A Russian military cyberweapon, disguised as ransomware and inserted into a routine software update used by 80% of Ukrainian businesses, escaped its intended target and propagated across interconnected corporate networks in 65 countries — destroying USD 10 billion in economic value in hours, shutting down the world's largest shipping company, halting pharmaceutical production, and triggering the most consequential insurance coverage litigation in cyber history: the war exclusion cases that rewrote how the industry understands the boundary between cyber risk and act of war.
NotPetya is the most consequential cyberattack in insurance history — not primarily because of its USD 10 billion in economic losses, though those were unprecedented, but because of what it forced the insurance industry to confront: the complete inadequacy of existing policy language to handle the intersection of state-sponsored cyber warfare and commercial property damage. The Merck and Mondelez litigation that followed — years of courtroom arguments over whether a Russian military cyberweapon destroying pharmaceutical manufacturing and food production systems constituted an "act of war" under language written for kinetic conflict in the 1950s — ultimately produced rulings and settlements that reshaped the entire cyber insurance market.
The ransomware framing was a lie. NotPetya looked like ransomware — it displayed a ransom note, encrypted files, and demanded Bitcoin. But there was never any decryption key. The encryption was designed to be irreversible. What appeared on 27 June 2017 was a wiper disguised as ransomware, deployed by Russian military intelligence against Ukraine — and it got loose across the entire global internet. The distinction between ransomware and wiper is not merely technical — it is the difference between an extortion operation with a possible recovery path and a deliberate act of destruction with none. Every organisation that paid the USD 300 ransom got nothing. Every system that NotPetya infected was permanently destroyed.
For the reinsurance and insurance industry, NotPetya established three analytical facts that had been theoretical before 2017: that a state-sponsored cyberattack could generate losses comparable to a major hurricane without any physical destruction; that corporate networks across industries and geographies were so tightly interconnected that a single malware deployment could propagate to companies that had no direct relationship with the original target; and that property insurance policies written in the pre-cyber era contained war exclusion language that was fundamentally ambiguous when applied to state-sponsored cyberattacks — creating USD billions of disputed coverage that courts would spend years resolving.
To understand NotPetya, it is essential to understand its geopolitical context. By June 2017, the Russia-Ukraine conflict had been ongoing for more than three years following Russia's 2014 annexation of Crimea and support for separatist forces in eastern Ukraine. Sandworm — GRU Unit 74455, Russia's most aggressive offensive cyber unit — had already demonstrated its capabilities and intent in Ukraine: the 2015 and 2016 Ukrainian power grid attacks (BlackEnergy/Industroyer) had caused the first confirmed cyber-induced electricity blackouts in history, leaving hundreds of thousands of Ukrainians without power. NotPetya was the next, far more destructive operation.
The timing — 27 June 2017, the day before Ukrainian Constitution Day — was deliberate. Ukraine's Constitution Day (28 June) is a national holiday, meaning many IT administrators and incident responders would be absent when the malware detonated. The choice of M.E.Doc as the delivery vector was equally deliberate: the primary infection vector was a compromised update mechanism for M.E.Doc, a Ukrainian accounting software used by approximately 80% of Ukrainian businesses. Doing business legally in Ukraine required M.E.Doc — it was the mandatory interface for filing tax returns with the Ukrainian government. By compromising M.E.Doc's update server months before the attack, Sandworm had seeded access to virtually every company operating in Ukraine, including the Ukrainian subsidiaries of multinationals like Maersk, Merck, and Mondelez.
The attribution of NotPetya to Russia's GRU was made publicly and formally by multiple governments: the U.S., U.K., and allied governments attributed the attack to Sandworm, a hacking group operating within Russia's GRU military intelligence agency. In 2018, the U.S. Department of Justice indicted six GRU officers by name — members of Unit 74455 — for their roles in NotPetya and other destructive operations. The UK's National Cyber Security Centre assessed that Russian military was "almost certainly responsible" — its highest confidence designation. The EU, Australia, Canada, and New Zealand made parallel public attributions. Russia denied responsibility.
This formal multi-government attribution was not merely a diplomatic statement — it became the central factual predicate in the subsequent insurance litigation. The war exclusion cases turned on whether a cyberattack formally attributed to the military intelligence agency of a foreign state, conducted as part of an ongoing hybrid conflict, constituted a "hostile or warlike action by a government or sovereign power" — the standard language of war exclusions written decades before cyber operations existed.
NotPetya's core deception was its resemblance to ransomware — specifically to Petya, a genuine ransomware variant from 2016. It displayed a ransom demand, demanded Bitcoin payment, and styled itself as a financially motivated extortion operation. This framing served two purposes: it provided Sandworm with a degree of plausible deniability ("this is criminal ransomware, not a state operation"), and it confused early incident response teams who applied ransomware playbooks to what was actually a deliberate, irreversible destruction operation.
The fundamental difference was in the encryption design. Genuine ransomware generates a decryption key that the attacker holds — they need it to collect the ransom. NotPetya executes a multi-stage destruction sequence. The encryption was designed to be irreversible. No decryption key was ever generated, stored, or transmitted. The 45 people who paid the USD 300 ransom received nothing in return. The ransom mechanism was pure theatre — a facade over a destruction engine.
Sandworm compromised M.E.Doc's update server months before the attack, inserting a backdoor into the legitimate software update package (ZvitPublishedObjects.dll). On 27 June 2017, approximately one million computers received the compromised update through the normal software update mechanism — a routine action that triggered an active cyberweapon.
M.E.Doc supply chainBackdoor DLLNotPetya immediately deploys a modified version of Mimikatz — a legitimate security tool repurposed for offensive use — to extract all credentials stored in Windows LSASS memory. This harvests usernames, passwords, and authentication tokens for every user who had recently logged in on the infected machine, including — critically — domain administrator credentials.
MimikatzLSASS credential dumpNotPetya spreads using EternalBlue, an exploit targeting a vulnerability in Windows' Server Message Block (SMB) protocol, believed to have been developed by the NSA and leaked by the Shadow Brokers in April 2017. Microsoft had issued a patch (MS17-010) in March 2017 — three months before NotPetya — but millions of systems had not yet applied it. EternalBlue allowed NotPetya to propagate to every unpatched Windows system on the same network without any user interaction.
EternalBlue (NSA exploit)SMBv1 vulnerabilityMS17-010Using the administrator credentials extracted by Mimikatz, NotPetya executes itself on remote machines using PsExec (a legitimate Windows remote execution tool) and Windows Management Instrumentation (WMI). Critically, this mechanism does not require the target machine to be unpatched — if NotPetya can reach a machine using valid administrator credentials, it can infect it regardless of patch status. Fully patched systems were not immune if they shared a network with an infected machine whose administrator credentials had been harvested.
PsExecWMICHarvested domain credentialsNotPetya overwrites the Master Boot Record (MBR) — the critical first sector of a hard drive that the computer reads to start the operating system. It encrypts the Master File Table (MFT) of NTFS volumes using a key generated from a random string that is never stored or transmitted. The system is rendered completely unbootable. No decryption key exists. The data is permanently inaccessible. The machine requires complete wipe and reinstallation from clean media.
MBR overwriteMFT encryptionNo key storage — unrecoverableA critical and widely misunderstood aspect of NotPetya's propagation is that applying the MS17-010 patch for EternalBlue was insufficient to prevent infection. The Mimikatz credential-harvesting component, combined with PsExec and WMI lateral movement using valid administrator credentials, meant that any machine reachable from an infected machine using harvested credentials could be infected regardless of patch status. This dual-vector propagation — opportunistic vulnerability exploitation for initial spread, credential-based authentication for subsequent spread — gave NotPetya a capability that pure exploit-based malware lacked: the ability to traverse network boundaries where access control systems accepted legitimate credentials.
For Maersk, this meant that a single infected machine in their Ukrainian office — reached via the M.E.Doc update — could use harvested administrator credentials to reach, authenticate to, and destroy machines in Copenhagen, Rotterdam, New York, and Singapore without ever exploiting a single vulnerability. The network perimeter, which organisations rely on to contain infections, was irrelevant once legitimate credentials were in the attacker's hands.
Within hours of the M.E.Doc update deploying on the morning of 27 June, Ukraine experienced the most comprehensive cyber disruption of a functioning national economy ever recorded. Government agencies, banks, hospitals, the state power utility, Kyiv's airport and metro systems, and Chernobyl's radiation monitoring system all went offline.
"NotPetya was not ransomware. It was a cyberweapon of mass destruction — a wiper deployed by one nation-state against another that lost containment and caused collateral damage on a global scale. The USD 10 billion in losses was not the cost of a criminal operation. It was the cost of a military operation that escaped its target."
— White House statement attributing NotPetya to Russia, February 2018| Organisation | Reported Loss | Sector | What Happened |
|---|---|---|---|
| Merck & Co. | USD 870M | Pharmaceuticals | Manufacturing systems destroyed; KEYTRUDA, JANUVIA production halted for weeks. Had to borrow GARDASIL vaccine stock from U.S. government emergency reserve |
| FedEx / TNT Express | USD 400M | Logistics | TNT's European systems never fully recovered; admitted some customer package data was permanently lost. TNT's European network operated partially manually for months |
| Saint-Gobain | USD 384M | Construction materials | French multinational's global IT systems destroyed; factory and distribution operations disrupted across Europe and North America |
| Maersk | USD 250–300M | Shipping / Logistics | All 17 APM Terminal port facilities worldwide reverted to manual operations; 45,000 PCs and 4,000 servers reinstalled in 10 days. A ship carrying 10,000–20,000 containers docked every 15 minutes — handled manually |
| Mondelez International | USD 150–188M | Food & Beverage | 1,700 servers and 24,000 laptops destroyed; production and sales operations disrupted globally. Filed USD 100M insurance claim denied under war exclusion — triggering landmark litigation |
| Reckitt Benckiser | USD 129M | Consumer goods | Manufacturing and supply chain systems disrupted; revenue loss from production shutdown |
| Rosneft | Significant | Oil & Gas (Russia) | Ironic collateral victim — the Russian state oil company was among those hit, despite NotPetya being a Russian military operation. Illustrates the indiscriminate nature of the malware's spread |
| WPP | USD 15M+ | Advertising | Global advertising conglomerate's systems destroyed; client campaign management and creative production disrupted |
| Nuance Communications | USD 92M | AI / Healthcare IT | Healthcare transcription and AI systems destroyed; hospital clients lost access to diagnostic reporting tools |
Of all the corporate NotPetya stories, Maersk's is the most analytically instructive for understanding both the operational severity of a major cyber event and the relationship between IT resilience and physical operations. Maersk is the world's largest container shipping company, responsible for approximately 20% of global maritime container trade. At the moment NotPetya struck, a container ship carrying 10,000–20,000 containers was docking at a Maersk port every 15 minutes somewhere in the world.
The recovery was nothing short of impressive. Within 10 days, Maersk had restored 4,000 of their 6,500 servers, 45,000 of their 49,000 PCs, and 2,500 of their 3,500 applications. This achievement — the equivalent of building an entirely new IT infrastructure for a Fortune 500 company in less than two weeks — required flying IT teams to offices across 130 countries, sourcing tens of thousands of new hardware units globally at a moment when the full scale of the attack was still being assessed, and relying on a single surviving domain controller discovered in a Maersk office in Ghana that had been offline when NotPetya spread — the last backup of Maersk's entire Active Directory, spared by a power outage. Without that one server, the recovery timeline could have been measured in months rather than days. "All of our 1,200 applications were inaccessible and approximately 1,000 were destroyed. Data was preserved on back-ups but the applications themselves couldn't be restored from those as they would immediately have been re-infected," Maersk's technology chief recalled. The company manually processed 80% of its normal work volume during the outage — a demonstration of operational resilience under conditions no business continuity plan had ever anticipated.
The insurance consequences of NotPetya were as consequential for the industry as the technical event itself — and they played out over years of litigation that ultimately reshaped the entire architecture of cyber insurance coverage. Two cases defined the debate.
The war exclusion clauses at issue in both cases had language originating in the 1950s, written to address traditional armed conflict between nation-states. The standard formulation excluded losses from "hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack by any government or sovereign power."
The insurers' argument was straightforward: NotPetya was deployed by Russia's military intelligence agency as part of an ongoing geopolitical conflict with Ukraine. It was hostile action by a sovereign power. The exclusion should apply. The policyholders' counter-argument — which ultimately prevailed in the New Jersey courts — was equally logical: the war exclusion was written for and has historically been interpreted to apply to kinetic armed conflict between states, not to cyberattacks against private companies. The presiding judge ruled that the War or Hostile Acts exclusion was inapplicable in the Merck claim because its language is meant to apply to armed conflict. The ruling noted that insurers didn't change the war language to put companies like Merck "on notice" that cyberattacks wouldn't be covered, despite a trend of attacks by countries like Russia hitting private sector companies.
The appeals court refined the logic further: the appellate court found that "the exclusion of damages caused by hostile or warlike action by a government or sovereign power in times of war or peace requires the involvement of military action" and does not preclude coverage for "damages arising out of a government action motivated by ill will." The distinction — between military action (excluded) and a government action motivated by hostility (not excluded) — is subtle but legally significant, and it left insurers with exclusion language that could not reliably be applied to the most important category of state-sponsored cyber events.
The litigation outcomes, even without definitive Supreme Court rulings, sent a clear signal to the insurance market: the existing war exclusion language in property and all-risk policies could not reliably exclude coverage for state-sponsored cyberattacks. The industry's response was to rewrite the coverage architecture rather than continue to rely on contested exclusion language.
Many companies had cyber losses covered under all-risk property policies without explicit cyber coverage — through silent cyber. War exclusion language from the 1950s was assumed to address nation-state cyber risk. No one had tested this assumption in court.
Merck and Mondelez sue their all-risk property insurers. Courts find war exclusion language does not unambiguously exclude state-sponsored cyberattacks. Industry faces USD billions in unexpected cyber coverage exposure from legacy property policies.
Lloyd's issued a Market Bulletin outlining four exclusions from cyber insurance policies it would expect to see going forward as of 31 March 2023. Syndicates required to exclude losses from state-backed cyber operations, and to clearly define what "state-backed" means — closing the ambiguity that the Merck litigation exposed.
Property and liability policies explicitly address cyber coverage — either expressly covering or expressly excluding cyber losses. Standalone cyber policies with explicit war exclusions using modern, cyber-specific language become the standard vehicle for cyber risk transfer. Attribution clauses define the threshold for state-backed attribution.
GRU Unit 74455 (Sandworm) identifies M.E.Doc's SSH administrator credentials and compromises the company's software update server, inserting a backdoor into the legitimate update package. The backdoor allows remote command execution on any machine that installs the update. The compromise is undetected for months, giving attackers back-door access to approximately one million machines across Ukrainian businesses — including the Ukrainian subsidiaries of major multinationals.
A hacking group known as the Shadow Brokers publicly releases a cache of NSA-developed cyberweapons, including EternalBlue — an exploit for the Windows SMB vulnerability (MS17-010). Microsoft releases a patch in March 2017; millions of systems remain unpatched. NotPetya will weaponise EternalBlue as a propagation mechanism two months later. WannaCry, a cruder ransomware, uses EternalBlue in May 2017 — a dress rehearsal that should have prompted far more aggressive patching.
The M.E.Doc update, downloaded by approximately one million machines on or before 27 June, activates NotPetya. Within minutes, Ukrainian government agencies, banks, power companies, Kyiv's metro, Boryspil airport, and Chernobyl's monitoring system are all offline. Oschadbank loses 90% of its computers in the first hour. A large Ukrainian bank's network was taken down in just 45 seconds; part of Ukraine's transit hub was fully infected in 16 seconds. Ukrainian officials later estimate 10% of all computers in the country were wiped.
NotPetya crosses international borders via the interconnected corporate networks of multinationals with Ukrainian subsidiaries. Maersk's global IT infrastructure — 45,000 PCs across 130 countries — is destroyed. Merck's manufacturing systems go offline. FedEx's TNT subsidiary loses systems. Mondelez loses 1,700 servers and 24,000 laptops. Saint-Gobain, Reckitt Benckiser, WPP, and hundreds of other multinationals across 65 countries are hit.
Maersk's IT team discovers a single surviving domain controller in their Ghana office — spared by a power outage that had it offline when NotPetya struck. This one server contains Maersk's entire Active Directory — the essential foundation for rebuilding all other systems. IT teams reinstall 4,000 servers, 45,000 PCs, and 2,500 applications in 10 days. The chairman later says he expected it to take six months. Merck is still unable to produce some bulk pharmaceutical products a month after the attack.
The White House, UK Cabinet Office, EU, and Australian government formally and publicly attribute NotPetya to GRU Unit 74455 (Sandworm). The U.S. calls it "the most destructive and costly cyberattack in history." Russia denies all involvement. The formal attribution establishes the factual foundation for subsequent insurance litigation about whether the attack constitutes an "act of war."
Merck sues its all-risk property insurers for USD 1.4 billion in NotPetya losses. Mondelez sues Zurich American for USD 100 million. Both insurers invoke war exclusion clauses. The cases proceed through multiple courts over years, with insurers and policyholders making fundamentally different arguments about what "hostile or warlike action by a government" means in the cyber context.
Judge Walsh rules that the War or Hostile Acts exclusion is inapplicable because its language is meant to apply to armed conflict. Insurers had not updated the war exclusion language to put companies on notice that cyberattacks wouldn't be covered. The ruling is immediately influential — Mondelez and Zurich settle their case shortly afterward, with Zurich paying an undisclosed amount.
Lloyd's issues a Market Bulletin requiring all cyber policies written on Lloyd's paper to include explicit exclusions for state-backed cyber operations by 31 March 2023. The four model exclusion clauses address attribution standards, trigger thresholds, and the definition of "state-backed" — closing the silent cyber gap that the NotPetya litigation exposed and restructuring the entire architecture of cyber insurance coverage.
Three Merck insurers filed with the New Jersey Supreme Court and settled on confidential terms in January 2024. The Supreme Court never issues a binding ruling. The insurance industry has, by this point, already restructured its policy language in response to the lower court rulings — making the Supreme Court precedent less necessary but leaving the underlying legal question about the boundaries of war exclusions formally unresolved.
NotPetya demonstrated that cyber losses are not independent across policyholders in the way that most physical peril losses are. In a hurricane, a building in New York and a building in Miami experience uncorrelated damage — they are in different locations, subject to different hazard intensities. In a cyber event like NotPetya, a shipping company in Denmark, a pharmaceutical manufacturer in New Jersey, a construction materials firm in France, and a food producer in Illinois all suffered simultaneous, correlated losses — not because they were geographically connected but because they were network-connected through shared software, shared infrastructure providers, and shared internet protocols.
This network-driven correlation is the defining challenge for cyber cat models. The loss accumulation is not driven by physical proximity to a hazard source but by topology of network connectivity — a fundamentally different structure that requires fundamentally different modelling approaches. The degree to which policyholders share software dependencies (like M.E.Doc), cloud providers, internet service providers, or network equipment vendors determines the degree of correlated exposure — a dimension that is invisible in geographic exposure databases and cannot be inferred from property characteristics.
Before NotPetya, most property insurers had not explicitly considered whether their all-risk property books contained cyber exposure. All-risk policies were written to cover physical perils — fire, flood, windstorm, earthquake. Cyber damage was not contemplated. But the Merck and Mondelez cases demonstrated that when cyber damage causes property-like losses — destroyed systems, halted production, business interruption — all-risk property policy language could be interpreted to respond to those losses in the absence of an explicit exclusion.
The silent cyber problem — the existence of unquantified, unpriced cyber exposure in property books that was never explicitly underwritten or modelled — was one of the most significant systemic risks that NotPetya exposed. Insurers who had priced their property books based on physical peril models found themselves with unexpected cyber exposure that no model had estimated and no pricing had reflected. The Lloyd's mandate requiring explicit cyber treatment in all relevant policies was the regulatory response to closing this gap.
| Dimension | NotPetya 2017 (Cyber) | Hurricane Katrina 2005 (Physical) |
|---|---|---|
| Total economic loss | ~USD 10 billion | ~USD 125 billion |
| Insured loss | Disputed — multi-billion; many claims denied | ~USD 65 billion |
| Physical footprint | None — losses were entirely digital | Louisiana, Mississippi, Alabama Gulf Coast |
| Warning time | None — propagated globally within hours of detonation | Days — hurricane track forecasting provides preparation time |
| Loss correlation driver | Network topology — shared software, infrastructure, connectivity | Geographic proximity to storm track and surge zones |
| Attribution complexity | Nation-state attribution required — intelligence assessment, not physical evidence | Cause is meteorological — attribution to natural hazard straightforward |
| Policy coverage clarity | Ambiguous — war exclusion applicability disputed in courts for years | Ambiguous — wind vs. surge coverage splits created major disputes |
| Primary cat model gap | Network correlation; silent cyber; no physical footprint to model | Levee reliability; surge undermodelling; CBI |
| Industry structural response | Lloyd's cyber war exclusion mandate; silent cyber elimination; policy language reform | NFIP reform; surge modelling investment; claims handling reform |
| Human fatalities | None directly attributable | 1,833 confirmed |
The Merck and Mondelez rulings established that 1950s war exclusion language — written for kinetic armed conflict — cannot reliably exclude coverage for state-sponsored cyberattacks against private companies. This forced the entire industry to write explicit, modern cyber-specific war exclusions with clear attribution standards, replacing the ambiguous legacy language that had generated years of coverage disputes.
The Lloyd's mandate requiring explicit cyber treatment in all relevant policies — either expressly covered or expressly excluded — eliminated the silent cyber gap that NotPetya exposed. Property insurers were forced to consciously underwrite and price any cyber exposure they retained, rather than inadvertently accumulating it through all-risk language. This was the most significant structural change to property insurance product design in decades.
NotPetya's M.E.Doc delivery mechanism established the software supply chain attack as the most consequential cyber attack vector in history — a vector that was subsequently used in the SolarWinds operation (2020) and the Kaseya attack (2021). The security community's response — including mandatory software bill of materials (SBOM) requirements, software supply chain security standards, and increased scrutiny of software update mechanisms — traces directly to the NotPetya lesson.
The MS17-010 patch for EternalBlue had been available for three months before NotPetya. Millions of systems had not applied it. NotPetya made patch management — the mundane IT practice of applying vendor security updates — a boardroom-level risk management issue. The failure to patch MS17-010 was not a sophisticated failure; it was a routine maintenance failure that enabled catastrophic losses. Cat models and cyber underwriting now explicitly assess patch management practices as a material risk factor.
NotPetya's credential-harvesting propagation — reaching fully patched systems using stolen administrator credentials — demonstrated that perimeter security is insufficient when credentials can be extracted from any infected machine. The post-NotPetya security investment cycle prioritised network segmentation (limiting the blast radius of any single compromise), privileged access management (restricting administrator credential exposure), and multi-factor authentication (making stolen credentials insufficient for lateral movement).
NotPetya produced USD 10 billion in economic losses — comparable to a major hurricane — without physical damage, weather, or geography. It established conclusively that cyber risk can generate catastrophe-scale losses across correlated policyholders simultaneously, and must be modelled, priced, and managed as a peak peril rather than a frequency/attritional risk. The cyber cat model market — barely existent before 2017 — grew substantially in the years following NotPetya as the industry invested in quantifying a peril it could no longer ignore.