A Texas federal district court, applying Texas law, has held that a cyber insurer did not need to cover losses incurred by its insured resulting from a system failure incident, finding that those losses were consequential and indirect, and therefore outside the scope of coverage. Southwest Airlines Co. v. Liberty Ins. Underwriters Inc., No. 3:19-CV-2218-C (N.D. Tex. Sept. 6, 2022).

In 2016, an insured airline experienced a computer system failure that reportedly led to thousands of cancelled flights and resulted in other impacts to its business. The airline later submitted its purported losses – totaling over $77 million – under its cyber insurance tower. While the airline recovered some of its losses, one excess insurer declined coverage on the grounds that many of the claimed losses were not directly attributable to the system failure and were therefore not covered. As a result, the insurer asserted that any covered loss fell below its attachment point.

In the ensuing coverage action, the court agreed with the insurer, holding that over $30 million of the claimed losses fell outside the scope of coverage or were expressly excluded as consequential losses, liabilities to third parties, or losses due to unfavorable business conditions. The court explained that the airline acknowledged that these losses were “not solely and directly” caused by the system failure, but were instead incurred to fund “purely discretionary” rewards programs and marketing promotions. Moreover, the court found that, “even if incurred on sound business judgment” and necessitated by a desire to “protect against potential future losses,” the losses at issue were the result of “various business decisions” and not incurred solely as a result of the system failure, which was required to implicate coverage.

[View source.]