Haynes and Boone, LLP Partner Peter Halprin and Associate Rebecca Schwarz authored an article for Law360 Expert Analysis discussing recent cyberinsurance decisions and the implications for policyholders.
Read an excerpt below:
Concerns about cyber risk continue to be atop lists of what keeps general counsel, risk management professionals and C-suite executives up at night.
And these concerns are well-founded. Three major incidents have occurred this year: the Change Healthcare cyberattack in February, primarily affecting healthcare; the CDK Global cyberattack in June, primarily affecting car dealerships; and the Crowdstrike outage in July, affecting a broad range of businesses including airlines, airports, public transit, healthcare and financial services.
What these incidents share in common is that the business interruptions that companies face can be due to their connections with other businesses that are directly affected — even if they themselves were not an intended target. To address these contingent liabilities, the recent incidents have also raised the profile of contingent business interruption coverage, coverage for the very types of losses that many businesses have suffered as a result of these attacks.
While a variety of cyberinsurance products have come to market, and continue to evolve, to reduce the financial impact of such risks, there had been very little litigation interpreting cyberinsurance coverage.
Given this, recent cyberinsurance decisions therefore provide some much-needed context and nuance to our understanding of cyberinsurance, and the manner in which it protects business income losses.
Clarity on Coverage Grants, Causation, and the Period of Restoration
In three seminal decisions — Southwest Airlines v. Liberty Insurance Underwriters Inc., decided by the U.S. Court of Appeals for the Fifth Circuit in January, New England Systems Inc. v. Citizens Insurance Company of America, decided in the U.S. District Court for the District of Connecticut in December 2022; and Fishbowl Solutions Inc. v. Hanover Insurance Co., decided in the U.S. District Court in the District of Minnesota in November 2022 — courts have interpreted key coverage phrases to explain how coverage grants and causation work in the cyberinsurance context.
Likewise, in Arizona Beverages USA LLC v. Hanover Insurance Co., decided in the U.S. District Court for the Eastern District of New York in July 2023, and Heritage Co. Inc. v. Hudson Excess Insurance Co., decided by the U.S. District Court for the Eastern District of Arkansas this May, courts interpreted the "period of restoration" in the cyberinsurance context.[5] Each case will be discussed in turn.
To read the full article in Law360, click here.
