FOLLOW US

The NotPetya Precedent: $10 Billion in Losses

The insurance industry has one major precedent to guide its thinking, and it is not reassuring. The 2017 NotPetya cyberattack, attributed to Russia, inflicted more than $10 billion in global damages. Pharmaceutical giant Merck alone absorbed $1.4 billion in losses. Its insurer, Ace American, initially denied the claim under a war exclusion. After years of litigation, New Jersey courts ruled in early 2024 that standard war exclusions did not apply to the Merck attack — a ruling that sent shockwaves through the reinsurance market and forced a fundamental rethinking of how nation-state attacks are categorized.

Moody’s Ratings issued a stark assessment following the Stryker attack: “An attack against an individual corporation, however severe, likely sits below the systemic thresholds most exclusions were designed to address. A more difficult question is whether a coordinated campaign of individual, sub-systemic attacks, spread across a variety of sectors and insureds, could collectively reach a point where exclusions trigger.”

Ransomware, Sanctions, and the OFAC Trap

There is a further legal dimension that has received inadequate attention: paying ransoms to Iranian-linked groups may itself be a federal crime. Under the International Emergency Economic Powers Act (IEEPA) and the Trading with the Enemy Act (TWEA), U.S. organizations are prohibited from engaging in transactions, directly or indirectly, with entities on the Treasury Department’s Specially Designated Nationals (SDN) list. Iran and many Iran-linked organizations appear on this list.

Law firm Kennedys has warned that Iranian APT groups use infrastructure controlled by sanctioned entities. Paying a ransom or making any transfer of value that ultimately benefits a sanctioned party could constitute a sanctions violation, even where the organization is itself a victim. This creates a catastrophic bind for businesses: they may be legally barred from paying ransoms that would allow them to restore operations, while simultaneously discovering that their cyber insurance policy excludes the loss due to a war exclusion.

Demand Surges, But Uncertainty Reigns

Despite the coverage uncertainty, demand for cyber insurance has surged dramatically since the conflict began. GlobalData insurance analyst Charlie Hutcherson confirmed that cyber insurance is viewed as the commercial product most likely to see rising demand, as businesses anticipate a higher probability of disruptive cyber events alongside physical disruption. A GlobalData survey found that 27.4% of respondents ranked cyber insurance as a more immediate pressure point than traditional geopolitical covers.

The challenge for insurers is that the companies most urgently seeking coverage are precisely those most likely to be targeted. CyberCube has identified high concentrations of high-risk companies in the financial services and healthcare sectors — the same sectors that form the core of most cyber insurance portfolios. Fitch Ratings issued a formal warning that the threat ranges from DDoS disruptions to financially motivated attacks and could lead to downstream impacts on critical infrastructure providers such as power companies and water utilities.