NotPetya and the Failure of a Legacy Clause

Every insurance policy carries a war exclusion. It is one of the oldest terms in the business, born from a simple logic: private insurers cannot underwrite the losses of armed conflict between states, because those losses are unbounded, correlated, and beyond any premium base. The clause was written for a world of armies, navies, and borders. Then cyber conflict arrived, and the legacy clause was asked to do work it was never drafted for.

The test case was NotPetya. In 2017, malware later known as NotPetya spread globally, wiping systems across shipping, pharmaceuticals, food production, and logistics. Though disguised as ransomware, it was a destructive wiper — it did not restore systems even if a ransom was paid. Multiple governments, including the United States and the United Kingdom, publicly attributed the attack to Russian military actors, describing it as part of a campaign directed at Ukraine that spilled worldwide. The losses ran into the billions of dollars across the affected companies, and much of that loss sat on property and package policies with old-fashioned war exclusions.

When major policyholders claimed for their NotPetya losses, several insurers denied coverage on the basis of the war exclusion, arguing that a state-attributed cyberattack was an act of war. The most consequential dispute was Merck's, litigated in New Jersey courts over a claim reported in the range of well over a billion dollars. The trial court, and then the appellate division, sided with the policyholder. The reasoning is what practitioners must absorb: the war exclusions at issue used language historically understood to require traditional armed conflict — the use of physical force between states — and a reasonable policyholder would not have understood that language to encompass a non-physical cyberattack. Because the insurers had continued to use legacy wording without adapting it to cyber operations, the courts declined to stretch it. The matter ultimately resolved without a higher court overturning that logic.

Do not read this as a ruling that cyberattacks can never be excluded as acts of war. Read it as a ruling about drafting. The courts penalized the insurers for using a clause built for tanks to exclude a loss caused by code, without updating the words. The lesson cut both ways. Policyholders learned that legacy war exclusions were weaker against cyber than insurers had assumed. Insurers learned that if they wanted to exclude state-sponsored cyber operations, they would have to say so explicitly, in language written for the medium. The NotPetya litigation did not settle whether such losses should be covered; it settled that the old words would not do the excluding.

There is a structural reason the war exclusion sits at the center of cyber insurance in a way it never did for fire or theft. The perils that most frighten cyber underwriters — the ones capable of hitting the entire book simultaneously — are frequently the ones most plausibly linked to state actors. A destructive, self-propagating wiper that crosses borders in hours looks less like ordinary crime and more like the digital equivalent of the catastrophe the war exclusion was designed to keep off the books. The exclusion is therefore not a peripheral term for cyber; it is the mechanism by which insurers try to wall off the correlated, potentially unbounded tail of state conflict from the losses they are willing to price. When that mechanism failed to engage in NotPetya, the whole industry recognized the wall had a hole in it.

The practitioner's task is to treat the war exclusion as a live, negotiated term rather than boilerplate. Read the actual words in the actual policy. Ask whether the exclusion is a legacy armed-conflict clause or a modern cyber-specific one. Ask what has to be true for it to engage — and, crucially, who gets to decide that it is true. NotPetya proved that the answer changes the economics of a catastrophe. An operator holding a policy whose war exclusion is silent, ambiguous, or legacy is in a very different position from one holding a policy with a precisely drafted, cyber-specific state-actor clause. Which of those positions is better depends entirely on how the clause is written and how attribution is decided — the subject of the next lesson.