# Cyber insurance cases: NotPetya, data breaches, ransomware URL: https://insurancelawestonia.ee/specialty-lines/handbook/cases/cyber-insurance-cases/ Author: Dr Olavi-Jüri Luik, Partner, Head of Insurance Law, attorney at law (Advokaadibüroo WIDEN OÜ) Last updated: 2026-11-06 > International cyber insurance cases and insurers' claims examples: war exclusion, property and liability cover, supply chain, card brand fees. > **In short.** International cyber insurance disputes revolve around four questions: whether a cyber loss is covered by traditional property or liability insurance (so-called silent cyber), whether a state-linked attack is "war", whether contractual liability (for example card brand assessments) is covered, and whether the information on security measures that the policyholder gave in the proposal matched reality. The descriptions below are based on public secondary sources.[^1] Merck, Mondelēz, Clorox and G&G Oil are analysed in more depth on the cyber insurance page of the Estonian site: see [Küberkindlustuse kaasused](https://kindlustusoigus.ee/kindlustusliigid/kahjukindlustus/kuberkindlustus/kaasused/) (in Estonian). ## 1. Merck v ACE American: NotPetya and the war exclusion (United States) **Facts.** NotPetya (2017) was destructive malware disguised as ransomware. It spread through an update of Ukrainian accounting software and hit thousands of organisations worldwide. The pharmaceutical company Merck estimated its loss at about USD 1.4 billion; it had all-risks property insurance of USD 1.75 billion. **Dispute.** The insurers relied on the war exclusion, arguing that the attack was state-sponsored action against Ukraine. **Decision.** In December 2021 a New Jersey state court held that the war exclusion did not apply. The insurer knew that cyberattacks could amount to hostile acts but had not changed the wording of the exclusion, so the policyholder could reasonably expect the exclusion to concern traditional warfare. The Appellate Division affirmed on 1 May 2023, holding that the hostile or warlike action exclusion in the policies did not apply to the cyberattack on a non-military company; the insurers obtained leave to appeal to the Supreme Court of New Jersey, but the parties settled in January 2024 and that court dismissed the appeals by an order filed on 26 January 2024, without a ruling on the merits.[^2] The outcome concerns the specific hostile/warlike action exclusion in those all-risks property policies and should not be generalised to the newer cyber-war and state-backed cyber operation exclusions. **Lesson.** The case affected the whole market: in the Lloyd's market and elsewhere, separate exclusions for cyber operations and state-backed cyberattacks were introduced. Today the outcome of such a dispute is a question of wording: whether the policy excludes state cyber operations, how a "major detrimental impact on the functioning of a state" is defined, and who has to prove attribution. See [War exclusions and cyber insurance under Estonian law](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber). ## 2. Mondelēz v Zurich: NotPetya and property insurance (United States) **Facts.** The food manufacturer Mondelēz suffered loss from NotPetya and in 2018 sued its property insurer on a claim of more than USD 100 million. The insurer relied on the war exclusion. **Outcome.** The dispute ended in October 2022 with a settlement reached shortly before the trial concluded; the terms are confidential.[^3] **Lesson.** Traditional property insurance is not a reliable fallback for cyber risk. Whether a cyber loss is covered, excluded or covered only within agreed limits under the property policy must be stated clearly in the contract. ## 3. Sony PlayStation Network: general liability insurance and a data breach (United States) **Facts.** In 2011 the Sony PlayStation Network was attacked and the data of about 77 million users leaked. Sony sought cover for the claims of users and partners under its commercial general liability (CGL) policies, relying on the cover for personal injury by publication (invasion of privacy). **Outcome.** In February 2014 a New York state court of first instance held that the leak was indeed a "publication", but that the policy required the publication to be made by the policyholder itself, not by a third party (the attacker); the court decided in favour of the insurer. The insurer and Sony settled while the appeal was pending, so no appellate decision followed.[^4] **Lesson.** General liability insurance is not cyber insurance by default. Liability for a data breach requires express cover. ## 4. Clorox v Cognizant: the IT service provider and supply chain risk (United States) **Facts.** The consumer goods manufacturer Clorox suffered a major loss from a cyberattack in 2023 and in 2025 sued its IT support service provider on a claim of about USD 380 million, alleging that the provider's help desk staff had handed passwords to the attacker without any verification.[^5] **Lesson.** In a supply chain incident, the cyber insurance of both the client and the service provider may be triggered at the same time. The service contract should address security requirements, limitations of liability and the provider's obligation to insure, and the client should check that its own insurer's subrogated claim against the provider is preserved (Law of Obligations Act (*võlaõigusseadus*, VÕS) § 492).[^6] ## 5. Capital One 2019: the cloud environment and board responsibility (United States) **Facts.** An unauthorised person gained access to credit applications and customer data stored in a cloud environment; the incident affected about 100 million customers in the United States and 6 million in Canada. Consumer class actions, securities claims and a fine imposed by the US banking supervisor followed.[^7] **Lesson.** An incident of this kind raises an allocation question between cyber insurance (notification, forensics, consumer claims) and D&O insurance (investor claims, supervisory proceedings). The cited sources do not show how Capital One's own insurers actually allocated their payments, so the split is described here as a typical coverage question, not as an established outcome. Using a cloud service does not reduce the board's responsibility: a configuration error is the company's own risk. ## 6. Netgain Technology: ransomware at a managed IT service provider (United States) **Facts.** In 2020 a managed IT service provider (MSP) was hit by ransomware, which disrupted the work of several healthcare providers and accounting firms and led to a leak of sensitive data. Court proceedings and settlements followed.[^8] **Lesson.** A client whose data is held by a service provider often bears the loss itself first and can only later claim it from the provider. The service provider's insurance contract must contain adequate cover for liability towards its clients. ## 7. MGM Resorts 2023: business interruption as the largest loss (United States) **Facts.** A ransomware attack shut down the booking, payment and gaming systems of the casino and hotel chain. The company did not pay a ransom; class actions followed.[^9] **Lesson.** The largest part of the loss was business interruption, not the data breach. A cyber policy must define clearly when an interruption counts as an insured event (only a complete outage, or also a material reduction in operating capacity), as well as the waiting period and the indemnity period. ## 8. P.F. Chang's v Federal Insurance: card brand assessments and contractual liability (United States) **Facts.** After a data breach in 2014, the cyber insurer paid the restaurant chain more than USD 1.7 million of direct costs. The dispute concerned Mastercard assessments of about USD 2 million that the chain was obliged under a contract to reimburse to its payment processor. **Decision.** In 2016 the federal court in Arizona held that, although some of the assessments fell within the policy's insuring clauses, the exclusions for liability assumed under contract applied: the chain would not have been liable for the assessments without the contract.[^10] **Lesson.** A company that processes card data must negotiate cover for card brand (PCI) assessments separately. ## 9. Columbia Casualty v Cottage Health: pre-contractual information (United States) **Facts.** Because a hospital's server had been misconfigured, the data of about 32,500 patients became publicly accessible. The insurer sought to set the policy aside retroactively (rescission), arguing that the security measures described in the proposal had not been in place.[^11] **From the Estonian law perspective**, the English term *rescission* has no automatic equivalent. If the policyholder breached the pre-contractual duty of disclosure, the insurer may, under the conditions laid down by law, withdraw from the contract (*taganemine*, VÕS §§ 441, 442), and in the case of fraud it may avoid the contract (*tühistamine*, General Part of the Civil Code Act (*tsiviilseadustiku üldosa seadus*, TsÜS) § 94).[^12] The legal consequences differ. See [Typical coverage disputes in cyber, crime and D&O insurance](https://insurancelawestonia.ee/specialty-lines/handbook/coverage-disputes) and [Ending the contract: nullity, avoidance, withdrawal, cancellation](https://insurancelawestonia.ee/estonian-insurance-contract-law/ending-the-contract). ## 10. National Bank of Blacksburg v Everest: two cyberattacks and a crime policy (United States) **Facts.** A small bank was attacked in 2016 and 2017; the attackers fraudulently credited money to customer accounts, and the money was withdrawn from ATMs. The bank estimated its loss at about USD 2.4 million and sued in 2018. The dispute concerned whether the loss fell under the computer and electronic crime rider (USD 8 million per single loss) or under the debit card rider (USD 50,000 per single loss); the insurer also treated the two attacks as a single event.[^13] **Lesson.** Where the crime policy and the cyber policy are not aligned, disputes arise over classification and sub-limits. Banks and payment service providers must negotiate both policies as one package. ## 11. G&G Oil v Continental Western: ransomware under a crime policy (United States) **Facts.** The fuel retailer's systems were encrypted in 2017. The company paid a ransom of four bitcoins (about USD 35,000) and claimed an indemnity under the computer fraud cover of its crime policy. **Decision.** In 2021 the Indiana Supreme Court held that the loss resulted directly from the use of a computer and that the payment made under duress did not break the causal link. Whether the systems had been obtained by fraud remained a question of fact, and the case was remanded.[^14] **Lesson.** Ransomware can be both a cyber risk and a crime risk. The policies must deal with computer fraud, funds transfer fraud and cyber extortion in a coordinated way. ## 12. EMOI Services v Owners: ransomware and "physical loss" in property insurance (United States) **Facts.** A company claimed a loss caused by ransomware under its businessowners' property policy, which required direct physical loss. **Decision.** The Supreme Court of Ohio held (2022-Ohio-4649) that software is intangible and cannot suffer direct physical loss or damage. The electronic equipment endorsement, which required physical loss, therefore did not cover the loss of use of the software caused by the ransomware.[^15] **Lesson.** A "physical loss" requirement in property insurance usually leaves data losses outside the cover. The Merck case (section 1) shows that, depending on the wording, the outcome may also be different. ## 13. City of Baltimore 2019: ransomware in the public sector (United States) **Facts.** Ransomware paralysed the city's payment systems, its real estate records and its e-mail. The city did not pay a ransom, and the recovery took months. In 2025 a person connected with the attack pleaded guilty in a US court.[^16] **Lesson.** Most of the loss resulted from the shutdown of operations and from the recovery, not from a data breach. Municipalities and public sector bodies also need cyber risk management and protection. ## 14. Claims examples published by insurers The insurer Beazley publishes generalised examples of cyber losses.[^17] Four of them are particularly instructive: - **An insider breach on social media.** An employee of a small-town hospital published details of a patient's treatment on social media without naming the patient, but in an identifiable way. The cyber insurance covered privacy law specialists, notification advice and crisis communication. Lesson: a data breach does not require a technical attack. - **A service provider's publicly accessible server file.** An IT service provider left publicly accessible a file containing the billing and treatment data of more than 30,000 patients; it was discovered during checks carried out before a merger. Supervisory proceedings followed. Lesson: liability towards third parties often remains with the controller of the data. - **Lost unencrypted backups.** During an IT remodelling project, unencrypted backup data containing the billing data of nearly 1.6 million children went missing. The largest costs were notification, identity protection and the supervisory proceedings. Lesson: the loss of a physical data carrier is also a cyber risk. - **The e-mails of a departing employee.** Before leaving, an employee sent patient files to a personal e-mail address. The investigation showed that the data had not been used or disseminated and that no obligation to notify arose. Lesson: a professional assessment helps to avoid both excessive and insufficient notification. ## What these cases mean for businesses in Estonia 1. Check whether your property and liability insurance excludes cyber losses, and cover the risk appropriately with cyber insurance. 2. Align the war exclusion across all policies and clarify how attribution is to be proved. 3. Negotiate cover for contractual liability and for card brand assessments if these matter in your business model. 4. Complete the insurance proposal accurately; it will later serve as evidence. 5. Check supply chain and service provider risk both in the service contract and in the insurance. ## Related pages - [Cyber claims in Estonia: NIS2, GDPR, ransomware and insurance](https://insurancelawestonia.ee/guides/cyber-claims-estonia) - [Küberkindlustuse kaasused](https://kindlustusoigus.ee/kindlustusliigid/kahjukindlustus/kuberkindlustus/kaasused/) (in Estonian): cyber insurance cases on the insurance line page - [War exclusions and cyber insurance under Estonian law](https://insurancelawestonia.ee/guides/war-exclusions-and-cyber) - [Crime insurance court cases](https://insurancelawestonia.ee/specialty-lines/handbook/cases/crime-court-cases) - [Public incidents in the Baltic states](https://insurancelawestonia.ee/specialty-lines/handbook/cases/baltic-incidents) ## References [^1]: O.-J. Luik. Ettevõtte juhtkonna riskiraamat (Risk handbook for company management). Manuscript, version of 03.05.2026, ch 41. [^2]: Merck & Co., Inc. v. ACE American Insurance Co., Docket No. UNN-L-2682-18 (N.J. Super. Ct. Law Div., Union County, order of 6 December 2021), affirmed, Nos. A-1879-21 and A-1882-21 (N.J. Super. Ct. App. Div. 1 May 2023), ; appeals dismissed with prejudice, Supreme Court of New Jersey, A-62/63 September Term 2022 (088274), order dated 23 January 2024, filed 26 January 2024, ; Merck wins cyber insurance lawsuit related to NotPetya attack. The Record, 21.01.2022. . [^3]: Mondelez International, Inc. v. Zurich American Insurance Co., No. 2018-L-11008 (Ill. Cir. Ct., Cook County; complaint filed 10 October 2018); Mondelez, Zurich reach settlement in NotPetya cyberattack insurance suit. Cybersecurity Dive, 08.11.2022. . [^4]: Zurich American Insurance Co. v. Sony Corp. of America, Index No. 651982/2011 (N.Y. Sup. Ct., N.Y. County, 21 February 2014); What cyber insurance lessons did we learn from Sony v. Zurich? . [^5]: Clorox v. Cognizant (Superior Court of California, County of Alameda; complaint filed 22 July 2025); Clorox accuses IT provider in lawsuit of giving hackers employee passwords. Reuters, 22.07.2025. ; republished by Insurance Journal. . [^6]: Law of Obligations Act (võlaõigusseadus, VÕS) § 492. RT I, 20.06.2026, 18 (in force 01.09.2026). Estonian: ; English: . [^7]: Analysis of the Capital One 2019 data breach. ACM Digital Library. ; Capital One to pay $80M penalty over 2019 data breach. Banking Dive, August 2020. . [^8]: Netgain Technology data breach settlement. HIPAA Journal. . [^9]: MGM Resorts data breach settlement analysis. SDO Security. ; Cyberattack at MGM Resorts expected to cost casino giant $100 million. ClickOnDetroit, 06.10.2023. . [^10]: P.F. Chang's China Bistro, Inc. v. Federal Insurance Co., No. 15-cv-1322 (D. Ariz. 31 May 2016), 2016 WL 3055111; overview: ArentFox Schiff. ; Simpson Thacher, 23.06.2016. . [^11]: Columbia Casualty Co. v. Cottage Health System, No. 2:16-cv-03759 (C.D. Cal.; complaint filed 31 May 2016). ; Columbia Casualty v. Cottage Health System shows importance of reading your cyber policy. CIAB. . [^12]: VÕS §§ 440–442 (n 6); General Part of the Civil Code Act (tsiviilseadustiku üldosa seadus, TsÜS) § 94. RT I, 31.12.2024, 48 (in force 01.01.2025). Estonian: ; English: . [^13]: National Bank of Blacksburg v. Everest National Insurance Co. (US District Court for the Western District of Virginia; complaint filed 28 June 2018); Bank, insurer fight over coverage for cyber attack. Business Insurance, 27.07.2018. . [^14]: G&G Oil Co. of Indiana, Inc. v. Continental Western Insurance Co., No. 20S-PL-617 (Ind. 18 March 2021). . [^15]: EMOI Services, L.L.C. v. Owners Insurance Co., Slip Opinion No. 2022-Ohio-4649 (Supreme Court of Ohio); Takeaways from Ohio court ruling on ransomware and insurance exclusions. IAPP. . [^16]: Iranian man pleads guilty in US to 2019 Baltimore ransomware attack. Reuters, 27.05.2025. ; U.S. Attorney's Office for the Eastern District of North Carolina. Press release, 27.05.2025. . [^17]: Beazley. Breach and claims examples. .