Mondelez sues Zurich for refusing to pay-up over NotPetya cyber attack

Mondelez is suing Zurich Insurance for its refusal to pay-up on a $100 million claim relating to the NotPetya virus outbreak in 2017.

Mondelez has filed suit in Illinois, according to the Financial Times. The food conglomerate that acquired Cadbury in 2010 had been seeking the insurance pay-out under the terms of its property cover, which is underwritten by the Swiss insurance giant.

In those papers, Mondelez claimed that the company had been hit twice by NotPetya, rendering 1,700 servers and 24,000 laptops "permanently dysfunctional" as a result.

Under the terms of the property insurance policy, Mondelez claims that it was entitled to claim for up to $100 million for "physical loss or damage to electronic data, programs, or software, including physical loss or damage caused by the malicious introduction of a machine code or instruction".

However, while Zurich was initially prepared to make an interim $10 million up-front payment, it later refused to pay, citing an exclusion clause for a "hostile or warlike action" by a sovereign power, or people acting on their behalf.

Zurich was able to cite security experts' claims that the NotPetya attack appeared to have been one of many launched by Russia against its neighbour Ukraine.

NotPetya struck in June 2017, just one month after WannaCry. Both made use of the same EternalBlue exploit that older, unpatched versions of Microsoft Windows were vulnerable to.

EternalBlue was revealed following the Shadow Brokers series of leaks of US National Security Agency exploits. These started in the summer of 2016, with EternalBlue part of the fifth and final tranche of leaks in April 2017. The Windows security flaw that EternalBlue took advantage of had been patched a month earlier.

The initial NotPetya attack vector was the poorly secured update server of a Ukrainian accounting company, whose software is used by around four-fifths of business in the former Soviet state. This enabled the virus to be quickly propagated, not just to organisations across Ukraine, but multinationals operating in the country.

An ensuing investigation found that the update servers of the accounting firm, ME Doc, hadn't been patched in four years. The outbreak occurred on the even of the Constitution Day public holiday in Ukraine.

source computing

Industry: Cyber Security News