As of 1 October 2026. Information only, not legal advice – see the disclaimer.

Note: This is a decision of a court of a US State on a particular policy wording. It does not establish a general standard for the interpretation of war exclusions in other policies or jurisdictions.

In June 2017 the NotPetya malware spread worldwide from Ukraine and caused extensive damage to companies, including the pharmaceutical company Merck. Several governments, among them the United Kingdom and the United States, attributed NotPetya to the Russian military in February 2018. Merck's property insurers relied on the exclusion for loss caused by “hostile or warlike action in time of peace or war” by a government or sovereign power. The trial court (Superior Court, Law Division, Union County) granted summary judgment to Merck in January 2022. The Appellate Division affirmed: it held that the exclusion, read according to its ordinary meaning and its history, requires a connection to military or warlike action and does not cover a cyber-attack on a non-military company that had no involvement in an armed conflict. The decision is frequently referred to in discussions on the application of war exclusions to State-attributed cyber-attacks.

• The decision concerns the interpretation of a contractual exclusion, not of international law. The court did not decide whether NotPetya was attributable to the Russian Federation.
• The court considered that insurers had not changed the wording of the exclusion despite the growth of cyber-attacks, and that the policyholder could reasonably understand the exclusion to refer to traditional forms of warfare.

The decision illustrates how private law allocates the losses of a cyber operation attributed to a State. A comparable dispute between Mondelez International and Zurich American Insurance over NotPetya losses was settled in 2022 without a judgment. The insurance market has since introduced specific clauses for State-backed cyber-attacks; see Lloyd's requirements on State-backed cyber-attack exclusions (2022).

• 2022-01-13: Summary judgment for Merck in the trial court.
• 2023-05-01: Appellate Division affirms.
• 2024-01-03: Settlement before decision of the New Jersey Supreme Court.

• lloyds_cyber_exclusions
• cyber_sanctions
• ict_norms
• private_actors

• Superior Court of New Jersey, Appellate Division, opinion of 1 May 2023, accessed 2026-10-01
• DAC Beachcroft: Merck prevails on war clause appeal (2023), accessed 2026-10-01
• DataBreaches.net: Merck settles coverage dispute with insurers (2024), accessed 2026-10-01

• 2026-10-01: Entry created; note on the scope of the decision added.