The damage to Merck and Mondelez alone topped $1 billion. Their insurers would later refuse to pay out damages relating to NotPetya, citing a widely written but rarely invoked “war exemption” clause in their policies. The Russian attack, insurers concluded, qualified as an act of war;

