Merck Cyberattack Isn’t ‘Warlike Action’ Under NJ Insurance Law

Merck & Co. is entitled to insurance payouts in connection with a malware attack that was possibly orchestrated by agents of the Russian government, as a New Jersey appellate court on Monday rejected several insurance companies’ argument that the attack falls under a policy exemption for warlike actions.

Merck was attacked in June 2017 by encryption virus NotPetya through accounting software developed by a Ukrainian company. The malware blocked access to files across 40,000 Merck machines, ultimately costing the company an estimated $1.4 billion. Although the pharmaceutical company had “all risks” policies with several insurers, they excluded losses or damages ...