New Jersey Appeals Court Affirms War Exclusion

The appellate division of New Jersey Superior Court Appellate has upheld a state trial court opinion that the war exclusion in drugmaker Merck & Co.’s all-risk property insurance policies does not apply in the case of the cyber attack that the company suffered in 2017.

The appeals court affirmed that insurers could not use the policy exclusion to avoid covering about $1.4 billion in damages Merck & Co. said it suffered from a spring 2017 cyber attack known as NotPetya.

The appeals court agreed with the lower court ‘s decision issued in January, 2022 that the plain language of the exclusion does not support the insurers’ position. It found that the exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action.

The hostile/warlike action exclusion was included in each of the 2017-2018 policies involved. It excludes loss or damage “caused by hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack by any government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval, or air forces; or by military, naval, or air forces; or by an agent of such government, power, authority, or forces.

While insurers conceded the word “warlike” in the exclusion might not be applicable, they asserted the word “hostile” should be read in the broadest possible sense, as meaning “adverse,” “showing ill will or a desire to harm,” “antagonistic,” or “unfriendly.” They contended that any action that “reflects ill will or a desire to harm by the actor” falls within the hostile/warlike action exclusion, as long as the actor was a government or sovereign power

The insurers asserted that the trial court should have granted them summary judgment because the exclusion “is clear and unambiguous, and it plainly applies to the NotPetya attack.” The war exclusion applied to the NotPetya attack because it was attributed to Russia and was meant to be deployed to disrupt and destabilize Ukraine, insurers maintained..

While insurers conceded that the word “warlike” might not be applicable, they argued that the word “hostile” should be read in the broadest possible sense, as meaning “adverse,” “showing ill will or a desire to harm,” “antagonistic,” or “unfriendly.” According to the Insurers, any action that “reflects ill will or a desire to harm by the actor” falls within the hostile/warlike action exclusion, as long as the actor was a government or sovereign power, in this case the Russian Federation.

As the American Property Casualty Insurers’ Association explained the insurers’ position, damage caused by any unfriendly action of any nature undertaken by a “nation-state” falls under the plain meaning of the hostile/warlike action exclusion.

However, the appeals court declared the plain language of the exclusion does not support the Insurers’ interpretation. “The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will,” the court wrote.

The court also considered the history of the war exclusion, which has been included in policies for more than a century. The court said the few applicable cases reaffirm that similar exclusions have never been applied outside the context of a clear war or concerted military action.

“Contrary to the Insurers’ contentions, these cases demonstrate a long and common understanding that terms similar to “hostile or warlike action” by a sovereign power are intended to relate to actions clearly connected to war or, at least, to a military action or objective,” the opinion states.. “Therefore, in addition to the plain language interpretation of the exclusion requiring the inapplicability of the exclusion, the context and history of this and similarly worded exclusions and the manner in which similar exclusions have been interpreted by courts all compel the conclusion that the exclusion was inapplicable to bar coverage for Merck’s losses.”

More than 30 insurers were involved in the case at the start. However, many have since resolved their claims with Merck, leaving eight remaining defendants. Merck’s property insurance program included the “all risks” property policies in a three-layer structure, with $1.75 billion in total limits above a $150 million deductible. The remaining eight Insurers’ policies insured percentages of coverage in one, two or all three of the layers. In total, they were disputing $699,475,000 in coverage or just under 40% of Merck’s total coverage for the policy period.

While the ruling is specific to New Jersey, when the lower court issued its decision, Moody’s Investor Service said it was a warning to property/casualty insurers and reinsurers about cyber coverage embedded in traditional policies.

In 2022, food and beverage company Mondelez International settled its lawsuit against its insurer Zurich American Insurance Co. in Illinois over its $100 million NotPetya claims.

In August, 2002, a Lloyd’s market bulletin said insurers must exclude state-backed cyber-attacks in standalone (or affirmative) cyber policies. The exclusion should include liability for losses arising from both war- and non-war-related state-backed cyber-attacks.

The Russian invasion of Ukraine has increased the risk of cyberattacks and further testing of the effectiveness of “war exclusion” and “hostile act exclusion” language. Larger insurers have taken significant pricing and underwriting actions in response to rising cyber claims in recent years, including tightened contract language, which should help mitigate underwriting losses in the current uncertain environment, Fitch Ratings reported.