Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/11/2019
02:15 PM
50%
50%

NotPetya Victim Mondelez Sues Zurich Insurance for $100 Million

Mondelez files lawsuit after Zurich rejects claim for damages from massive ransomware attack.

Mondelez, US food distributor and owner of major brands Ritz and Nabisco, has filed a lawsuit against Zurich Insurance Group after its claim seeking $100 million for NotPetya damage was denied.

NotPetya struck global companies with a massive ransomware attack back in 2017. Instead of encrypting data and demanding money for its return, as most ransomware attacks do, it aimed to wreak havoc by permanently damaging files. A new Financial Times report states 1,700 Mondelez servers and 24,000 laptops were permanently damaged in the global attack.

Mondelez's insurance policy covered "physical loss or damage to electronic data, programs, or software" with "the malicious introduction of a machine code or instruction," ZDNet points out. Zurich rejected the $100 million claim, saying the NotPetya attack was "hostile or warlike action in time of peace or war." This voided the claim; now Mondelez is suing Zurich in response.

The case prompts a question of how "war exclusion" factors into cyberattacks evolving in size and strength. In February 2018, the UK government officially declared Russia's military was responsible for the NotPetya campaign, which was aimed at destabilizing Ukraine and spread around the world.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MarkSindone
100%
0%
MarkSindone,
User Rank: Moderator
1/27/2019 | 7:58:34 PM
Do a better job!
Seriously this seems like it's all very scandalous. Honestly speaking, all attacks of a technological nature on data in storage of these companies  are going to be seen as a declaration of "war" in a certain sense isn't it! If the company isn't willing to compensate, they shouldn't be offering such policies to begin with! 
PaulChau
100%
0%
PaulChau,
User Rank: Strategist
1/26/2019 | 5:11:38 AM
Empty promises
It really isn't surprising how countless insurance companies have by far rejected various claims from their clients. Before getting us to sign a policy from them, they are the ones to sing praises of their coverage. However, upon submitting our claims, they are also the ones to reject every single one of them.
wait 10
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/18/2019 | 8:23:40 AM
Re: "physical loss or damage to electronic data"
I worked for Aon which was closely associated with Zurich and in 2004 Aon outsourced IT to Computer Sciences Corp.  It was a bad deal and a year later 140 staff and techs were dismissed, replaced by kids whose last job was delivering pizza.  True - saw their resumes and i was part of the 140.  Sometime later I performed a side taskfor Zurich in NJ and, sure enough, there was CSC again ..... so you think Zurich has troubles in IT??????  CSC staff did not even know what a backup was.  Plenty of procedures of course that slowed everything down.  Aon staff hated it and so did Zurich. (I later worked for Continuum Health partners and they outsourced to First Consulting Group which was later bought by .... CSC.  HORRIBLE experience - hospitals with virus, porn, malware rampant on 11,000 systems, no firewalls.  It was a horror).   So you think CSC would give good protection???
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 2:56:38 PM
Re: "physical loss or damage to electronic data"
Thanks, much appreciated!
mcavanaugh1
50%
50%
mcavanaugh1,
User Rank: Moderator
1/16/2019 | 10:39:35 AM
Re: "physical loss or damage to electronic data"
I have had conversations with some of my underwriters at Zurich and a couple others to confirm. I am not sure why they have not confirmed either way in writing except that they truly may not be commenting on open matters. Also, the description of coverages quoted in the article line up with your typical coverage/wording in the GL & Property policies inclusive of a minor extension of the EDP.

If I find more I will share
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 9:31:12 AM
Re: "physical loss or damage to electronic data"
Do you have the source stating that the policy is currently a GL/Property Policy? Looking through the article and the read more link it doesn't seem that this is stated. Would like to read more on the logistics if this is the case.
christcpd@yahoo.com
50%
50%
[email protected],
User Rank: Strategist
1/15/2019 | 9:12:33 PM
Re: "physical loss or damage to electronic data"
Directly from the article: "Mondelez's insurance policy covered "physical loss or damage to electronic data, programs, or software" with "the malicious introduction of a machine code or instruction,""

So, Mondelez is correct in the claim.  Zurich will lose in court is my prediction.
mcavanaugh1
50%
50%
mcavanaugh1,
User Rank: Moderator
1/15/2019 | 3:06:14 PM
Re: "physical loss or damage to electronic data"
The policy that is currently written through Zurich is a General Liability & Property Policy, not a Cyber Liability policy which is one of the big reasons that this policy is not responding.  A typical cyber liability policy incorporates language to extend coverage in events of Cyber Terrorism (Zurich included).  Mondelez is most likely trying to force a cyber claim under a GL/Property policy to get access to higher limits.  Similar cases are either ongoing or recently settled between Travelers and Chubb regarding the filing of claims under a General Liability and Crime policy respectively.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/14/2019 | 2:42:54 PM
"physical loss or damage to electronic data"
Typically, policies that act in the interest of the insurance provider are extremely vague in terms of verbiage. In this way, if an incident is to occur it can be close to impossible to collect. That is why its imperative to ensure the verbiage is concise and acts in the company's who takes out the policys self-interest.

However, it sounds like "physical loss or damage to electronic data" should cover company damage based on this policy's verbiage. If this policy does not deliver, then it begs the question does it even pay to get any cyber policy but minimum coverage to satisfy compliance requirements. 
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32066
PUBLISHED: 2021-08-01
An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the c...
CVE-2021-37759
PUBLISHED: 2021-07-31
A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2021-37760
PUBLISHED: 2021-07-31
A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).
CVE-2020-26564
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a generic survey template (containing a link to this .css file), and import this .xml file at the survey/admin/folderSurvey.do?action=viewImportSurvey['importFil...
CVE-2020-26565
PUBLISHED: 2021-07-31
ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to retrieve possibly sensitive serverInfo data.