A Russian military cyberweapon, disguised as ransomware and inserted into a routine software update used by 80% of Ukrainian businesses, escaped its intended target and propagated across interconnected corporate networks in 65 countries, destroying USD 10 billion in economic value in hours, shutting down the world's largest shipping company, halting pharmaceutical production, and triggering the most consequential insurance coverage litigation in cyber history: the war exclusion cases that rewrote how the industry understands the boundary between cyber risk and act of war.
NotPetya is the most consequential cyberattack in insurance history, not primarily because of its USD 10 billion in economic losses, though those were unprecedented, but because of what it forced the insurance industry to confront: the complete inadequacy of existing policy language to handle the intersection of state-sponsored cyber warfare and commercial property damage. The Merck and Mondelez litigation that followed, years of courtroom arguments over whether a Russian military cyberweapon destroying pharmaceutical manufacturing and food production systems constituted an "act of war" under language written for kinetic conflict in the 1950s, ultimately produced rulings and settlements that reshaped the entire cyber insurance market.
The ransomware framing was a lie. NotPetya looked like ransomware, it displayed a ransom note, encrypted files, and demanded Bitcoin. But there was never any decryption key. The encryption was designed to be irreversible. What appeared on 27 June 2017 was a wiper disguised as ransomware, deployed by Russian military intelligence against Ukraine, and it got loose across the entire global internet. The distinction between ransomware and wiper is not merely technical, it is the difference between an extortion operation with a possible recovery path and a deliberate act of destruction with none.
For the reinsurance and insurance industry, NotPetya established three analytical facts that had been theoretical before 2017: that a state-sponsored cyberattack could generate losses comparable to a major hurricane without any physical destruction; that corporate networks across industries and geographies were so tightly interconnected that a single malware deployment could propagate to companies with no direct relationship with the original target; and that property insurance policies written in the pre-cyber era contained war exclusion language that was fundamentally ambiguous when applied to state-sponsored cyberattacks.
Every other case study in this series involves physical damage from natural or man-made perils. NotPetya produced USD 10 billion in losses without destroying a single building, flooding a single street, or generating a single millimetre of ground motion. It is the first case study here that demonstrates catastrophe can be purely digital, and that the insurance frameworks, coverage language, and cat model approaches built for physical peril are not automatically transferable to cyber risk. NotPetya is the "Hurricane Andrew" of cyber insurance: the event that exposed a systematic gap between the risk landscape and the industry's ability to measure, price, and contractually cover it.
By June 2017, the Russia-Ukraine conflict had been ongoing for more than three years following Russia's 2014 annexation of Crimea. Sandworm, GRU Unit 74455, Russia's most aggressive offensive cyber unit, had already attacked Ukraine's power grid in 2015 and 2016, causing the first confirmed cyber-induced electricity blackouts in history. NotPetya was the next, far more destructive operation.
The timing, 27 June 2017, the day before Ukrainian Constitution Day, was deliberate. The choice of M.E.Doc as the delivery vector was equally deliberate: the primary infection vector was a compromised update mechanism for M.E.Doc, a Ukrainian accounting software used by approximately 80% of Ukrainian businesses. Doing business legally in Ukraine required M.E.Doc, it was the mandatory interface for filing tax returns with the Ukrainian government. By compromising M.E.Doc's update server months before the attack, Sandworm had seeded access to virtually every company operating in Ukraine, including the Ukrainian subsidiaries of Maersk, Merck, and Mondelez.
The attribution of NotPetya to Russia's GRU was made publicly and formally by multiple governments. The U.S., U.K., and allied governments attributed the attack to Sandworm, a hacking group operating within Russia's GRU military intelligence agency. In 2018, the U.S. Department of Justice indicted six GRU officers by name, members of Unit 74455, for their roles in NotPetya and other destructive operations. The UK's NCSC assessed that Russian military was "almost certainly responsible", its highest confidence designation. The EU, Australia, Canada, and New Zealand made parallel public attributions.
This formal multi-government attribution was not merely a diplomatic statement, it became the central factual predicate in the subsequent insurance litigation. The war exclusion cases turned on whether a cyberattack formally attributed to the military intelligence agency of a foreign state, conducted as part of an ongoing hybrid conflict, constituted a "hostile or warlike action by a government or sovereign power."
NotPetya's core deception was its resemblance to ransomware. It displayed a ransom demand, demanded Bitcoin payment, and styled itself as a financially motivated extortion operation. This provided Sandworm with a degree of plausible deniability and confused early incident response teams who applied ransomware playbooks to what was actually a deliberate, irreversible destruction operation. The fundamental difference was in the encryption design: genuine ransomware generates a decryption key the attacker holds. NotPetya executes a multi-stage destruction sequence where no decryption key was ever generated, stored, or transmitted. The 45 people who paid the USD 300 ransom received nothing.
Sandworm compromised M.E.Doc's update server months before the attack, inserting a backdoor into the legitimate software update package. On 27 June 2017, approximately one million computers received the compromised update through the normal software update mechanism, a routine action that triggered an active cyberweapon.
M.E.Doc supply chainBackdoor DLLNotPetya immediately deploys a modified version of Mimikatz to extract all credentials stored in Windows LSASS memory, harvesting usernames, passwords, and authentication tokens for every user who had recently logged in, including domain administrator credentials.
MimikatzLSASS credential dumpNotPetya spreads using EternalBlue, an exploit targeting a vulnerability in Windows' Server Message Block (SMB) protocol, believed to have been developed by the NSA and leaked by the Shadow Brokers in April 2017. Microsoft had issued a patch (MS17-010) in March 2017, three months before NotPetya, but millions of systems had not yet applied it.
EternalBlue (NSA exploit)SMBv1 vulnerabilityMS17-010Using harvested administrator credentials, NotPetya executes itself on remote machines using PsExec and Windows Management Instrumentation. Critically, this mechanism does not require the target machine to be unpatched, if NotPetya can reach a machine using valid administrator credentials, it can infect it regardless of patch status.
PsExecWMICHarvested domain credentialsNotPetya overwrites the Master Boot Record and encrypts the Master File Table using a key generated from a random string that is never stored or transmitted. The system is rendered completely unbootable. No decryption key exists. The machine requires complete wipe and reinstallation from clean media.
MBR overwriteMFT encryptionNo key storage, unrecoverableApplying the MS17-010 patch was insufficient to prevent infection. The Mimikatz credential-harvesting component, combined with PsExec and WMI lateral movement using valid administrator credentials, meant that any machine reachable from an infected machine using harvested credentials could be infected regardless of patch status. For Maersk, this meant a single infected machine in their Ukrainian office could use harvested administrator credentials to reach and destroy machines in Copenhagen, Rotterdam, New York, and Singapore without exploiting a single vulnerability.
Within hours of the M.E.Doc update deploying, Ukraine experienced the most comprehensive cyber disruption of a functioning national economy ever recorded. Government agencies, banks, hospitals, the state power utility, Kyiv's airport and metro systems, and Chernobyl's radiation monitoring system all went offline. Oschadbank, one of Ukraine's largest banks, had 90% of its computers frozen within the first hour. ATM networks went offline across Kyiv. A large Ukrainian bank's network was taken down in just 45 seconds once NotPetya entered. Ukrainian officials later estimated 10% of all computers in the country were wiped.
| Organisation | Reported Loss | Sector | What Happened |
|---|---|---|---|
| Merck & Co. | USD 870M | Pharmaceuticals | Manufacturing systems destroyed; KEYTRUDA, JANUVIA production halted for weeks. Had to borrow GARDASIL vaccine stock from U.S. government emergency reserve |
| FedEx / TNT Express | USD 400M | Logistics | TNT's European systems never fully recovered; admitted some customer package data was permanently lost. TNT's European network operated partially manually for months |
| Saint-Gobain | USD 384M | Construction materials | French multinational's global IT systems destroyed; factory and distribution operations disrupted across Europe and North America |
| Maersk | USD 250–300M | Shipping / Logistics | All 17 APM Terminal port facilities worldwide reverted to manual operations; 45,000 PCs and 4,000 servers reinstalled in 10 days. A ship carrying 10,000–20,000 containers docked every 15 minutes, handled manually |
| Mondelez International | USD 150–188M | Food & Beverage | 1,700 servers and 24,000 laptops destroyed; filed USD 100M insurance claim denied under war exclusion, triggering landmark litigation |
| Reckitt Benckiser | USD 129M | Consumer goods | Manufacturing and supply chain systems disrupted; revenue loss from production shutdown |
| Nuance Communications | USD 92M | Healthcare IT | Healthcare transcription and AI systems destroyed; hospital clients lost access to diagnostic reporting tools |
| Rosneft | Significant | Oil & Gas (Russia) | Ironic collateral victim, the Russian state oil company was among those hit, illustrating the indiscriminate nature of the malware's spread |
Of all the corporate NotPetya stories, Maersk's is the most analytically instructive. Maersk is responsible for approximately 20% of global maritime container trade, at the moment NotPetya struck, a container ship docked at a Maersk port every 15 minutes somewhere in the world. Within 10 days, Maersk had restored 4,000 of their 6,500 servers, 45,000 of their 49,000 PCs, and 2,500 of their 3,500 applications. This achievement required flying IT teams to offices across 130 countries, and relied on a single surviving domain controller discovered in a Maersk office in Ghana that had been offline when NotPetya spread, spared by a power outage. Without that one server, the recovery timeline could have been measured in months rather than days. All 1,200 applications were inaccessible and approximately 1,000 were destroyed. Data was preserved on back-ups but the applications themselves couldn't be restored from those as they would immediately have been re-infected. The company manually processed 80% of its normal work volume during the outage.
"NotPetya was not ransomware. It was a cyberweapon of mass destruction, a wiper deployed by one nation-state against another that lost containment and caused collateral damage on a global scale. The USD 10 billion in losses was not the cost of a criminal operation. It was the cost of a military operation that escaped its target."
— White House statement attributing NotPetya to Russia, February 2018The insurance consequences of NotPetya were as consequential for the industry as the technical event itself, playing out over years of litigation that ultimately reshaped the entire architecture of cyber insurance coverage. Two cases defined the debate.
The war exclusion clauses at issue had language originating in the 1950s, written to address traditional armed conflict. The standard formulation excluded losses from "hostile or warlike action in time of peace or war, including action in hindering, combating, or defending against an actual, impending, or expected attack by any government or sovereign power."
The insurers' argument: NotPetya was deployed by Russia's military intelligence agency as part of an ongoing geopolitical conflict, hostile action by a sovereign power. The policyholders' counter-argument, which ultimately prevailed in the New Jersey courts: the war exclusion was written for and has historically been interpreted to apply to kinetic armed conflict between states, not to cyberattacks against private companies. The presiding judge ruled that the War or Hostile Acts exclusion was inapplicable in the Merck claim because its language is meant to apply to armed conflict, and that insurers hadn't changed the war language to put companies like Merck "on notice" that cyberattacks wouldn't be covered.
The appeals court refined this further: the exclusion of damages caused by hostile or warlike action by a government or sovereign power requires the involvement of military action and does not preclude coverage for damages arising out of a government action motivated by ill will. This distinction, between military action (excluded) and a government action motivated by hostility (not excluded), left insurers with exclusion language that could not reliably be applied to the most important category of state-sponsored cyber events.
Many companies had cyber losses covered under all-risk property policies without explicit cyber coverage, through silent cyber. War exclusion language from the 1950s was assumed to address nation-state cyber risk. No one had tested this assumption in court.
Merck and Mondelez sue their all-risk property insurers. Courts find war exclusion language does not unambiguously exclude state-sponsored cyberattacks. Industry faces USD billions in unexpected cyber coverage exposure from legacy property policies.
Lloyd's issued a Market Bulletin outlining four exclusions from cyber insurance policies it would expect to see going forward as of 31 March 2023. Syndicates required to exclude losses from state-backed cyber operations, and to clearly define what "state-backed" means, closing the ambiguity the Merck litigation exposed.
Property and liability policies explicitly address cyber coverage, either expressly covering or expressly excluding cyber losses. Standalone cyber policies with explicit war exclusions using modern, cyber-specific language become the standard vehicle for cyber risk transfer.
NotPetya demonstrated that cyber losses are not independent across policyholders in the way that most physical peril losses are. In a hurricane, a building in New York and a building in Miami experience uncorrelated damage, they are in different locations. In NotPetya, a shipping company in Denmark, a pharmaceutical manufacturer in New Jersey, a construction materials firm in France, and a food producer in Illinois all suffered simultaneous, correlated losses, not because they were geographically connected but because they were network-connected through shared software, shared infrastructure providers, and shared internet protocols.
This network-driven correlation is the defining challenge for cyber cat models. The loss accumulation is not driven by physical proximity to a hazard source but by topology of network connectivity, a fundamentally different structure requiring fundamentally different modelling approaches. The degree to which policyholders share software dependencies, cloud providers, or network equipment vendors determines the degree of correlated exposure, a dimension invisible in geographic exposure databases and impossible to infer from property characteristics.
Before NotPetya, most property insurers had not explicitly considered whether their all-risk property books contained cyber exposure. All-risk policies were written to cover physical perils, fire, flood, windstorm. Cyber damage was not contemplated. But the Merck and Mondelez cases demonstrated that when cyber damage causes property-like losses, destroyed systems, halted production, business interruption, all-risk property policy language could be interpreted to respond to those losses in the absence of an explicit exclusion. Insurers who had priced their property books based on physical peril models found themselves with unexpected cyber exposure that no model had estimated and no pricing had reflected.
GRU Unit 74455 identifies M.E.Doc's SSH administrator credentials and compromises the company's software update server, inserting a backdoor into the legitimate update package. The compromise is undetected for months, giving attackers backdoor access to approximately one million machines across Ukrainian businesses, including the Ukrainian subsidiaries of major multinationals.
A hacking group publicly releases a cache of NSA-developed cyberweapons, including EternalBlue, an exploit for the Windows SMB vulnerability. Microsoft releases a patch in March 2017; millions of systems remain unpatched. WannaCry, a cruder ransomware, uses EternalBlue in May 2017, a dress rehearsal that should have prompted far more aggressive patching.
The M.E.Doc update activates NotPetya across approximately one million machines. Within minutes, Ukrainian government agencies, banks, power companies, Kyiv's metro, Boryspil airport, and Chernobyl's monitoring system are all offline. Oschadbank loses 90% of its computers in the first hour. Ukrainian officials later estimate 10% of all computers in the country were wiped.
NotPetya crosses international borders via the interconnected corporate networks of multinationals with Ukrainian subsidiaries. Maersk's global IT infrastructure, 45,000 PCs across 130 countries, is destroyed. Merck's manufacturing systems go offline. FedEx's TNT subsidiary loses systems. Mondelez loses 1,700 servers and 24,000 laptops. Companies across 65 countries are hit.
Maersk's IT team discovers a single surviving domain controller in their Ghana office, spared by a power outage that had it offline when NotPetya struck. This one server contains Maersk's entire Active Directory. IT teams reinstall 4,000 servers, 45,000 PCs, and 2,500 applications in 10 days. The chairman later says he expected it to take six months.
The White House, UK Cabinet Office, EU, and Australian government formally and publicly attribute NotPetya to GRU Unit 74455 (Sandworm). The U.S. calls it "the most destructive and costly cyberattack in history." Russia denies all involvement.
Merck sues its all-risk property insurers for USD 1.4 billion in NotPetya losses. Mondelez sues Zurich American for USD 100 million. Both insurers invoke war exclusion clauses. The cases proceed through multiple courts over years, with insurers and policyholders making fundamentally different arguments about what "hostile or warlike action by a government" means in the cyber context.
Judge Walsh rules that the War or Hostile Acts exclusion is inapplicable because its language is meant to apply to armed conflict. Insurers had not updated the war exclusion language to put companies on notice that cyberattacks wouldn't be covered. The ruling is immediately influential, Mondelez and Zurich settle shortly afterward.
Lloyd's issues a Market Bulletin requiring all cyber policies written on Lloyd's paper to include explicit exclusions for state-backed cyber operations by 31 March 2023. The four model exclusion clauses address attribution standards, trigger thresholds, and the definition of "state-backed", closing the silent cyber gap the NotPetya litigation exposed.
Three Merck insurers filed with the New Jersey Supreme Court and settled on confidential terms in January 2024. The Supreme Court never issues a binding ruling. The insurance industry has, by this point, already restructured its policy language in response to the lower court rulings, leaving the underlying legal question about the boundaries of war exclusions formally unresolved.
| Dimension | NotPetya 2017 (Cyber) | Hurricane Katrina 2005 (Physical) |
|---|---|---|
| Total economic loss | ~USD 10 billion | ~USD 125 billion |
| Physical footprint | None, losses were entirely digital | Louisiana, Mississippi, Alabama Gulf Coast |
| Warning time | None, propagated globally within hours of detonation | Days, hurricane track forecasting provides preparation time |
| Loss correlation driver | Network topology, shared software, infrastructure, connectivity | Geographic proximity to storm track and surge zones |
| Attribution complexity | Nation-state attribution required, intelligence assessment, not physical evidence | Cause is meteorological, attribution to natural hazard straightforward |
| Policy coverage clarity | Ambiguous, war exclusion applicability disputed in courts for years | Ambiguous, wind vs. surge coverage splits created major disputes |
| Primary cat model gap | Network correlation; silent cyber; no physical footprint to model | Levee reliability; surge undermodelling; CBI |
| Industry structural response | Lloyd's cyber war exclusion mandate; silent cyber elimination; policy language reform | NFIP reform; surge modelling investment; claims handling reform |
The Merck and Mondelez rulings established that 1950s war exclusion language, written for kinetic armed conflict, cannot reliably exclude coverage for state-sponsored cyberattacks against private companies. This forced the entire industry to write explicit, modern cyber-specific war exclusions with clear attribution standards, replacing the ambiguous legacy language that had generated years of coverage disputes.
The Lloyd's mandate requiring explicit cyber treatment in all relevant policies eliminated the silent cyber gap that NotPetya exposed. Property insurers were forced to consciously underwrite and price any cyber exposure they retained, rather than inadvertently accumulating it through all-risk language. This was the most significant structural change to property insurance product design in decades.
NotPetya's M.E.Doc delivery mechanism established the software supply chain attack as the most consequential cyber attack vector in history, a vector subsequently used in the SolarWinds operation (2020) and the Kaseya attack (2021). Mandatory software bill of materials requirements, software supply chain security standards, and increased scrutiny of software update mechanisms trace directly to the NotPetya lesson.
The MS17-010 patch for EternalBlue had been available for three months before NotPetya. Millions of systems had not applied it. NotPetya made patch management, the mundane IT practice of applying vendor security updates, a boardroom-level risk management issue. Cat models and cyber underwriting now explicitly assess patch management practices as a material risk factor.
NotPetya's credential-harvesting propagation, reaching fully patched systems using stolen administrator credentials, demonstrated that perimeter security is insufficient when credentials can be extracted from any infected machine. The post-NotPetya security investment cycle prioritised network segmentation, privileged access management, and multi-factor authentication as the primary defences against credential-based lateral movement.
NotPetya produced USD 10 billion in economic losses, comparable to a major hurricane, without physical damage, weather, or geography. It established conclusively that cyber risk can generate catastrophe-scale losses across correlated policyholders simultaneously, and must be modelled, priced, and managed as a peak peril rather than a frequency/attritional risk. The cyber cat model market, barely existent before 2017, grew substantially in the years following NotPetya.
This event is directly referenced in Exposure Data Preparation for Catastrophe Modelling - the Intermediate course on The Return Period - in Lesson 4.4 (Emerging Risks and Non-Modelled Items), where NotPetya anchors the discussion of silent cyber as an unmodelled exposure in property books; and in Lesson 4.3 (NNC and War Exclusion Return), where the Merck and Mondelez litigation outcomes are used to illustrate how policy language written for one risk universe (kinetic warfare) fails when applied to a structurally different risk category (state-sponsored cyber operations).