Beware the War Exclusion in Cyber Liability Policies
Mondelez International fell victim to the NotPetya virus in June, 2017. As a result of the damage caused by the virus, Mondelez incurred property damage, commercial supply and distribution disruptions, unfilled customer orders, reduced margin and other losses aggregating well in excess of $100,000,000.
Mondelez made a claim under the policy it had from the Zurich Insurance Group providing for “all risks of physical loss or damage” to Mondelez’s property, specifically including “physical loss or damage to electronic data, programs, or software, including physical loss or damage caused by the malicious introduction of a machine code or instruction ….” The Policy also specifically provided other types of coverage, including but not limited to “TIME ELEMENT” coverage, including for “Actual Loss Sustained and EXTRA EXPENSE incurred by the Insured during the period of interruption directly resulting from the failure of the Insured’s electronic data processing equipment or media to operate” resulting from malicious cyber damage.
Zurich denied the coverage under the Policy under what is typically referred to as an “Act of War” exclusion. Specifically, Exclusion B.2(a) provides:
B. This Policy excludes loss or damage directly or indirectly caused by or resulting from any of the following regardless of any other cause or event, whether or not insured under this Policy, contributing concurrently or in any other sequence to the loss: …
2(a) hostile or warlike action in time of peace or war, including action in hindering, combating or defending against an actual, impending or expected attack by any:
(i) government or sovereign power (de jure or de facto);
(ii) military, naval, or air force; or
(iii) agent or authority of any party specified in i or ii above.
Initially, Zurich contended that the NotPetya virus was spread by Russia and therefore was a hostile or warlike action taken by a sovereign government or power, military force or agent thereof. Later, according to a complaint filed by Mondelez in Mondelez International, Inc. v. Zurich (2018 WL 4941760), it appears that while Zurich promised to rescind its denial and make a partial payment in the amount of $10,000,000, they did not follow through on those promises thus prompting Mondelez to file a lawsuit.
Acts of War exclusion are common in many insurance policies including the earlier cyber liability policy forms. In our experience, most insurers are open to removing them from newer cyber liability policies upon issue or renewal.