Preview
Hearing Date: No hearing scheduled
Location: <>
Judge: Calendar, N
FILED
10/26/2022 2:34 PM
IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS IRIS Y. MARTINEZ
CIRCUIT CLERK
COUNTY DEPARTMENT, LAW DIVISION
COOK COUNTY, IL
FILED DATE: 10/26/2022 2:34 PM 2018L011008
2018L011008
MONDELĒZ INTERNATIONAL, INC., ) Calendar, N
) 20054366
Plaintiff, )
)
v. ) No. 2018 L 011008
)
Judge Mary Colleen Roberts
ZURICH AMERICAN INSURANCE )
COMPANY, )
)
Defendant. )
MONDELĒZ INTERNATIONAL, INC.’S MOTION FOR
DIRECTED VERDICT AT THE CLOSE OF ZURICH’S CASE
Plaintiff Mondelēz International, Inc. (“MDLZ”) hereby moves for a directed verdict at the
close of Defendant Zurich American Insurance Company’s (“Zurich”) case, pursuant to 735 ILCS
5/2-1202.
STANDARD
A directed verdict is appropriate “in those cases in which all of the evidence, when viewed
in its aspect most favorable to the opponent, so overwhelmingly favors movant that no contrary
verdict based on that evidence could ever stand.” Pedrick v. Peoria & E. R.R. Co., 37 Ill. 2d 494,
510 (1967). Here, Zurich has failed to present any evidence as to either of its defenses to coverage,
compelling a ruling in favor of MDLZ on the issue of Zurich’s liability.
ARGUMENT
I. In light of the Court’s prior ruling that the meaning of ambiguous policy language is
a question of fact for the jury after hearing extrinsic evidence to ascertain the parties’
intent, MDLZ is entitled to a directed verdict on the meaning of Exclusion B.2(a).
In its March 31 Order, the Court found that Exclusion B.2(a) in the insurance policy issued
by Zurich to MDLZ for the 2016-2017 policy period is ambiguous, and as such, its meaning should
be determined by the jury after hearing extrinsic evidence to ascertain the parties’ intent as to that
meaning. (See, e.g., Mar. 29, 2022 Hr’g Tr. at 197:12–23; Oct. 7, 2022 Hr’g Tr. 104:7–105:13.)
FILED DATE: 10/26/2022 2:34 PM 2018L011008
As part of that determination, Illinois Supreme Court precedent requires as a matter of law that
Exclusion B.2(a) be interpreted narrowly, against the insurer, and be applied only if its terms are
clear, definite, and specific.
If the policy language is susceptible to more than one reasonable meaning, it is
considered ambiguous and will be construed against the insurer. Importantly, a
policy provision that purports to exclude or limit coverage will be read
narrowly and will be applied only where its terms are clear, definite, and
specific.
Gillen v. State Farm Mut. Auto. Ins. Co., 215 Ill. 2d 381, 393, 395–96 (2005) (emphasis added)
(citations omitted); see also Lenkutis v. New York Life Ins. Co., 374 Ill. 136, 140 (1940)
(“[A]mbiguous provisions or equivocal expressions whereby the insurer seeks to limit its liability
will be construed most strongly against the insurer and liberally in favor of the insured.”);
Outboard Marine Corp. v. Liberty Mut. Ins. Co., 154 Ill. 2d 90, 121–22 (1992). Moreover, Zurich
bears the burden to demonstrate that Exclusion B.2(a) applies to MDLZ’s insurance claim. See
Gillen, 215 Ill. 2d at 393.
A. Zurich has not introduced any evidence to contradict MDLZ’s evidence of its
reasonable interpretation as to the meaning of Exclusion B.2(a) that requires
“tangible physical damage” and “the kind of physical force or violence commonly
associated with conventional wars or physical, armed conflicts.”
MDLZ has produced evidence at trial establishing that the terms “hostile or warlike
action,” particularly when construed in the context of an insurance policy exclusion referencing
attacks involving government or sovereign powers; military, naval or air forces; or agents thereof,
refer only to loss or damage caused by or arising from physical violence, armaments, deadly force,
or similar sources of kinetic effects commonly understood as attributes of conventional war or
2
related hostilities:
Pete Flaherty, MDLZ’s risk manager, understood the war exclusion in the relevant
FILED DATE: 10/26/2022 2:34 PM 2018L011008
insurance policy to involve the kind of physical force or violence commonly
associated with conventional wars or physical armed conflicts. That is why he
reached out to Ben Johnson at Zurich in 2014 with a question about the application
of the war exclusion to insured properties in Ukraine after Russia’s annexation of
Crimea and after the downing of a commercial airliner involving a missile. (Oct.
14, 2022 Trial Tr. 176:1–183:15) As it turned out, neither were sufficient to cause
Mr. Johnson to tell Mr. Flaherty that Ukraine was a war zone in late July 2014.
Instead, Mr. Johnson said it would be “pure conjecture.” (Id. at 184:19–23.)
Hermes Marangos, a leading expert on war risks and related insurance policy
exclusions, testified that in the insurance industry’s custom and practice, the words
“hostile” and “warlike” refer to physical attacks in the field of battle in the context
of war, and as result, it would be inconsistent with custom and practice to apply the
terms “hostile” and “warlike” to cyber incidents like NotPetya. (Oct. 19, 2022 Trial
Tr. 125:16-20.)
Oona Hathaway, a leading scholar on International Law, testified about the
conditions that a cyber operation must satisfy in order to qualify as a hostile or
warlike action under International Law. Specifically, one of those conditions is that
the cyber operation must cause significant tangible physical destruction or death,
which simply did not occur for NotPetya. (Oct. 19, 2022 Trial Tr. at 28:7–30:01.)
In other words, Exclusion B.2(a) applies only to an action that (1) is carried out by a
government, military, or agent thereof; and (2) causes tangible physical damage and involves the
kind of physical force or violence commonly associated with conventional wars or physical, armed
conflicts. Zurich has not introduced evidence sufficient to show that MDLZ’s interpretation of
Exclusion B.2(a) is not reasonable, and Illinois law requires that MDLZ’s interpretation be
followed. See, e.g., Outboard Marine Corp., 154 Ill. 2d at 121 (citations omitted) (“In Illinois,
ambiguities and doubts in insurance policies are resolved in favor of the insured, especially those
that appear in exclusionary clauses.”).
Zurich has produced no evidence that malware incursions on June 27, 2017 “caus[ed]
tangible physical damage and involve[d] the kind of physical force or violence commonly
3
associated with conventional wars or physical, armed conflicts,” which is the interpretation that
MDLZ contends should apply as a matter of law. (MDLZ Pretrial Motion No. 3 at 1.) To the
FILED DATE: 10/26/2022 2:34 PM 2018L011008
contrary, the evidence shows that there was no physical violence or tangible destruction associated
with the malware incursions:
Dr. Upchurch explained that NotPetya encrypted MDLZ’s computers and servers.
(Oct. 17, 2022 P.M. Trial Tr. 180:7–16.)
The computers and servers themselves were not physically destroyed or altered. For
the most part, MDLZ wiped the data on its servers and laptops and they were
“reinstalled from scratch,” as Bryon Maxwell testified. (Oct. 18, 2022 A.M. Trial Tr.
174:19–175:19; 179:1–13.)
Colonel Gary Corn, one of Zurich’s experts, testified that he looked at the “complaint
filed in this case, that claimed that computers were destroyed, but looking – if you can
wipe and re-image the physical hard drive, the physical hard drive is not damaged in
that sense.” (Oct. 21, 2022 Trial Tr. 191:10–14 (emphasis added).) He later conceded
that, based on testimony he heard from Bryon Maxwell, a MDLZ employee, he would
“take him at his word and testimony, there was not physical damage to those hard
drives. They had – they could be re- – reused. They could be re-imaged, wiped and re-
imaged and used again as a hard drive.” (Oct. 21, 2022 Trial Tr. 193:12–17.)
There has been no testimony or argument that MDLZ experienced any type of physical
force or violence in connection with the malware incursions. Accordingly, the Court should enter
a directed verdict in favor of MDLZ that Exclusion B.2(a) does not bar coverage and MDLZ is
entitled to coverage as a matter of law.
II. Zurich did not put forward any evidence that there was only one occurrence.
Zurich also bears the burden to demonstrate that MDLZ suffered only one, rather than two,
“occurrences” as defined in the insurance policy as “the sum total of all loss or damage of the type
insured, including any insured TIME ELEMENT loss, arising out of or caused by one discrete
event of physical loss or damage.” (Trial Ex. 001 at 74 of 83.) The burden to demonstrate that
MDLZ suffered only one occurrence, rather than two occurrences, is placed on Zurich because the
4
proposed construction would limit MDLZ’s recovery. Addison Ins. Co. v. Fay, 232 Ill. 2d 446,
455 (2009). Indeed, in its proposed jury instructions, Zurich conceded that it has the burden of
FILED DATE: 10/26/2022 2:34 PM 2018L011008
proof on this issue. (Sept. 22, 2022 Zurich’s Proposed Jury Instruction No. 12.)
Zurich has not put forward any evidence to meet that burden. Zurich did not introduce any
evidence that MDLZ suffered only one occurrence. Zurich did not call any technical experts or
computer scientists to testify.
By contrast, MDLZ introduced evidence at trial that it suffered two occurrences:
The Policy (Trial Ex. 1 at 74 of 83) defines “occurrence” as “the sum total of all loss or
damage of the type insured, including any insured TIME ELEMENT loss, arising out of or
caused by one discrete event of physical loss or damage.”
Dr. Jason Upchurch testified that he conducted a forensic investigation of the 05 and 06
servers that were collected from MDLZ’s Ukrainian subsidiaries. (Oct. 17, 2022 P.M. Tr.
167:10–168:15.) Dr. Upchurch determined that a backdoor was installed on the 05 server
on 6/22/17 at 6:25. A backdoor was installed on the 06 server at 6:12 on the same date.
(Id. 172:4–173:3.) Dr. Upchurch determined that the NotPetya malware was installed on
the 05 server, using the backdoor, at 10:29:04 on 6/27/17. The NotPetya malware was
installed on the 06 server, using the 06 server’s backdoor, at 10:14:04 on 6/27/17. (Id.
P.M. Tr. 174:5–21.)
Dr. Upchurch opined that based on the facts uncovered by his forensic investigation, server
05 and server 06 experienced separate and discrete events of physical damage, constituting
two occurrences under the policy. (Id. 182:10–184:5.)
Alexander Kornyukhov’s deposition testimony played in court further established that the
M.E.Doc update that ultimately led to the NotPetya infection was installed on two MDLZ
servers in Ukraine—one in Trostyanets and one in Petrivtsi. (Oct. 25, 2022 Trial Tr.
128:11–19.) Mr. Kornyukhov further testified that these servers are separate: “each of sites
in the Ukraine have their own VPN connection to the global backbone. So they are not
connected one to each other. They are connecting to the global backbone.” (Oct. 25, 2022
Trial Tr. 132:6–9.)
Sean Kanuck, one of Zurich’s experts, testified that it was his understanding that the
M.E.Doc software update was “actually downloaded by a vendor or a contractor and
manually installed onto two of the Mondelez computer servers or machines.” (Oct. 25,
2022 Trial Tr. 195:4–13 (emphasis added).) Mr. Kanuck further testified that on June 27,
2017, the “Mondelez servers . . . comunicat[ed] to the compromised MeDoc update server
asking, do you have anything for me?” (Id. 198:5–11.) Mr. Kanuck then testified that after
5
the machines have downloaded and been instructed to execute the malware, “that is how
the malicious payload, the destructive payload of NotPetya comes to arrive on the [MDLZ]
servers and begins to both propagate throughout the victim network and to perpetrate its
FILED DATE: 10/26/2022 2:34 PM 2018L011008
destructive activity.” (See id. 198:21–199:10.)
CONCLUSION
For the reasons stated herein, MDLZ respectfully requests that the Court enter an order
finding, after the close of Zurich’s evidence, that Zurich has failed to carry its burden to prove that
Exclusion B.2(a) applies or that MDLZ suffered only one, rather than two, occurrences; that the
Court grant MDLZ a directed verdict on the issue of Zurich’s liability; and that the Court grant
such other and further relief as the Court deems just and proper.
Dated: October 26, 2022 MONDELĒZ INTERNATIONAL, INC.
By: s/ John H. Mathias, Jr.
One of Its Attorneys
John H. Mathias, Jr.
Megan B. Poetzel
David M. Kroeger
Jan A. Larson (admitted pro hac vice)
JENNER & BLOCK LLP (05003)
353 N. Clark Street
Chicago, Illinois 60654
(312) 222-9350
JMathias@jenner.com
MPoetzel@jenner.com
DKroeger@jenner.com
JanLarson@jenner.com
6
CERTIFICATE OF SERVICE
I, David M. Kroeger, an attorney, hereby certify that on October 26, 2022, I caused to be
FILED DATE: 10/26/2022 2:34 PM 2018L011008
served MONDELĒZ INTERNATIONAL, INC.’S MOTION FOR DIRECTED VERDICT
AT THE CLOSE OF ZURICH’S CASE on the following parties via electronic mail.
Ronald S. Safer
Sondra A. Hemeryck
Lucas T. Rael
RILEY SAFER HOLMES & CANCILA LLP (Firm No. 60128)
70 West Madison Street, Three First National Bank Plaza, Suite 2900
Chicago, Illinois 60602
(312) 471-8700
rsafer@rshc-law.com
shemeryck@rshc-law.com
lrael@rshc-law.com
Philip C. Silverberg (admitted pro hac vice)
Jonathan R. Gross (admitted pro hac vice)
Hilary M. Henkind (admitted pro hac vice)
Bruce R. Kaliner (admitted pro hac vice)
Sanjit S. Shah (admitted pro hac vice)
MOUND COTTON WOLLAN & GREENGRASS LLP
One New York Plaza, 44th Floor
New York, New York 10004
(212) 804-4200
psilverberg@moundcotton.com
jgross@moundcotton.com
hhenkind@moundcotton.com
bkaliner@moundcotton.com
sshah@moundcotton.com
Counsel for Defendant Zurich American Insurance Company
/s/ David M. Kroeger
One of the Attorneys for Plaintiff
Preview
Hearing Date: No hearing scheduled Location: <> Judge: Calendar, N FILED 10/26/2022 2:34 PM IN THE CIRCUIT COURT OF COOK COUNTY, ILLINOIS IRIS Y. MARTINEZ CIRCUIT CLERK COUNTY DEPARTMENT, LAW DIVISION COOK COUNTY, IL FILED DATE: 10/26/2022 2:34 PM 2018L011008 2018L011008 MONDELĒZ INTERNATIONAL, INC., ) Calendar, N ) 20054366 Plaintiff, ) ) v. ) No. 2018 L 011008 ) Judge Mary Colleen Roberts ZURICH AMERICAN INSURANCE ) COMPANY, ) ) Defendant. ) MONDELĒZ INTERNATIONAL, INC.’S MOTION FOR DIRECTED VERDICT AT THE CLOSE OF ZURICH’S CASE Plaintiff Mondelēz International, Inc. (“MDLZ”) hereby moves for a directed verdict at the close of Defendant Zurich American Insurance Company’s (“Zurich”) case, pursuant to 735 ILCS 5/2-1202. STANDARD A directed verdict is appropriate “in those cases in which all of the evidence, when viewed in its aspect most favorable to the opponent, so overwhelmingly favors movant that no contrary verdict based on that evidence could ever stand.” Pedrick v. Peoria & E. R.R. Co., 37 Ill. 2d 494, 510 (1967). Here, Zurich has failed to present any evidence as to either of its defenses to coverage, compelling a ruling in favor of MDLZ on the issue of Zurich’s liability. ARGUMENT I. In light of the Court’s prior ruling that the meaning of ambiguous policy language is a question of fact for the jury after hearing extrinsic evidence to ascertain the parties’ intent, MDLZ is entitled to a directed verdict on the meaning of Exclusion B.2(a). In its March 31 Order, the Court found that Exclusion B.2(a) in the insurance policy issued by Zurich to MDLZ for the 2016-2017 policy period is ambiguous, and as such, its meaning should be determined by the jury after hearing extrinsic evidence to ascertain the parties’ intent as to that meaning. (See, e.g., Mar. 29, 2022 Hr’g Tr. at 197:12–23; Oct. 7, 2022 Hr’g Tr. 104:7–105:13.) FILED DATE: 10/26/2022 2:34 PM 2018L011008 As part of that determination, Illinois Supreme Court precedent requires as a matter of law that Exclusion B.2(a) be interpreted narrowly, against the insurer, and be applied only if its terms are clear, definite, and specific. If the policy language is susceptible to more than one reasonable meaning, it is considered ambiguous and will be construed against the insurer. Importantly, a policy provision that purports to exclude or limit coverage will be read narrowly and will be applied only where its terms are clear, definite, and specific. Gillen v. State Farm Mut. Auto. Ins. Co., 215 Ill. 2d 381, 393, 395–96 (2005) (emphasis added) (citations omitted); see also Lenkutis v. New York Life Ins. Co., 374 Ill. 136, 140 (1940) (“[A]mbiguous provisions or equivocal expressions whereby the insurer seeks to limit its liability will be construed most strongly against the insurer and liberally in favor of the insured.”); Outboard Marine Corp. v. Liberty Mut. Ins. Co., 154 Ill. 2d 90, 121–22 (1992). Moreover, Zurich bears the burden to demonstrate that Exclusion B.2(a) applies to MDLZ’s insurance claim. See Gillen, 215 Ill. 2d at 393. A. Zurich has not introduced any evidence to contradict MDLZ’s evidence of its reasonable interpretation as to the meaning of Exclusion B.2(a) that requires “tangible physical damage” and “the kind of physical force or violence commonly associated with conventional wars or physical, armed conflicts.” MDLZ has produced evidence at trial establishing that the terms “hostile or warlike action,” particularly when construed in the context of an insurance policy exclusion referencing attacks involving government or sovereign powers; military, naval or air forces; or agents thereof, refer only to loss or damage caused by or arising from physical violence, armaments, deadly force, or similar sources of kinetic effects commonly understood as attributes of conventional war or 2 related hostilities: Pete Flaherty, MDLZ’s risk manager, understood the war exclusion in the relevant FILED DATE: 10/26/2022 2:34 PM 2018L011008 insurance policy to involve the kind of physical force or violence commonly associated with conventional wars or physical armed conflicts. That is why he reached out to Ben Johnson at Zurich in 2014 with a question about the application of the war exclusion to insured properties in Ukraine after Russia’s annexation of Crimea and after the downing of a commercial airliner involving a missile. (Oct. 14, 2022 Trial Tr. 176:1–183:15) As it turned out, neither were sufficient to cause Mr. Johnson to tell Mr. Flaherty that Ukraine was a war zone in late July 2014. Instead, Mr. Johnson said it would be “pure conjecture.” (Id. at 184:19–23.) Hermes Marangos, a leading expert on war risks and related insurance policy exclusions, testified that in the insurance industry’s custom and practice, the words “hostile” and “warlike” refer to physical attacks in the field of battle in the context of war, and as result, it would be inconsistent with custom and practice to apply the terms “hostile” and “warlike” to cyber incidents like NotPetya. (Oct. 19, 2022 Trial Tr. 125:16-20.) Oona Hathaway, a leading scholar on International Law, testified about the conditions that a cyber operation must satisfy in order to qualify as a hostile or warlike action under International Law. Specifically, one of those conditions is that the cyber operation must cause significant tangible physical destruction or death, which simply did not occur for NotPetya. (Oct. 19, 2022 Trial Tr. at 28:7–30:01.) In other words, Exclusion B.2(a) applies only to an action that (1) is carried out by a government, military, or agent thereof; and (2) causes tangible physical damage and involves the kind of physical force or violence commonly associated with conventional wars or physical, armed conflicts. Zurich has not introduced evidence sufficient to show that MDLZ’s interpretation of Exclusion B.2(a) is not reasonable, and Illinois law requires that MDLZ’s interpretation be followed. See, e.g., Outboard Marine Corp., 154 Ill. 2d at 121 (citations omitted) (“In Illinois, ambiguities and doubts in insurance policies are resolved in favor of the insured, especially those that appear in exclusionary clauses.”). Zurich has produced no evidence that malware incursions on June 27, 2017 “caus[ed] tangible physical damage and involve[d] the kind of physical force or violence commonly 3 associated with conventional wars or physical, armed conflicts,” which is the interpretation that MDLZ contends should apply as a matter of law. (MDLZ Pretrial Motion No. 3 at 1.) To the FILED DATE: 10/26/2022 2:34 PM 2018L011008 contrary, the evidence shows that there was no physical violence or tangible destruction associated with the malware incursions: Dr. Upchurch explained that NotPetya encrypted MDLZ’s computers and servers. (Oct. 17, 2022 P.M. Trial Tr. 180:7–16.) The computers and servers themselves were not physically destroyed or altered. For the most part, MDLZ wiped the data on its servers and laptops and they were “reinstalled from scratch,” as Bryon Maxwell testified. (Oct. 18, 2022 A.M. Trial Tr. 174:19–175:19; 179:1–13.) Colonel Gary Corn, one of Zurich’s experts, testified that he looked at the “complaint filed in this case, that claimed that computers were destroyed, but looking – if you can wipe and re-image the physical hard drive, the physical hard drive is not damaged in that sense.” (Oct. 21, 2022 Trial Tr. 191:10–14 (emphasis added).) He later conceded that, based on testimony he heard from Bryon Maxwell, a MDLZ employee, he would “take him at his word and testimony, there was not physical damage to those hard drives. They had – they could be re- – reused. They could be re-imaged, wiped and re- imaged and used again as a hard drive.” (Oct. 21, 2022 Trial Tr. 193:12–17.) There has been no testimony or argument that MDLZ experienced any type of physical force or violence in connection with the malware incursions. Accordingly, the Court should enter a directed verdict in favor of MDLZ that Exclusion B.2(a) does not bar coverage and MDLZ is entitled to coverage as a matter of law. II. Zurich did not put forward any evidence that there was only one occurrence. Zurich also bears the burden to demonstrate that MDLZ suffered only one, rather than two, “occurrences” as defined in the insurance policy as “the sum total of all loss or damage of the type insured, including any insured TIME ELEMENT loss, arising out of or caused by one discrete event of physical loss or damage.” (Trial Ex. 001 at 74 of 83.) The burden to demonstrate that MDLZ suffered only one occurrence, rather than two occurrences, is placed on Zurich because the 4 proposed construction would limit MDLZ’s recovery. Addison Ins. Co. v. Fay, 232 Ill. 2d 446, 455 (2009). Indeed, in its proposed jury instructions, Zurich conceded that it has the burden of FILED DATE: 10/26/2022 2:34 PM 2018L011008 proof on this issue. (Sept. 22, 2022 Zurich’s Proposed Jury Instruction No. 12.) Zurich has not put forward any evidence to meet that burden. Zurich did not introduce any evidence that MDLZ suffered only one occurrence. Zurich did not call any technical experts or computer scientists to testify. By contrast, MDLZ introduced evidence at trial that it suffered two occurrences: The Policy (Trial Ex. 1 at 74 of 83) defines “occurrence” as “the sum total of all loss or damage of the type insured, including any insured TIME ELEMENT loss, arising out of or caused by one discrete event of physical loss or damage.” Dr. Jason Upchurch testified that he conducted a forensic investigation of the 05 and 06 servers that were collected from MDLZ’s Ukrainian subsidiaries. (Oct. 17, 2022 P.M. Tr. 167:10–168:15.) Dr. Upchurch determined that a backdoor was installed on the 05 server on 6/22/17 at 6:25. A backdoor was installed on the 06 server at 6:12 on the same date. (Id. 172:4–173:3.) Dr. Upchurch determined that the NotPetya malware was installed on the 05 server, using the backdoor, at 10:29:04 on 6/27/17. The NotPetya malware was installed on the 06 server, using the 06 server’s backdoor, at 10:14:04 on 6/27/17. (Id. P.M. Tr. 174:5–21.) Dr. Upchurch opined that based on the facts uncovered by his forensic investigation, server 05 and server 06 experienced separate and discrete events of physical damage, constituting two occurrences under the policy. (Id. 182:10–184:5.) Alexander Kornyukhov’s deposition testimony played in court further established that the M.E.Doc update that ultimately led to the NotPetya infection was installed on two MDLZ servers in Ukraine—one in Trostyanets and one in Petrivtsi. (Oct. 25, 2022 Trial Tr. 128:11–19.) Mr. Kornyukhov further testified that these servers are separate: “each of sites in the Ukraine have their own VPN connection to the global backbone. So they are not connected one to each other. They are connecting to the global backbone.” (Oct. 25, 2022 Trial Tr. 132:6–9.) Sean Kanuck, one of Zurich’s experts, testified that it was his understanding that the M.E.Doc software update was “actually downloaded by a vendor or a contractor and manually installed onto two of the Mondelez computer servers or machines.” (Oct. 25, 2022 Trial Tr. 195:4–13 (emphasis added).) Mr. Kanuck further testified that on June 27, 2017, the “Mondelez servers . . . comunicat[ed] to the compromised MeDoc update server asking, do you have anything for me?” (Id. 198:5–11.) Mr. Kanuck then testified that after 5 the machines have downloaded and been instructed to execute the malware, “that is how the malicious payload, the destructive payload of NotPetya comes to arrive on the [MDLZ] servers and begins to both propagate throughout the victim network and to perpetrate its FILED DATE: 10/26/2022 2:34 PM 2018L011008 destructive activity.” (See id. 198:21–199:10.) CONCLUSION For the reasons stated herein, MDLZ respectfully requests that the Court enter an order finding, after the close of Zurich’s evidence, that Zurich has failed to carry its burden to prove that Exclusion B.2(a) applies or that MDLZ suffered only one, rather than two, occurrences; that the Court grant MDLZ a directed verdict on the issue of Zurich’s liability; and that the Court grant such other and further relief as the Court deems just and proper. Dated: October 26, 2022 MONDELĒZ INTERNATIONAL, INC. By: s/ John H. Mathias, Jr. One of Its Attorneys John H. Mathias, Jr. Megan B. Poetzel David M. Kroeger Jan A. Larson (admitted pro hac vice) JENNER & BLOCK LLP (05003) 353 N. Clark Street Chicago, Illinois 60654 (312) 222-9350 JMathias@jenner.com MPoetzel@jenner.com DKroeger@jenner.com JanLarson@jenner.com 6 CERTIFICATE OF SERVICE I, David M. Kroeger, an attorney, hereby certify that on October 26, 2022, I caused to be FILED DATE: 10/26/2022 2:34 PM 2018L011008 served MONDELĒZ INTERNATIONAL, INC.’S MOTION FOR DIRECTED VERDICT AT THE CLOSE OF ZURICH’S CASE on the following parties via electronic mail. Ronald S. Safer Sondra A. Hemeryck Lucas T. Rael RILEY SAFER HOLMES & CANCILA LLP (Firm No. 60128) 70 West Madison Street, Three First National Bank Plaza, Suite 2900 Chicago, Illinois 60602 (312) 471-8700 rsafer@rshc-law.com shemeryck@rshc-law.com lrael@rshc-law.com Philip C. Silverberg (admitted pro hac vice) Jonathan R. Gross (admitted pro hac vice) Hilary M. Henkind (admitted pro hac vice) Bruce R. Kaliner (admitted pro hac vice) Sanjit S. Shah (admitted pro hac vice) MOUND COTTON WOLLAN & GREENGRASS LLP One New York Plaza, 44th Floor New York, New York 10004 (212) 804-4200 psilverberg@moundcotton.com jgross@moundcotton.com hhenkind@moundcotton.com bkaliner@moundcotton.com sshah@moundcotton.com Counsel for Defendant Zurich American Insurance Company /s/ David M. Kroeger One of the Attorneys for Plaintiff