You must be kidding, right? NotPetya was designed for Ukrainian targets and brought the country to their knees (again) - what some Western companies like Merck or Maersk experienced was just a tiny fraction of what the institutions in Kiev went through.

Whether insurers like AIG can run away from their contractual obligations playing the "cyber war" card is a different issue. Technically, it was a cyberattack similar to many others, no matter if the authors were Kremlin-employed or not.