With the increasing incidents of cyberattacks on Canadian businesses, companies are spending more money to protect themselves against data breaches. In turn, insurers may face greater indemnity claims from their insured thus increasing the risk of exposure. However, as the Ontario Court of Appeal recently held in Panasonic v. XL Specialty Insurance Co., the insured can be required to fund more than the base policy retention amount. In this case, the Court held that a policy Endorsement covering a ransomware attack made the insured, Panasonic, liable to cover up to $3 million of its costs, instead of the lower retention of $1.5 million identified in the base policy.
In February 2022, Panasonic Canada was hit with a data breach. A Panasonic employee downloaded malware, which infected a virus into Panasonic’s system network. The attackers stole confidential data, which they encrypted. They demanded payment for release of the stolen data back to the company. Panasonic followed its company policy and did not pay the ransom. Instead, it spent millions on damage control. This included investigating the scope of the breach, cleaning and restoring its servers and rebuilding its network.
Panasonic’s base policy included a $1.5 million retention, the maximum it was obligated to pay before it could seek indemnity of its expenses from its insurer, XL Specialty. An Endorsement to the policy that specifically covered cyber-extortion reimbursement and ransomware attacks amended the retention to $3 million. Panasonic did not seek coverage under the Endorsement. XL denied Panasonic’s claim over $1.5 million. Panasonic brought an application in Superior Court for a declaration that only the $1.5 million retention in the base policy applied.
Justice Leiper in the lower court decision granted the application. She determined that the definitions in the base policy applied to Panasonic, specifically a “cyber security breach, cyber extortion threat or data breach” that was covered under the headings “Business Interruption and Extra Expenses” and “Data Recovery”. Further, she found that the third-party liability coverage, for data breach response and crisis management costs, resulted from a “cyber security breach,” as defined in the base policy. She found no language in the policy or Endorsement obligating Panasonic to seek indemnity under the Endorsement. Therefore, she held that the $1.5 million retention applied.
On appeal, the Ontario Court of Appeal held that the lower court’s decision was incorrect at law. Following the Supreme Court of Canada’s 2016 principles in Ledcor Construction Ltd. v. Northbridge Indemnity Insurance Co., the Court of Appeal held that whether the lower court was correct at law was the proper standard of review. This was because the policy and Endorsement were widely used standard form contracts, and that cybersecurity breaches and retentions were not unique to the parties. Consequently, it concluded that the Court did not need to engage in a factual examination of the case.
Upon review, the Court of Appeal found that the lower court erred at law by failing to consider the full terms of several clauses in the Endorsement and their relation to the policy as a whole. It further found that the cyber extortion incident was captured squarely by the Endorsement clause “Ransomware Event Loss”, and thus Panasonic’s claim was subject to the amended terms in the Endorsement. Therefore, the $3 million retention applied to Panasonic, and it was of no consequence that Panasonic made its claim only under the base policy.
The Court of Appeal’s decision establishes an important precedent for future claims involving cyber attacks and data breaches. It finds that the factual circumstances of the parties in these types of cases typically are not relevant to interpreting and applying the terms of the policy. It also gives legal certainty for insurers that endorsements amending insurance policies will operate to define the full limits of available coverage.
Jonathan White is the author of this blog and a member of the Coverage Team practice group. If you have a question about this decision or a similar issue, please contact Jonathan at 416-777-5204.
