Pierluigi Paganini January 14, 2019

Zurich American Insurance Company is refusing to refund its client because consider the attack as “an act of war” that is not covered by its policy.

The US food giant Mondelez is suing Zurich for $100 Million after the
insurance company rejected its claim to restore normal operations following the massive NotPetya ransomware attack.

On the other side, Mondelez was requesting the payment of a policy that was promising to conver “all risks of physical loss or damage” as well as “physical loss or damage to electronic data, programs, or software, including loss or damage caused by the malicious introduction of a machine code or instruction.”

Mondelez International is one of the world’s largest snacks companies, its products include the Oreo cookies and Cadbury chocolates.

The company estimated the NotPetya attack caused a cut of three percentage points from second-quarter sales growth because of disruptions to shipping and invoices caused by the cyber attack.

The company declared that its shipping and invoicing was disrupted during the last four days of Q2.

Considering that Mondelez International’s net revenues were $6.4bn in Q1, it is possible to quantify the overall economic impact of a cyber attack.

“There are a few markets where we have permanently lost some of that revenue due to holiday feature timing, but we expect we will be able to recognize the majority of these delayed shipments in our third quarter results,” Mondelez declared in July.

After the attack, employees in different regions experienced technical problems, according to Mondelez, the malware infected 1,700 servers and 24,000 laptops.

According to the cyber security community, NotPetya is a cyber weapon develped by Russia to hit the Ukrainian government.

The overall damages that insurance firms would probably have to cover reach over $80bn. The shipping giant Maersk declared that it had lost $300 million as a result of the massive ransomware attacks.

Zurich offered an initial payment of $10m, but after a further investigation decided to not pay the policy due to an exclusion for “hostile or warlike action in time of peace or war” by a “government or sovereign power.”

This decision is a case study, both companies are facing an unprecedented court case. Of course, this situation will not have a simple resolution, even if Zurich has found a way to avoid paying the policy, it will be obliged to prove the attribution of the attack to Russia.

The ruling will be a milestone in the cyber insurance sector, whatever its outcome will force companies to review their policies and client companies to pay attention to all possible exceptions.

The case, lodged in Illinois court (2018-L-011008) is being watched keenly as a result. 

Pierluigi Paganini

(SecurityAffairs – Mondelez, cyber insurance)

[adrotate banner=”5″]

[adrotate banner=”13″]