A legal definition of cyberwar and its relationship with kinetic war has been avoided by a settlement between Merck and its insurers over damage caused by NotPetya.
Merck had lodged an insurance claim for $1.4 billion for damage caused by the NotPetya malware attack in 2017.
Merck did not have cyberinsurance but made a claim under its 'all-risks' coverage.
NotPetya was attributed to Russia as part of an effort to attack Ukraine.
For most people, this was an act of cyberwar against Ukraine.
Its effect spread around the globe, causing billions of dollars of further damage in what, on the surface, appears to be collateral damage emanating from an act of cyberwar.
This basic stance was adopted by the insurers over Merck's claim.
Merck did not have cyber insurance, and the damage was excluded by the standard war exclusion clause.
The insurers appealed again but have now settled with Merck.
Merck can be considered to have won the argument although details of the settlement have not been disclosed.
We have learned more about what fails the cyberwar legal litmus test, but are no closer to a legal definition of cyberwar.
This Cyber News was published on www.securityweek.com. Publication date: Fri, 05 Jan 2024 16:43:03 +0000