It then went rogue, worming its way from the computers of multinational firms with local outposts in Ukraine to their global operations, causing collateral damage to victims ranging from Maersk, a huge shipping company, and Saint-Gobain, a French construction giant, to Mondelez International, owner of Cadbury chocolate. The total hit was put at $10bn, making it the costliest such attack ever.
The Merck judgment, made public last month, is potentially a landmark one. It tackles a question of great importance in the context of modern-day belligerence: is cyber-warfare war? Merck’s insurers, including firms like Chubb, argued that there was ample evidence that NotPetya was an instrument of the Russian government and part of ongoing hostilities against Ukraine. In other words, it was an act of warlike behaviour covered by the war exclusion.