One attack, NotPetya, two victims, two property policies and two war exclusions with similar wording: the market might have expected from these two cases a clear answer to the question "is a state cyberattack an act of war within the meaning of a policy?". It received only one judgment, and that judgment was not about war. Merck's is about the meaning of a few words; the Mondelez case stopped before the judge spoke. This lesson reads what the judges actually read, because that, and not the geopolitical debate, is what dictated the drafting of the LMA clauses. The first lesson of the course placed the two cases in the chronology; this one goes into the texts and the reasoning.
The exclusion raised against Merck by some thirty of its property insurers removed losses caused by "hostile or warlike action in time of peace or war" by a government or sovereign power, de jure or de facto, by military, naval or air forces, or by an agent of those authorities. The insurers drew two arguments from it. The words "in time of peace" showed that the clause did not require a declared war; the reference to a government's agent covered a military intelligence unit acting through software. Merck was claiming about 1.4 billion dollars. The insurers' reasoning was consistent with the letter of the clause read word by word; it lacked support in the ordinary meaning of the phrase read as a whole.
In January 2022, the Union County trial court ruled for Merck on this point. It noted that the insurers had known of the risk of computer attack for years, that the market had begun writing explicit cyber exclusions, and that they had nonetheless not changed the wording of their own. An insured could therefore reasonably understand the clause as aimed at traditional forms of war. This reasoning does not say what war is; it says that a drafter who could have written more clearly and did not bears the uncertainty left behind. It is the rule of construction against the drafter, applied to a text nobody had reread since the risk it was asked to exclude appeared.
On May 1, 2023, the New Jersey Appellate Division affirmed, on a narrower ground. It read the phrase "hostile or warlike action" in context and according to its ordinary meaning, and concluded that it requires the involvement of military action. NotPetya struck, through the update of an accounting package, a company that had nothing military about it and whose business was commercial. The court did not have to decide attribution: even treating the attack as the work of a state, the exclusion did not apply, for lack of military action. The ruling follows a long line of American cases that read war exclusions narrowly, among them Pan American v. Aetna of 1974, decided on the hijacking of an airliner. The settlement of January 3, 2024 left this ruling as the last word.
The Mondelez case, filed in October 2018 in an Illinois court against Zurich American, shows the other side of the problem. The group was claiming about 100 million dollars; its complaint described 1,700 servers and 24,000 laptops put out of use. Zurich's exclusion also targeted hostile or warlike action by a government, a sovereign power or their agents. The debate could therefore not stop at the meaning of words: it had to be proven, before a judge, that the attack was the work of a Russian state service. The February 2018 attribution was a political statement by two governments, resting on intelligence they do not put into evidence. Turning it into judicial proof required experts, technical exhibits and an opponent free to challenge them. The parties settled in 2022, during the trial, on confidential terms: nobody knows what a judge would have held established.
The underwriter takes three findings from these two cases, which became three provisions of the 2023 clauses. The first: a judge reads words, not a geopolitical situation, and an exclusion that does not name the cyber operation does not exclude it; hence the definition of cyber operation, which requires no military force. The second: the exclusion is a defense, whose proof the insurer bears, and doubt favors the insured; hence the sentence in the A versions that expressly keeps that burden instead of pretending to shift it. The third: public attribution is evidence only if the contract makes it so; hence the attribution clause, which names the government whose word counts. The cost of the old text is also measured in time: six and a half years between the attack and Merck's settlement, during which nobody knew what the contract was worth.
Sources: Merck & Co. v. ACE American Insurance Co., Appellate Division of the New Jersey Superior Court, May 1, 2023, and the Union County trial court decision of January 2022, cross-checked against Insurance Journal and Simpson Thacher; Mondelez International v. Zurich American Insurance Co., Cook County court, Illinois, complaint of October 2018 and settlement of 2022, cross-checked against The Record and Cybersecurity Dive; Pan American World Airways v. Aetna Casualty & Surety Co., federal Court of Appeals for the Second Circuit, 1974. The "Merck v. ACE American" and "Mondelez v. Zurich" entries of the observatory's glossary give the same facts in short form.
A case fabricated for this lesson. In 2026, a property insurer renews the program of a European chemicals company. To answer the Merck case, it has added to its exclusion of hostile or warlike action, in time of peace or war, by a government or its agents, the sentence "including any computer attack carried out by or on behalf of a government". The policy carries no attribution clause. Six months later, a destructive malware wipes the control systems of one of the insured's plants. Two governments publicly attribute the attack to a foreign intelligence service. No armed conflict is under way. The committee asks the underwriter whether the 2026 addition has protected the insurer from what happened in Merck and in Mondelez.
The addition answers Merck, and Merck only. By naming the computer attack, it removes from the insured the argument that won in 2023: the exclusion no longer requires military action, and a judge can no longer confine it to traditional war. But it leaves the Mondelez question whole. The exclusion applies only if the attack was carried out by or on behalf of a government, and the insurer must prove it. The two public statements are facts in evidence, not a contractual condition met: the policy says neither which government counts, nor what kind of proof suffices, nor what happens in the meantime. The insured will be able to challenge the attribution with its own experts, and the dispute will move from the meaning of words to proof. What the underwriter tells the committee is not a coverage recommendation: it is a finding on the text. The interpretation risk has been reduced; the proof risk is intact, and it is the one the attribution clause of the 2023 A versions is written to frame.
- 01Merck (2023) did not hold that NotPetya was not state backed: it held that "hostile or warlike action" requires military action, which an attack on a civilian company is not.
- 02The trial court (2022) made the drafter bear the uncertainty of a text it could have clarified and had not changed.
- 03Mondelez, settled in 2022 without a ruling, shows the other difficulty: proving before a judge that an attack is a state's work, when public attribution is a political act.
- 04The 2023 clauses answer both: they define the cyber operation without military force, and say how attribution is established, the burden of proof staying with the insurer.