements suggests both parties recognized the legal uncertainty and mutual interest in avoiding precedent-setting appellate decisions that could have sector-wide implications.

Key War Exclusion Legal Cases

Burden of Proof for War Exclusion Invocation

A fundamental legal question in cyber war exclusion disputes is who bears the burden of proof. Under standard insurance law principles, insurers bear the burden of proving that an exclusion applies when invoking it to deny a claim. For war exclusions in cyber context, this means the insurer must demonstrate that the attack was conducted by a state or sovereign power—a requirement for presenting credible attribution evidence. Attribution in cyber is technically complex, politically sensitive, and may rely on classified intelligence that cannot be disclosed in commercial litigation.

The practical problem for insurers is that they may have strong classified intelligence indicating state sponsorship of an attack but be unable to present that intelligence in court. Public government attribution statements (such as joint US/UK/EU attributions of NotPetya to Russia) provide some evidentiary foundation but may not meet the civil litigation burden of proof standard without classified corroborating evidence. The attribution problem creates structural legal uncertainty that is difficult to resolve through policy drafting alone.

Post-Lloyd's Policy Language

Following the Lloyd's 2022 mandate, cyber insurance policy war exclusions have been substantially redrafted to provide clearer terms. New exclusion language typically addresses: the definition of war (now more clearly including state-sponsored cyber operations); attribution standards (some policies define attribution to include official government statements as sufficient evidence); scope of exclusion (whether collateral damage to third parties during attacks primarily targeting other states is excluded); and sublimited coverage for certain state-sponsored attack consequences that would otherwise be excluded.

Ukrainian Government Insurance Claims Context

Ukrainian government entities generally do not access commercial insurance markets for cyber incident coverage during active conflict—conventional insurers exclude active conflict zones from coverage, and even with war risk specialists, Ukraine's conflict status makes commercial coverage inaccessible at viable premiums. Recovery costs are instead funded through appropriations, international assistance, and reconstruction fund mechanisms. The cyber insurance dispute framework is more relevant to Ukrainian private sector entities, particularly subsidiaries of multinational corporations whose insurance structures were designed for peacetime commercial cyber risk.

FAQ

Why did the Merck court rule that the war exclusion didn't apply?

The court found that the war exclusion language—written in the 1940s for conventional warfare—referenced "hostile or warlike action" in ways that implied physical military operations. The language did not provide fair notice to a commercial policyholder that a malware attack, even if attributed to a nation-state, would be excluded. The court applied contra proferentem—the principle that ambiguous insurance language is interpreted against the insurer—in Merck's favor.

How do insurers prove nation-state attribution in court?

Insurers face a genuine evidentiary challenge. Public attribution statements from governments (Five Eyes joint attributions) provide some evidence but are not sworn testimony subject to cross-examination. Private cyber forensics reports can provide technical evidence of attacker infrastructure and TTPs consistent with known state-sponsored groups. The legal sufficiency of this evidence varies by jurisdiction and has not been definitively resolved in appellate decisions, which is why cases continue to settle.

Does the Merck ruling protect other policyholders from war exclusions?

The Merck ruling is persuasive authority, not binding precedent outside New Jersey state courts, and applied to legacy policy language that has since been largely replaced with new explicit cyber war exclusion language. The ruling's practical protection for policyholders is limited—modern policies drafted after 2022 with explicit cyber war exclusions per Lloyd's mandate are on different legal footing than the 1940s-era language at issue in Merck.

What is the status of cyber insurance for Ukrainian private companies?

Ukrainian private companies predominantly lost access to international cyber insurance coverage after the February 2022 invasion, as standard policies exclude active conflict zones. Companies with multinational corporate parents may retain coverage through umbrella policies that include some conflict zone provisions. Domestic Ukrainian insurance market capacity for cyber risks remains limited. Some specialized war risk insurers have offered narrow coverages for specific Ukrainian risks.

What changes have insurers made to prevent future Merck-style rulings?

Post-Merck policy changes include: explicit definitions of "cyber war" and "state-sponsored cyber attack" in cyber policy exclusions; specification that official government attribution statements by multiple governments constitute binding attribution; carve-back provisions providing sublimited coverage for certain attack categories that fall below "significantly impairs state functioning" threshold; and clearer language about whether collateral damage from attacks primarily targeting other states is covered or excluded.

Sources

1. Merck & Co. v. ACE American Insurance Co. — New Jersey Superior Court, January 2022
2. Lloyd's — "Cyber War Exclusion: Updated Requirements and Model Language," lloyds.com 2022
3. Insurance Journal — "Cyber War Exclusion Litigation Update," insurancejournal.com 2022-2023
4. Pillsbury Law — "NotPetya Cyber Insurance Coverage Litigation: Lessons Learned," 2022
5. Marsh McLennan — "Cyber War Exclusion Market Update," marsh.com 2023