That didn't take long. About a month and a half after Merck & Co. scored a legal win in the insurance case tied to the 2017 "NotPetya" cyberattack, the case is in appeals—again.
The case, Merck & Co., Inc. v. Ace American Insurance Company, is heading to the New Jersey Supreme Court, a court website shows. The sides are disputing around $699.5 million in coverage, according to a court filing (PDF).
This development follows a lower court's ruling in May rejecting the insurers' argument that the “hostile/warlike action” exclusion clause should apply in this case. In making that ruling, the New Jersey appellate court said the exclusion shouldn’t be applied to a cyberattack on a non-military company—even if it originated from a government or sovereign power.
After the 2017 cyberattack, tens of thousands of computers in Merck's global network were infected, leading to a significant disruption in the pharma company's business. In an annual filing afterward, the company said the hack affected "worldwide operations including manufacturing, research and sales operations."
As one example, Merck had to take a vaccine plant offline, then borrow doses from the Centers for Disease Control and Prevention in order to make shipments. That caused the company's sales for that franchise, Gardasil, to plummet during the third quarter of 2017.
In February 2018, the White House said Russia conducted the cyberattack as "part of the Kremlin’s ongoing effort to destabilize Ukraine."
Seeking to reclaim losses tied to the event, Merck filed a lawsuit against its insurers in August 2018. The company has scored successive wins in the case in January 2022 and then in May 2023.
Now, the sides will have another chance to make their arguments at New Jersey's top court.