Mondelez v. Zurich
Illinois litigation in which Zurich raised the war exclusion against 100 million dollars of NotPetya losses, settled mid-trial in 2022 without a ruling.
Mondelez v. Zurich American was the first major trial to put the war exclusion to the test against a state cyberattack. The food group, hit by NotPetya in June 2017, was claiming about 100 million dollars from its property insurer, which relied on the exclusion of hostile or warlike acts by a government or its agents. The dispute, filed in October 2018 in an Illinois court, therefore turned on a question of proof: who must show that the attack was a state's work, and with what evidence, when public attribution is a political act and not a forensic finding. The parties settled in 2022, during the trial, on confidential terms. With no ruling, the question stayed open, which is why the market chose to settle it by contract, with clauses stating who attributes and by which method.
In its October 2018 complaint, Mondelez stated that NotPetya, in June 2017, had permanently disabled 1,700 servers and 24,000 laptops. The same event, by the same attacker, produced two separate lawsuits, this one and Merck's, over two close wordings of the same exclusion.
Mondelez v. Zurich, Mondelez NotPetya case, Mondelez International v. Zurich American
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.