The world presently faces a precarious situation with Russian forces reportedly rolling into the Luhansk and Donetsk regions of Ukraine. Prior to these military operations, there were reports of cyberattacks on Ukraine's defense ministry and two banks. See Ukraine defence ministry website, banks, knocked offline, Reuters (Feb. 15, 2022). Russia rejected involvement in these cyberattacks. See Russia rejects claims it was responsible for cyberattack on Ukraine, Reuters (Feb. 19, 2022). But cyberattacks allegedly involving Russia are nothing new.

In 2017, computer systems around the world were infected with a malware known as NotPetya. Merck & Co. alleged that NotPetya damaged more than 40,000 of its computers and resulted in more than $1.4 billion in damages. Merck's insurers denied coverage based upon a so-called "war" exclusion, arguing that Russia was responsible for NotPetya and utilized the malware as part of its ongoing hostilities against Ukraine. Suit was filed in New Jersey state court followed by dueling motions for partial summary judgment on the applicability of the exclusion.

In its recent ruling in favor of the insured, the court considered general principles of insurance policy construction as well as case law regarding the war exclusion. Merck & Co. and Int'l Indem., Ltd. v. ACE American Ins. Co., Docket No.: UNN-L-2682-18 (N.J. Super Ct. Jan. 13, 2022). Although the decision applied New Jersey law, three decisions from New York courts—two from the Southern District of New York and one from Second Circuit—feature prominently in the Merck court's analysis.