After the 2017 NotPetya attack, Mondelez's insurer, Zurich American, refused a claim by citing a war exclusion. Mondelez sued for US$100 million and the case settled in 2022 on confidential terms. The lesson is to read exclusion wording before an incident, not after.
What was reported
The Wikipedia entry on NotPetya says Zurich American Insurance Company refused to pay a cleanup claim, calling NotPetya an act of war that the policy did not cover. It states Mondelez sued Zurich for US$100 million in 2018 and that the suit settled in 2022 with terms confidential. These details are attributed there to The Register and Cybersecurity Dive.
The article also cites a White House assessment putting total damages from NotPetya above US$10 billion, reported by Wired. It gives a Maersk estimate of US$200 million to US$300 million in lost revenue. Treat these as press figures and check them before you quote them.
What it shows about the market
The cyber insurance entry on Wikipedia notes policies typically carry a war exclusion, and that after the US and UK attributed NotPetya to Russia's military, insurers argued they did not have to cover such events.
The settlement means there is no public ruling to rely on in that case. Because terms are confidential, the case does not tell a buyer how a court would read the clause.
Why the wording matters
Exclusion language varies. Questions to ask your broker:
- What triggers the exclusion? Is it a declared war, an attack by a state, or an attack attributed to a state?
- Who decides attribution? A government statement, a court or the insurer?
- Does it cover collateral damage? Malware that spreads beyond its target is a different case from a targeted attack.
- Is there a sublimit or carve back for cyber? Some policies restore partial cover.
- How is it worded for systems you depend on? A supplier outage can hurt you even if you were not the target.
For one concrete example of newer wording, see the Lloyd's state backed attack exclusion.
What engineering leaders can do
- Do not rely on cover alone. Segment networks, test restores and limit trust between systems, so malware that spreads is contained. See cascading supply chain attacks.
- Document your controls. Evidence helps in any dispute.
- Brief the finance team. They should know the exclusions as well as the limits.
This is educational material, not legal advice. Ask counsel to read your policy.
Quick check
Did a court decide the Mondelez case?
According to the source, the suit settled in 2022 with confidential terms, so there is no public ruling from that case.
What is one question to ask about a war exclusion?
Who decides whether an attack counts as state backed, and on what evidence.
Sources
Last reviewed: 19 October 2026.
