With a new year lands a new court decision to consider as companies grapple with losses resulting from a computer system failure under a cyber insurance policy. This decision is important for corporate policyholders because it refuses to take a narrow view of which first-party business income losses are covered under a cyber insurance policy.

The matter started when Southwest Airlines suffered a computer failure that caused approximately 475,839 Southwest customers to experience flight cancelations or delays of two hours or more. As a result, Southwest incurred more than $77 million in losses, including those from 1) discount codes, 2) travel vouchers, 3) cover refunds (to compensate customers for alternate travel arrangements), 4) Rapid Rewards Points (redeemable for airline tickets for members of its frequent flyer program), and 5) advertising costs (incurred to extend a sale that Southwest was conducting at the time of the system failure). Southwest sought reimbursement from its cyber risk insurance that included a series of follow form excess policies. Southwest recovered $50 million from its primary insurer and the first three layers of its excess insurance.

But then Liberty Insurance Underwriters Inc. denied coverage on the five loss categories and the claim for reimbursement under its cyber risk insurance policy. After Southwest filed suit for breach of contract, bad faith, and declaratory judgment, the U.S. District Court for the Northern District of Texas granted summary judgment for Liberty.⁽¹⁾ The district court concluded the sought costs were either not covered or excluded under the policy. On Jan. 16, 2024, the U.S. Court of Appeals for the Fifth Circuit reopened the runway for Southwest’s claim and reversed the district court’s decision.⁽²⁾

Liberty argued that the five categories of Southwest’s claimed losses were not covered or were subject to various exclusions and, on that basis, denied Southwest’s claim.

The policy’s System Failure Coverage provision covers “all Loss . . . that an Insured incurs. . . solely as a result of a System Failure . . . .” (emphasis added) Liberty argued that all five categories of costs that Southwest claimed were not incurred solely as a result of the system failure but rather as a result of Southwest’s subsequent business decisions. Southwest acknowledged that such costs were the result of business decisions but argued that, under the plain terms of the policy, they are covered.

Reversing the district court, the Fifth Circuit applied Texas law and agreed with Southwest.

Defining Loss Under the Policy

In coming to its conclusion, the court focused on the meaning of three key terms. First, the court concluded that the five categories of costs are “losses” under the policy’s “lenient but-for causation standard” (i.e., “costs that would not have been incurred but for a Material Interruption”). Second, the court also cited the dictionary definition of “incur” as “to bring down upon oneself” and concluded that the five categories of costs were “losses” that Southwest “incurred” because they were ones that Southwest brought upon itself. Third, the court disagreed with Liberty’s argument that “the system failure cannot be the sole cause of Southwest’s claimed costs because the ‘independent’ and ‘more direct’ cause of those losses was Southwest’s decision to incur them.” (emphasis added) (i.e., that the costs were purely discretionary and therefore not covered).

The court disagreed because Southwest’s decisions could only be independent sole causes of the costs if they wereprecipitating causes of the costs. However, here “[t]he decisions . . . were not precipitating causes . . . but links in a causal chain that led back to the system failure.” The court concluded that the district court should not have granted summary judgment as a matter of law.

The court also addressed two policy exclusions that Liberty argued barred coverage. The first – (Exclusion SF(b)) – provides that Liberty is not liable for “any Loss . . . alleging, arising out of, based upon or attributable to . . . consequential damages.” (emphasis added) The court agreed with Southwest’s interpretation of “consequential damages” that refers to the type of harms that flow “naturally, but not necessarily, from the defendant’s breach and are not the usual result of the wrong.” See James Constr. Grp., L.L.C. v. Westlake Chem. Corp., 650 S.W.3d 392, 417 n.25 (Tex. 2022).

The court rejected Liberty’s narrow definition of the term “consequential damages” (i.e., costs that “do not flow directly and immediately from the act”). The court reasoned that Liberty’s interpretation was “so narrow” that it “would render much of the coverage under the policy completely illusory.” The court therefore held that the district court erred in determining the costs at issue are consequential damages excluded from coverage.

The court then addressed the second exclusion at issue. Exclusion 3(i)(1) provides that Liberty will not pay for “any Loss . . . arising out of, based upon or attributable to . . . any liability to third-parties for whatever reason . . . .” (emphasis added) Liberty argued that the dictionary definition of “third party” as “a person other than the principals” should apply. In turn, Liberty argued that “third-parties” included Southwest’s customers and therefore the costs at issue attributable to Southwest’s customers were precluded under the exclusion. The court rejected Liberty’s broad definition of “third party” and instead interpreted “the policy in a way that ‘harmonizes’ its provisions,” Gilbert Tex. Constr., L.P. v. Underwriters at Lloyd’s London, 327 S.W.3d 118, 126 (Tex. 2010). The court concluded the district court erred in granting summary judgment on the basis of this exclusion as well.

Takeaways

As we take off into 2024 and onward, the Fifth Circuit’s decision is a reminder that when seeking coverage under cyber insurance policies for system failures and other business interruption claims, a best practice when insurers deploy narrow policy interpretations is to review the status of the law. Sometimes, insurers force policyholders to go to court to get the coverage that policyholders thought that they bought in the first place.