The Danger of Calling Out Cyberattackers
A bizarre $100 million lawsuit shows that companies can be collateral damage when governments publicly blame other countries for hacks.
Under attack.
Photographer: Vincent Mundy/Bloomberg
The $100 million lawsuit that Mondelez, the maker of Oreos and Cadbury chocolate, has brought against Zurich Insurance Group shows that governments should be more careful about identifying the would-be culprits in putative cyberwars: Such claims can have unintended consequences, and can sometimes harm businesses.
In June 2017, a malware program dubbed ExPetr or NotPetya wreaked havoc at Danish shipping giant Maersk, U.S. pharma titan Merck, Russian state-owned oil company Rosneft and a number of other big corporations, including Mondelez. NotPetya used an exploit known as EternalBlue, created by the U.S. National Security Agency and leaked earlier in 2017.