Merck v. ACE American
New Jersey case in which the "hostile or warlike action" exclusion of a property policy failed to defeat 1.4 billion dollars of NotPetya losses.
Merck v. ACE American pitted the pharmaceutical company against some thirty of its property insurers after the NotPetya attack of June 2017, which the US and UK governments attributed to the Russian military. The insurers denied cover under the "hostile or warlike action" exclusion, drafted for conventional war and never adapted to cyber. The trial court, in January 2022, then the New Jersey Appellate Division, on May 1, 2023, held that the clause targeted the use of military force, not a cyberattack on a civilian company, even one carried out by a state. The case settled in January 2024, before the state Supreme Court heard it. Its lesson for underwriting fits in one sentence: an exclusion that does not name cyber does not exclude it, and this ruling is what hastened the London market's cyber war clauses.
Merck was claiming about 1.4 billion dollars under all risks property policies. On August 16, 2022, while the appeal was pending, Lloyd's issued Market Bulletin Y5381, requiring every standalone cyber policy incepting from March 31, 2023 to carry an express exclusion of state-backed attacks: the market did not wait for the ruling to draw the conclusion.
Merck v. ACE, Merck NotPetya case, Merck & Co. v. ACE American Insurance
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.