Zurich Has to Prove Russia Did It
As the carrier, Zurich has the burden to prove that the exclusion applies. In other words, Zurich has to prove that NotPetya was a hostile or warlike act by a government or sovereign power - specifically Russia. Attribution for cyber attacks has improved recently, but Russia has denied any allegation that it instigated NotPetya.
Does Zurich plan to subpoena evidence from the FBI or the Department of Homeland Security to prove Russia was the perpetrator - - evidence that is probably confidential and requires some sort of secret clearance (I think not).
Better yet, can a judge or jury in Illinois, in an insurance case, determine that Russia was the perpetrator of a cyber attack and thus trigger an exclusion in an insurance policy (doubtful)?