Court blocks HSB’s ransomware sub-limit in first-of-its-kind cyber ruling

The case began with a ransomware attack on May 21, 2022, in which a threat actor encrypted CiCi’s computer systems and threatened to publish exfiltrated data unless a ransom was paid. CiCi held a cyber insurance policy issued by HSB with a $3,000,000 aggregate limit, subject to a $50,000 retention. Following the attack, CiCi notified At-Bay Insurance Services – HSB’s agent for receiving notice of claims – and, with At-Bay’s approval, retained a law firm and incident response firm, Arete Advisors, to conduct a breach investigation, manage the response, and negotiate with the threat actor. The original ransom demand of $2,000,000 was negotiated down to $400,000. CiCi ultimately alleged total losses exceeding $1,200,000 as a result of the cyber event.