Insurance Company Says NotPetya Is an “Act of War”, Refuses to Pay

This is why I try to avoid insurance policies wherever possible.<p>It’s still hard to argue with people questioning why I don’t buy insurance for my $25k or so of household contents in a relatively secure building.<p>I don’t care how cheap the policy is, I’m assuming they’re charging more than they payout on average, and I lock my doors consistently.

Why should &quot;act of war&quot; not be covered?<p>If I&#x27;m going broke because of a war, why shouldn&#x27;t my insurance company?<p>Similar, with natural disasters, those should be covered by default -- insurance companies can easily spread the risk geographically..<p>These exceptions feels like legacy from the &quot;good&quot; old days when wars were common and globalization limited.

I wonder how that insurance company expects to continue business. If they don&#x27;t pay in case of damage, why would anyone buy insurance from them?

&gt; <i>&quot;hostile or warlike action in time of peace or war&quot;</i><p>A lot of comments jump on the war and cyber war definitions, but the article states the exclusion is based on a &quot;hostile or warlike action&quot;, which is a much looser definition.<p>Based on the announcement of multiple governments that this attack is from Russian origin this exclusion might very well be justified.

Source article from The Register.[1]<p>[1] <a href="https:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2019&#x2F;01&#x2F;11&#x2F;notpetya_insurance_claim&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.theregister.co.uk&#x2F;2019&#x2F;01&#x2F;11&#x2F;notpetya_insurance_...</a>

I would kind of expect the argument about not paying out to be one of negligence on behalf of Mondelez. NotPetya uses the EternalBlue exploit which Microsoft patched in March 2017, NotPetya was late June 2017. Don&#x27;t install security patches on 1,700 servers and 24,000 laptops for four months? Don&#x27;t get an insurance payout.

This would be a massively interesting suit, if fought out to conclusion. Looking for a proper definition of war, you might even go back to the Hague Conventions or some historical precedents in common law. Probably the terms and conditions do not further specify &#x27;war&#x27;, let alone &#x27;cyber war&#x27;. But if it would be an easy case, the insurer wouldn&#x27;t take on Mendelez, unless perhaps as long shot to prevent ruin.

And that&#x27;s the last time anyone buys cyber insurance from Zurich. What&#x27;s the point of cyber insurance that doesn&#x27;t cover ransom wear? Just a useless waste of money.

Insurance companies live in the weird realm of customer service up front, and financial defense when the whistle is blown.

I wonder if you can get insurance against insurance companies not paying out?

Insurance is like a `bottomless wishing-well`, demands regular offerings but return favours during unforeseen emergencies not guaranteed.

So what is the standard of evidence for something like this? The fact that say top security outfits did attribution to APT-blah or APT some blahBear and there is some level of confidence that the groups might be state actors is it really enough?

Not entirely surprising that insurance company is attributing this to an Act of War.<p>* Russia is actively pursuing an Active Measures (активные мероприятия [1]) political war against the west<p>* Russian companies &amp; persons charged by Mueller have actively used the defense in filing that their actions were Acts of War, and so not illegal. These defense claims have not yet been ruled upon, AFAIK.<p>* The Russian govt, former KGB organization, Oligarchs, Russian Mob, and hacker community have effectively morphed into a single operation entity.<p>Nevertheless, it is a bit of a stretch to consider a specific hacking event as part of the Active Measures war. Not that it is surprising that the insurance company tries it. They&#x27;ll st least delay any payments.<p>This may, interestingly, raise the stakes on any cooperation with such operations (e.g., being a funds conduit, renting out a botnet to deploy the malware) from standard criminal conspiracy charges right up to treason. Not sure if it will play out that way, but I wouldn&#x27;t want to be the one testing the prosecutors&#x27; discretion, or the inclination of the NatSec organizations to get involved. Totally changes the risk profile of getting involved for those inclined to play around the edges.<p>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Active_measures" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Active_measures</a>

If insurance stops paying out then companies will take data security more seriously. Their very existence will depend on it.<p>Net win for society from my perspective.

I wonder what the long tail costs are for not paying the claim?<p>If I had any insurance policies with this company I would cancel and look elsewhere. The insurance company must have modeled both scenarios.

If they can&#x27;t pay out in a case like this, they shouldn&#x27;t be in business. I hope the affected insureds sue this scumbag insurance company into the bankruptcy it deserves. And if the whole cyber attack insurance industry goes belly up, it sounds like a win for society: maybe these other idiot companies will start to take security seriously rather than just trying to collect money for their insurance companies.

I’m curious how much the insurance thinking was: if we pay this, more companies will maintain bad security, pay bribes and we’ll be left to foot the bill.<p>In addition to more victims, the second compounding effect of this would be that giving money to hacker groups means they would become bolder. That might even mean they’d potentially blur the line from State-sponsored to something that outgrows even the authority of a (rogue) State.

Companies won&#x27;t take security seriously until there are real costs to losing customer data. Right now, they can just send out an apologetic press release after getting attacked due to their shoddy security and that&#x27;s it.

That&#x27;s a sleazy insurance company. They use a lame excuse to avoid paying.

Good luck proving conclusively in court that russia was behind the software

It’s interesting that insurance Co didn’t point to an absence of proper inclusion clause. They tried to find exclusions that may help them to pull the fast one on a customer.<p>Which means the policy wording clearly matched the covered event.

Just subpoena the intel agencies? Just because they haven&#x27;t released the evidence publicly doesn&#x27;t mean it wouldn&#x27;t seem reasonable for the intel agencies to assist the case.

Was there a declaration of war? Did their policy specifically mention &#x27;cyber war&#x27;?<p>what a steaming load.<p>insurance companies trying to squirm out of paying something is as certain as the sun rising.

It takes two to tango. If a cyber war is ongoing, then I think the insurance company should cite retaliatory action in the war as evidence. From what I can tell western governments do not generally publicize any specifics of effective cyber operations.<p>So i wonder if this puts insurance companies in a position where they benefit from classified operations are outed to bolster the case that this was indeed an act of war.