Pharmaceutical company Merck wins multimillion-dollar ransomware settlement

Five years have passed since the Russian government's cyberattack on Ukraine that hit the pharmaceutical company Merck, which saw its 30,000 computers and 7,500 servers rendered unusable by the NotPety ransomware. Initially, insurers considered that the losses should be subject to an 'act of war' exclusion so as not to indemnify the pharmaceutical company.

The fact that cyberattacks are now more common was the key to considering this incident as subject to indemnification by insurers, setting a possible precedent for disputes to come. According to the judge's interpretation, 'the insurers did not modify the language of their contract to exclude cyberattacks', leaving the pharmaceutical company free to consider this attack a consequence of a traditional form of warfare.