Cyber, crime and D&O insurance case studies

Case studies show how the wording of an insurance contract, its exclusions and its sub-limits (alamlimiidid) operate in a real loss. International practice is relevant to Estonian business for two reasons. First, the cyber, crime and D&O policies sold in Estonia often use the same English-language standard wordings and Lloyd's market clauses. Second, Estonian case law in these lines of insurance is still scarce, and international decisions show which questions arise once a claim is disputed.¹

How to read the cases

• A foreign decision is not Estonian law. The conclusion of a US, Canadian, UK or Indian court rests on that country's contract law and on the wording of the particular policy. An Estonian court interprets an insurance contract under the Law of Obligations Act (võlaõigusseadus, VÕS) and the case law of the Supreme Court (Riigikohus), including the rule on the interpretation of standard terms (VÕS § 39) and the proportionate consequences of a breach of an obligation by the policyholder (VÕS § 452 lg 2).²
• The sources are secondary. Unless stated otherwise, the descriptions of foreign cases are based on public sources (law firm commentary, trade press, claims examples published by insurers) rather than on the full text of the judgments. Each case carries a reference to its source.
• Insurers' claims examples are generalised. In the examples published by insurers the policyholder is anonymous and the facts are simplified. They show how cover typically operates, not how every similar claim ends.
• Baltic incidents. For incidents in the Baltic states we set out only publicly known, neutral facts. We do not know, and do not speculate, whether the organisation named had an insurance contract, and we do not assess anyone's conduct.

Parts of the collection

1. Cyber insurance cases: NotPetya and the war exclusion (Merck, Mondelēz), general liability insurance and a data breach (Sony), supply chain incidents (Clorox, Netgain), card brand assessments (P.F. Chang's), pre-contractual information (Cottage Health), ransomware under property and crime policies, and claims examples published by insurers.
2. Crime insurance court cases: direct loss (Cargill), computer fraud and social engineering (Medidata, Apache, American Tooling Center, Principle Solutions), sub-limits (Future Electronics), voluntary parting, client property (First Defiance) and employee intent (Marac).
3. Crime insurance schemes and claims examples: insurers' published examples of employee fraud and fraudulent payment instructions, and the fraud schemes common in Estonia.
4. D&O insurance cases: data breaches and investors (Equifax, Yahoo), the duty of oversight (Boeing), large investor claims and the adequacy of limits (Volkswagen, Wirecard, Petrobras, Fortis), climate litigation and insurers' claims examples.
5. Public incidents in the Baltic states: cyberattacks and management liability cases in Estonia, Latvia and Lithuania set out as neutral facts, together with the insurance law questions that a similar event raises.

Three recurring lessons

1. The wording decides. Cases with almost identical facts have ended with opposite outcomes, depending on whether the policy contained the word "directly", a separate social engineering clause or a broad war exclusion.
2. A sub-limit may be the real limit. Alongside a main limit of several million, a sub-limit of a few tens of thousands may turn out to be the amount that applies when the loss is assessed.
3. The limit runs out. Large D&O losses have repeatedly shown that even a multi-layered limit structure does not cover the entire loss. Separate personal protection for the directors and officers is therefore important.

Related pages

• Typical coverage disputes in cyber, crime and D&O insurance
• Cyber, crime and D&O insurance: interplay and boundaries
• Supreme Court of Estonia: insurance law case law
• Insurance litigation and arbitration in Estonia

References