Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

<a>Recent media </a><a href="https://www.cnbc.com/2024/07/19/crowdstrike-suffers-major-outage-affecting-businesses-around-the-world.html" target="_blank" rel="noreferrer noopener">reports</a> indicate that many organizations, across a range of business sectors (e.g., banks, airports, hotels) are facing widespread information technology (IT) outages due to a disruption impacting Microsoft operating systems. According to the reports, the IT outages are the result of supply chain “updates” and not a cyberattack. This incident serves as an important reminder for organizations to assess how their customer and supply chain contracts address force majeure events arising from upstream IT and other cyber disruptions, especially in light of how major cybersecurity events could impact their ability to fulfill obligations under their business contracts, whether or not the underlying cause of these outages was malicious.

contentpilot/introduction

Contract Drafting and Similar Considerations

core/heading

A force majeure clause is a contract provision or term that provides for a defense to liability or otherwise allocates the risk of loss among the parties if performance of a contractual obligation is delayed or becomes impossible or impracticable, especially as a result of an event or effect the parties could not have anticipated or controlled. The scope and application of a force majeure clause depends on the specific terms of the contract in question. The fact that a contract contains a force majeure clause does not necessarily mean that a party has the right to invoke relief as a result of impacts to its business resulting from a ransomware attack, business email compromise, or other IT disruption. Rather, the parties will need to determine whether a force majeure event has occurred under the terms of the contract.

core/paragraph

A force majeure clause is generally drafted to identify specific types of events that may excuse performance and usually requires the event to be beyond the parties’ “reasonable control.” In some cases, it also requires that the event was not reasonably foreseeable. Traditionally, these events have included acts of God, labor shortages or strikes, governmental orders or regulations, fires, and environmental disasters, and in recent times they have been expanded to include pandemics, nuclear incidents, riots, wars, and terrorism.

However, in light of major cybersecurity events in recent years, it is becoming more common for force majeure events to be defined to expressly include:

core/list

A favorable force majeure clause may be so expansive as to include supply delays, material shortages, or increased costs or delays in obtaining goods, workers or transportation.

Interpretations of force majeure provisions can vary greatly across states and even more so in foreign (non-U.S.) jurisdictions. Accordingly, the choice of law provision in the contract is key to its interpretation and will establish what jurisdiction’s law governs. Each U.S. state except Louisiana has enacted some version of the Uniform Commercial Code (UCC), though they are not all identical. In addition, not all state and federal courts interpret the UCC provisions in the same manner. In the case of international commerce, the United Nations Convention on Contracts for the International Sale of Goods applies unless it is specifically disclaimed in the contract.

A force majeure provision should also impose protocols for notice, timetables for non-excuse or termination, and other terms relevant to evaluating a force majeure declaration and the way it is made. If applicable, a party’s compliance with these protocols can impact whether the declaration is valid and if performance can be excused.

There are only a few judicial decisions addressing whether large-scale cybersecurity events, like ransomware attacks, are considered beyond a party’s “reasonable control” for the purpose of interpreting a force majeure clause. The two leading cases in this area both relate to the Russian military-launched <a href="https://www.cloudflare.com/learning/security/ransomware/petya-notpetya-ransomware/" target="_blank" rel="noreferrer noopener">NotPetya</a> cyberattack in June 2017.

Princeton Cmty. Hosp. Ass'n v. Nuance Communs., Inc., No. 1:19-00265, 2020 U.S. Dist. LEXIS 60490 (S.D. W. Va. Apr. 6, 2020), involves civil litigation arising from <a>the </a>NotPetya cyber operations. Here, the plaintiff (Princeton Community Hospital Association, Inc.) alleged that software from the defendant (Nuance Communications, Inc.) was integrated into its hospital computer network, which was corrupted during the NotPetya event, resulting in the plaintiff’s IT systems being “infected by malicious malware that embedded and destroyed” all data and encrypted its “entire computer health network.” The plaintiff argued that the defendant was responsible for its total damages in the amount of approximately $6.8 million. The master agreement between the two parties included a force majeure clause that the defendant wanted to invoke to excuse itself from liability. The defendant contended that the malware attack clearly fit within the language of the force majeure clause that excused the defendant’s “nonperformance.” The court assumed – but did not decide – that the NotPetya attack was a “governmental act or order,” “act of terrorism,” and/or “act of war.”

Heritage Valley Health Sys. v. Nuance Communs.", Inc., 479 F. Supp. 3d 175 (W.D. Pa. 2020), sets forth a similar set of circumstances. Here, the plaintiff (Heritage Valley) claimed that it suffered damages when malware from the NetPetya cyberattack entered its computer network system through a network connection with the defendant (Nuance Communications, Inc). The plaintiff alleged that the attack's success was a result of the defendant’s “poor ‘security practices and governance oversight’” and “of [the defendant’s] own information security failings.” The agreement between the plaintiff and defendant included a force majeure clause. While the defendant’s motion to dismiss was granted due to other defenses, the court noted in a footnote that “a cyber-attack launched by the Russian government which affected many other companies and organizations worldwide – was arguably beyond [the defendant’s] reasonable control.”

A force majeure clause is a bargained-for assumption of risk provision and is becoming more important in contract negotiations. In light of major disruptions to contractual performance obligations in recent years (e.g., COVID-19, global cyberattacks), these clauses can no longer be viewed as boilerplate or an afterthought. The recent Microsoft incident serves as an important reminder for organizations to assess how their customer and supply chain contracts address force majeure events arising from IT and other cyber disruptions.

core/separator

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/07/Privacy-Cybersecurity-Update-The-Microsoft-Outage-Cyber-Disruptions-and-Force-Majeure-Events.pdf

The Microsoft Outage, Cyber Disruptions, and Force Majeure Events

Services