The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently issued a warning of the risk of Russian cyberattacks spilling over onto United States networks as part of the Russian invasion of Ukraine. This follows previous CISA warnings on the risks posed by Russian cyberattacks for critical infrastructure. The European Central Bank (ECB) has similarly warned European financial institutions of the risk of Russian cyberattacks and related market disruptions.

The risk of cyberattacks is forcing businesses and insurers to examine their policies to determine which coverages may apply to losses caused by a cyberattack. The current elevated risk draws into focus the recent decision in Merck and International Indemnity v. ACE (et al.), in which the Superior Court of New Jersey examined coverage under an All-Risk insurance policy for loss arising from the NotPetya malware. NotPetya was allegedly used by Russia in a cyberattack on Ukraine and spilled over into the rest of the world. The Merck court found that the "Hostile/Warlike action" exclusion contained in the subject policy was inapplicable and could not be used to exclude coverage for the loss.