Attacks/Breaches

1/11/2019
02:15 PM
50%
50%

NotPetya Victim Mondelez Sues Zurich Insurance for $100 Million

Mondelez files lawsuit after Zurich rejects claim for damages from massive ransomware attack.

Mondelez, US food distributor and owner of major brands Ritz and Nabisco, has filed a lawsuit against Zurich Insurance Group after its claim seeking $100 million for NotPetya damage was denied.

NotPetya struck global companies with a massive ransomware attack back in 2017. Instead of encrypting data and demanding money for its return, as most ransomware attacks do, it aimed to wreak havoc by permanently damaging files. A new Financial Times report states 1,700 Mondelez servers and 24,000 laptops were permanently damaged in the global attack.

Mondelez's insurance policy covered "physical loss or damage to electronic data, programs, or software" with "the malicious introduction of a machine code or instruction," ZDNet points out. Zurich rejected the $100 million claim, saying the NotPetya attack was "hostile or warlike action in time of peace or war." This voided the claim; now Mondelez is suing Zurich in response.

The case prompts a question of how "war exclusion" factors into cyberattacks evolving in size and strength. In February 2018, the UK government officially declared Russia's military was responsible for the NotPetya campaign, which was aimed at destabilizing Ukraine and spread around the world.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 2:56:38 PM
Re: "physical loss or damage to electronic data"
Thanks, much appreciated!
mcavanaugh1
50%
50%
mcavanaugh1,
User Rank: Strategist
1/16/2019 | 10:39:35 AM
Re: "physical loss or damage to electronic data"
I have had conversations with some of my underwriters at Zurich and a couple others to confirm. I am not sure why they have not confirmed either way in writing except that they truly may not be commenting on open matters. Also, the description of coverages quoted in the article line up with your typical coverage/wording in the GL & Property policies inclusive of a minor extension of the EDP.

If I find more I will share
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/16/2019 | 9:31:12 AM
Re: "physical loss or damage to electronic data"
Do you have the source stating that the policy is currently a GL/Property Policy? Looking through the article and the read more link it doesn't seem that this is stated. Would like to read more on the logistics if this is the case.
christcpd@yahoo.com
50%
50%
[email protected],
User Rank: Apprentice
1/15/2019 | 9:12:33 PM
Re: "physical loss or damage to electronic data"
Directly from the article: "Mondelez's insurance policy covered "physical loss or damage to electronic data, programs, or software" with "the malicious introduction of a machine code or instruction,""

So, Mondelez is correct in the claim.  Zurich will lose in court is my prediction.
mcavanaugh1
50%
50%
mcavanaugh1,
User Rank: Strategist
1/15/2019 | 3:06:14 PM
Re: "physical loss or damage to electronic data"
The policy that is currently written through Zurich is a General Liability & Property Policy, not a Cyber Liability policy which is one of the big reasons that this policy is not responding.  A typical cyber liability policy incorporates language to extend coverage in events of Cyber Terrorism (Zurich included).  Mondelez is most likely trying to force a cyber claim under a GL/Property policy to get access to higher limits.  Similar cases are either ongoing or recently settled between Travelers and Chubb regarding the filing of claims under a General Liability and Crime policy respectively.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
1/14/2019 | 2:42:54 PM
"physical loss or damage to electronic data"
Typically, policies that act in the interest of the insurance provider are extremely vague in terms of verbiage. In this way, if an incident is to occur it can be close to impossible to collect. That is why its imperative to ensure the verbiage is concise and acts in the company's who takes out the policys self-interest.

However, it sounds like "physical loss or damage to electronic data" should cover company damage based on this policy's verbiage. If this policy does not deliver, then it begs the question does it even pay to get any cyber policy but minimum coverage to satisfy compliance requirements. 
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20735
PUBLISHED: 2019-01-17
** DISPUTED ** An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only...
CVE-2019-0624
PUBLISHED: 2019-01-17
A spoofing vulnerability exists when a Skype for Business 2015 server does not properly sanitize a specially crafted request, aka "Skype for Business 2015 Spoofing Vulnerability." This affects Skype.
CVE-2019-0646
PUBLISHED: 2019-01-17
A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka "Team Foundation Server Cross-site Scripting Vulnerability." This affects Team.
CVE-2019-0647
PUBLISHED: 2019-01-17
An information disclosure vulnerability exists when Team Foundation Server does not properly handle variables marked as secret, aka "Team Foundation Server Information Disclosure Vulnerability." This affects Team.
CVE-2018-20727
PUBLISHED: 2019-01-17
Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php, the dv parameter to Devices-Graph.php, or the tit parameter to drawmap.php.