This Means War! NJ Court Examines Whether Cyber Attack Is Excluded Under Policy
In January, 2022, in Merck v. ACE American Insurance Company, a New Jersey Superior Court Law Division Judge ruled that a cyberattack, for insurance coverage purposes, cannot simply be excluded based on a wartime exclusion. What does it mean for insurance companies?
A cyberattack is an unfortunate side effect of the advances in technology and it is clear that this form of attack is not going away anytime soon. Some insurance policies have the longstanding wartime exclusion language that meant to apply to armed conflict but in this case, the court placed the burden on insurance companies to put its insured on notice that cyberattacks are not covered because of the wartime exclusion. If such notice is not sufficient, then insurance company cannot escape the coverage. The court emphasis the importance of phrasing the contract to properly reflect the reasonable expectations of the insured when facing ambiguous language in the policy. This decision can mean two things for insurance companies: 1) it’s time to take a look at the policy and add in language to clarify the scope of wartime exclusion to put insured on notice, or 2) for non-cyber polices, it’s time to add an ironclad cyber exclusion to limit exposure.
Thanks to Yifan Li for her contribution to this post. Please contact Heather Aquino with any questions.