Merck & Co., Inc. v. Ace American Ins. Co., 475 N.J. Super. 420 (App. Div. 2023). Plaintiff (“Merck”) suffered a cyberattack from malware known as NotPetya. An expert for Merck’s insurance companies in this case (“Insurers”) concluded that NotPetya was “introduced into Merck through a server located in its Ukraine office that was running M.E. Doc (a tax software application used by Merck and other companies operating in Ukraine).” Over 40,000 computers in Merck’s network were infected. Merck said that the cyberattack “caus[ed] production facilities and critical applications to go offline and create[ed] massive disruptions to Merck’s operations, including its manufacturing, research and development, and sales operations.”

As Judge Currier recounted in her opinion for the Appellate Division in this case, “[t]he NotPetya malware spread to at least sixty-four different countries, including Russia. Among the companies infected by NotPetya were ‘a number of leading Russian companies, including Russia’s largest oil producer, Rosneft; one of Russia’s top lenders, Home Credit bank; and Evraz, a Russian steel manufacturing and mining company.” NotPetya also infected the systems of other multinational companies. While the attack caused property damage, there was no evidence the NotPetya malware caused bodily injury or death.” Thus, Merck was far from the only victim of NotPetya.

Merck had “all risks” insurance with several Insurers, and Merck called on the Insurers to cover the losses caused by NotPetya. Most of those Insurers denied coverage based on two “materially identical” exclusions: a “hostile/warlike” exclusion and a “war and terrorism” exclusion. They contended that the cyberattack was instigated by the Russian Federation, a claim that was disputed.

Merck sued and, after discovery, sought summary judgment, as did the Insurers. The Law Division granted Merck’s motion. That court noted that the language of the “hostile/warlike” exclusion, which had been employed for many years, had never been applied to facts such as those here. Moreover, though cyberattacks have become more common, “Insurers did nothing to change the language of the exemption to reasonably put this insured on notice that it intended to exclude cyber attacks. Certainly they had the ability to do so. Having failed to change the policy language, Merck had every right to anticipate that the exclusion applied only to traditional forms of warfare.” Under traditional rules of interpreting and applying insurance policies, Merck’s reasonable expectation was that there was coverage for the NotPetya attack, and the Law Division so found. The insurers appealed, but the Appellate Division affirmed, applying de novo review.

Judge Currier quoted the “hostile/warlike” exclusion as barring otherwise contracted-for coverage for “[l]oss or damage caused by hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack: (a) by any government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval, or air forces; (b) or by military, naval, or air forces; (c) or by an agent of such government, power, authority, or forces[.]” She then laid out some of the basic principles that govern insurance litigation. Those included that contract principles apply, policy language is given its “plain and ordinary meaning,” insureds have the burden of showing that (absent an exclusion) the policy covers the loss at issue, but that once that occurs, insurers must show that an exclusion applies, and that exclusions are narrowly construed. Finally, “[i]f the terms used in an exclusionary clause are ambiguous, courts apply the meaning that supports coverage rather than the one that limits it.”

The Insurers admitted that “warlike” might not be applicable here. But they argued that “the word ‘hostile’ should be read in the broadest possible sense, as meaning ‘adverse,’ ‘showing ill will or a desire to harm,’ ‘antagonistic,’ or ‘unfriendly.’ According to the Insurers, any action that ‘reflects ill will or a desire to harm by the actor’ falls within the hostile/warlike action exclusion, as long as the actor was a government or sovereign power, in this case the Russian Federation.”

Judge Currier did not agree. She stated that “the plain language of the exclusion does not support the Insurers’ interpretation. The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will.” She cited Supreme Court cases that had required “plain language pertinent to the situation to permit the enforcement of an exclusion.” None of those cases “held that words in an exclusion should be interpreted using the broadest dictionary definition available, as the Insurers contend.”

Given “basic construction principles requiring a court to narrowly construe an insurance policy exclusion[, t]he specific, plain, clear, and prominent meaning of, and the clear import and intent of, a word or phrase in an exclusion does not equate to its broadest possible interpretation, but rather its narrowest.” In short, “the plain language of the exclusion did not include a cyberattack on a non-military company that provided accounting software for commercial purposes to non-military consumers, regardless of whether the attack was instigated by a private actor or a ‘government or sovereign power.'”

Judge Currier went on to buttress her opinion with an analysis of the history of the war exclusion and a review of the cases, from New Jersey and elsewhere, cited by the parties (none of which, she observed, involved “the exact language at issue here … [or] a cyberattack”). The cases reinforced the panel’s conclusion that “similar exclusions have never been applied outside the context of a clear war or concerted military action and they do not support the Insurers’ arguments.”

This dispute involved nearly $700 million in coverage. For that reason, and because, as Judge Currier stated, “there is no precedent considering the hostile/warlike action exclusion,” the Insurers may well seek Supreme Court review. Stay tuned.