The damage to Merck and Mondelez alone topped $1 billion. Their insurers would later refuse to pay out damages relating to NotPetya, citing a widely written but rarely invoked “war exemption” clause in their policies. The Russian attack, insurers concluded, qualified as an act of war; while no lives were lost directly that June, it was a demonstration of how a stolen NSA weapon and some cleanly written code could do as much damage as a hostile military force.
