Supreme Court of New Jersey to Hear Merck Cyberattack Case

The Supreme Court of New Jersey recently agreed to hear ACE American Insurance Company’s appeal of an Appellate Division decision finding that a war exclusion in a property insurance policy did not preclude coverage for Merck & Co., Inc.’s claim stemming from a 2017 cyberattack. We previously reported about this case here.   

In 2017, Merck, like many other companies, was the victim of a NotPetya malware attack. The malware, which was delivered to Merck’s computers through accounting software developed by a Ukrainian company, allegedly spread to 40,000 Merck computers, caused more than $1.4 billion in losses and hurt Merck’s revenues. Merck sought coverage under its $1.75 billion property insurance program, but Merck’s insurers denied coverage, citing a “hostile/warlike action” exclusion. The appellate court affirmed the lower court’s finding that the war exclusion did not preclude coverage for Merck’s claim.

The Merck case is one of the first to consider the applicability of a traditional “war” exclusion to a cyberattack that is potentially backed by a nation-state, so the New Jersey Supreme Court’s decision could set the tone for the rest of the nation. We will continue to keep you updated on developments in this case.