War Risk Exclusions Threaten Cyber Coverage.

• Author: Gold, Joshua
• Position: FOREFRONT

It has become common knowledge that some cybercriminals are affiliated with nation states, and may have state backing for the mayhem they have wrought--money stolen from international banking funds transfer systems, email caches hacked and exposed, reams of personal data published.

The suspected role of nation-state actors has raised the possibility that insurance companies may attempt to invoke war risk exclusions to escape paying cyber-related insurance claims. But even if a given war risk exclusion does have some technical applicability to a cyber claim where state involvement is suspected, would an insurance company actually attempt to invoke it to deny coverage?

Until recently, disputes over the application of a war exclusion have generally remained private and been resolved through negotiation. Last fall, however, a property insurance company invoked the war risk exclusion over a cyber loss claim, compelling the policyholder to sue for coverage.

In October 2018, snack company Mondelez International, owner of Nabisco and Cadbury, filed suit in Cook County, Illinois, against its insurer, Zurich American Insurance Company, challenging a cyber coverage claim denial. According to the Mondelez complaint, the 2017 NotPetya attack, which has been attributed to state-sponsored Russian hackers, rendered 1,700 company computer servers and approximately 24,000 laptops "permanently dysfunctional." Mondelez sought coverage under an all-risk property policy mat protected against property damage and business interruption losses and promised protection for computer-related harm. The policy also provided express coverage for cyber perils, including "physical loss or damage to electronic data, programs or software, including physical loss or damage caused by the malicious introduction of a machine code or instruction."

Zurich denied the $100 million claim, however, and invoked the property policy's war exclusion, which barred coverage for "hostile or warlike action... by any... government or sovereign power... military, naval or air force," or an agent or authority of the aforementioned entities. The suit has not yet been adjudicated.

Mondelez should have the stronger legal position in this dispute. Under an all-risk insurance policy, a policyholder has a very limited set of items upon which it carries the burden of proof. As a corollary, courts often reject an insurance company's attempt to narrow the scope of the insuring agreements and broaden the...