In 2017, a malware/cyberattack infected Merck's computer and network systems. Prior to that date, someone had gained access to the computer systems of a Ukrainian company that had developed an accounting software called M.E. Doc used by Merck and other companies in Ukraine. The malware was delivered into the accounting software. Ultimately, over 40,000 machines in Merck's network were infected, resulting in "massive disruptions" to Merck's global operations. The malware spread to at least sixty-four different countries, including Russia.
Merck sought coverage for its losses under defendants' "all risks" property insurance policies. Defendants denied coverage under the "Hostile/Warlike Action" exclusion included in all their policies. Although defendants conceded the word "warlike" might not be applicable, they asserted the word "hostile" should be read in the broadest possible sense, as meaning "adverse," "showing ill will or a desire to harm," "antagonistic," or "unfriendly." Defendants contend that any action that "reflects ill will or a desire to harm by the actor" falls within the hostile/warlike action exclusion, as long as the actor was a government or sovereign power.
The court found the plain language of the exclusion does not support defendants' interpretation. The exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action. The exclusion does not state the policy precluded coverage for damages arising out of a government action motivated by ill will.
The court also considered the history of the war exclusion, which has been included in policies for more than a century. The few applicable cases reaffirm that similar exclusions have never been applied outside the context of a clear war or concerted military action.
The court concludes the exclusion did not include a cyberattack on a non-military company that provided accounting software for commercial purposes to non-military consumers, regardless of whether the attack was instigated by a private actor or a "government or sovereign power." Defendants could not assert the exclusion to bar coverage for Merck's losses.