U.S. Court Rules on Cyber Insurance Policy Clarity

In a significant development for the cyber insurance sector, the U.S. District Court for the Northern District of Texas ruled in favor of the policyholder, emphasizing the necessity for insurers to draft clear and specific policy language. In the case of CiCi Enterprises, LP v. HSB Specialty Insurance Company, the court addressed a dispute over a Ransomware Event Sublimit Endorsement. It concluded that due to ambiguous drafting by HSB, the policyholder was not restricted to a $250,000 recovery limit.

The cyber incident, which occurred in May 2022, involved the encryption of CiCi's systems by a threat actor demanding a ransom. CiCi promptly notified HSB and undertook appropriate measures, incurring costs close to $1.2 million. This included a $400,000 ransom payment. Despite the policy featuring a $3 million aggregate limit and triggering several insuring agreements, HSB attempted to enforce a $250,000 sublimit, citing the Ransomware Event Sublimit Endorsement.

Upon reviewing the motions for summary judgment, the court found that the endorsement lacked clarity regarding which insuring agreements it intended to amend. Unlike other clearly drafted endorsements, this sublimit lacked explicit language to affect Section I agreements, such as Cyber Extortion. Instead, it was classified under Section II, indicating a restriction on overall liability rather than specific coverage terms. This interpretation was corroborated by HSB's endorsements, which typically specified coverage modifications, an element missing here.

HSB further argued that a "Ransomware Event" was a subset of an "Extortion Threat," which would narrow the coverage scope. However, the policy's structure delineated "Ransomware Event" as distinct from categories like Information Privacy and Network Security, undermining HSB’s position. The court concluded that if HSB intended the sublimit's application to be universal, clearer language would have been essential.

As a result of this decision, CiCi's bad faith claims against HSB survived the summary judgment phase, allowing these claims to proceed to trial. The case highlights the critical importance of precise language in policy documentation.

Both insurers and policyholders are urged to clearly define endorsements and coverage limits at the outset of the policy. Insurers should seek to remove ambiguities to prevent litigation, while policyholders should consult with brokers to fully understand policy terms during renewals. This outcome serves as a reminder that the enforcement of sublimits depends on the original policy terms rather than any retrospective intentions.