Merck $1.4 Billion Cyberhack Settlement Ends ‘Warlike’ Act Claim

Pharmaceutical giant Merck & Co. Inc. struck an 11th-hour settlement with insurers Wednesday, evading a New Jersey Supreme Court review of its massive cyberattack insurance dispute on the eve of an oral argument that could have set a national precedent impacting the booming cyber insurance market.

Three of Merck’s insurers filed stipulations with the justices Wednesday—just before the scheduled start of oral argument—notifying the court that argument was off in the insurers’ appeal of a state appellate court ruling that Merck was entitled to roughly $700 million in claims. That ruling found the insurers liable under “all risks” property insurance policies triggered when roughly 40,000 Merck computers were hacked in a 2017 Russia-linked “NotPetya” attack, and that a common “Hostile/Warlike Action” policy exclusion for coverage in cyberattack insurance can prevent claims only from “traditional forms of warfare.”

The terms of the settlement are confidential, though Merck has alleged $1.4 billion in losses from the attack.

In amicus briefs filed before the scrapped oral argument, national associations for big business, manufacturers, and corporate insurance litigators all had urged the court to uphold the ruling and plant a national flag on this issue benefiting insured businesses. Dueling briefs from international law scholars debated whether foreign-linked hacking against corporations is warlike action.

The case is Merck Co., Inc. v. ACE Am. Ins. Co., N.J., No. A-62/63-22, case settled 1/3/24.