Insurers cite 'War Exclusion' clause to avoid paying damages

Giulio Saggin
Giulio Saggin
Tuesday 28 November 2023

When Mondelez International became a victim of the NotPetya ransomware attack in June 2017, their losses totalled more than US$100 million. The food and beverage conglomerate turned to their insurer, Zurich, and were shocked by what they heard.

Zurich weren't going to pay, citing the 'war exclusion' clause in their policy as reason for non-payment. The clause is commonplace throughout the insurance industry and Zurich's standard clause, which often appears under the heading "War, Act of terrorism, Confiscation, Radioactivity", reads:

'War, invasion, acts of foreign enemies, hostilities or warlike operations (whether war be declared or not), civil war, rebellion, revolution, insurrection, civil commotion assuming the proportions of or amounting to an uprising, military or usurped power'

The grey area lies in the question, what constitutes 'war'? Like many aspects of life in the digital age, war as we know it has changed. Think 'cyber warfare', for one. With this (no doubt) in mind, and aided by the fact that not only the USA, but countries such as the UK, Canada and Australia lay blame for NonPetya on Russia, a perceived 'foreign enemy' in this case, Zurich saw this as a way out.

However, Zurich aren't alone in disputing their definition of the 'war exclusion'. Pharmaceutical giant Merck, with nearly $700 million worth of losses attributed to NonPetya, has sued more than 20 insurers - several of which used the war exclusion 'out' - that rejected claims in relation to the attack.

Not surprisingly, all this has ended up in the courts, where the two cases could take years to resolve. In the meantime, expect 'war exclusions' to be reworded.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.


SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203