Hostile/Warlike Action Exclusion Not Applicable to Russian Cyber Attack

The Superior Court of New Jersey, applying New Jersey law, granted summary judgment to the insured, Merck & Co., Inc. (“Merck”), holding that the Hostile/Warlike Action Exclusion in Merck’s all-risk policy did not bar coverage for losses resulting from a 2017 cyber-attack. Merck suffered losses totaling more than $1.4 billion due to malware that was thought to originate in the Russian Federation.

The Hostile/Warlike Action Exclusion language in Merck’s all-risk policy issued by ACE American Insurance Company (“ACE”) precluded coverage for loss or damage caused by “hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack” by any national government, their military, or their agent.

ACE argued that the malware was an instrument of the Russian Federation, used as part of its ongoing hostilities against the nation of Ukraine, and, thus, the exclusion applied. Merck disputed that the malware was an official state action, and it also disputed that a cyber-attack constituted an act of war as contemplated by the exclusion.

After reviewing several nationwide cases construing this exclusion, the Superior Court found in favor of coverage, stating that “no court has applied a war (or hostile acts) exclusion to anything remotely close to the facts herein.” Despite the increasing frequency of cyber-attacks, ACE did nothing to change the language of the exclusion to reasonably put the insured on notice that it intended to exclude cyber-attacks. Cyber-attacks are unlike “traditional” forms of warfare, and, thus, Merck had no reason to anticipate that the exclusion applied to cyber-attacks. The Superior Court found that the exclusion did not, then, apply, and granted Merck’s motion for summary judgment. Merck & Co., Inc. v. ACE Am. Ins. Co., No. UNN-L-2682-18 (N.J. Super. Ct. Jan. 13, 2022).