Typically, comprehensive cyber insurance policies, rather than commercial crime policies, respond to claims of data breach and other cybercrimes. With the rise in hacking and ransomware attacks worldwide, businesses that may have chosen not to purchase cyber insurance may find themselves without coverage in the event of a cyberattack.
A recent decision by the Indiana Supreme court rejected a policyholder’s attempt to force a cyber claim into coverage under a commercial crime policy as a matter of law. In G&G Oil Co. of Ind. v. Cont’l W. Ins. Co.,[1] G&G Oil (“G&G”) was subjected to a ransomware attack that left its computer servers and drives encrypted and inaccessible. In order to obtain a decryption passcode that would allow G&G to regain access to its servers, G&G paid an approximate $35,000 ransom to the hacker in Bitcoin. Following the incident, G&G filed a claim with its insurer, Continental Western Insurance Company (“Continental”), seeking to recover the ransom it had paid.
Although G&G had specifically declined to purchase computer hacking and computer virus coverage, it sought coverage under the “computer fraud” section of its commercial crime policy. That clause provided:
Computer Fraud
We will pay for loss or damage to “money”, “securities” and “other property” resulting directly from the use of any computer to fraudulently cause a transfer of that property from inside the “premises” or “banking premises”:
Continental denied the claim because G&G had declined to purchase the computer hacking coverage. More importantly, however, Continental also argued that the ransom payment did not fall within the computer fraud c ..
Support the originator by clicking the read the rest link below.
