In June 2017, employees at Merck logged into their computers and found a note saying that their files were encrypted and they would have to send a $300 bitcoin payment per computer in order to recover them.
Officials later determined that the attack originated in Russia and was aimed at companies in Ukraine. But Merck, along with several other major companies such as Saint-Gobain, a French chemicals and materials company, and Mondelez, an American food company, had become collateral damage.
Ultimately, Merck says that the attack wiped out years of research data, hampered work at facilities and cost the company $1.3 billion in damages. Now, it’s looking to recoup the costs from its $1.75 billion insurance plans that include data protection, software and coding. Yet, most of the company’s 30 insurers have rejected its claim, calling the incident an “act of war” rather than a cyberattack.
Merck has responded with lawsuits and according to Bloomberg, some analysts predict that the insurers will win, especially because President Trump publicly stated that the attack was part of the Kremlin’s “ongoing effort to destabilize Ukraine.” The insurers have also argued that Merck didn’t do a good enough job of protecting its data.
Analysts will be watching the lawsuits closely, and say that it could help determine how similar cases play out in the future, and whether or not these kinds of acts can be considered an act of war.
