(Article from Insurance Law Alert, March 2022)
For more information, please visit the Insurance Law Alert Resource Center.
Recent events in Ukraine have heightened awareness of potential cyberattacks perpetrated by Russian actors. Resulting business interruption losses from any such cyberattacks may give rise to coverage litigation involving a war exclusion, among other issues. Outcomes in such litigation will be driven primarily by specific exclusionary language, which may differ significantly across policies.
As discussed in our January 2022 Alert, a New Jersey trial court recently ruled that a war exclusion in an all risk policy did not bar coverage for claims arising out of a malware attack. Merck & Co., Inc. v. ACE American Ins. Co., No. UNN-L-2682-18 (N.J. Super. Ct. Jan. 13, 2022). There, Merck’s insurers argued that the evidence established that the Russian government was responsible for the cyberattack and therefore coverage was barred by an exclusion that applied to:
Loss or damage caused by hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack: a) by an government or sovereign power (de jure or de facto) or by any authority maintaining or using military, naval or air forces; b) or by military, naval, or air forces; c) or by an agent of such government, power, authority or forces.
Rejecting this assertion, the court noted that decisions interpreting war-related exclusions have construed “war” to mean the use of armed forces in conflicts between nations and have deemed such exclusions to be inapplicable to scenarios not directly linked to military conflict. In so ruling, the court noted that the exclusion did not include any language indicating that it was intended to encompass cyberattacks. An interlocutory appeal of the decision is currently pending.
However, the parameters of war exclusions have rarely been tested in coverage litigation. In scenarios presenting different policy language and a factual record linking cyber-related losses to Russia’s current military actions, a war exclusion may be deemed applicable to bar coverage.