Typical coverage disputes in cyber, crime and D&O insurance

In short. Disputes in cyber, crime and D&O insurance revolve around concepts whose content depends on the policy wording: direct and indirect loss, fraud, duty of care and intent. Pre-contractual information is also frequently disputed. Under Estonian law the policyholder has several strong arguments (the control of standard terms, the proportionate consequence of a breach of a duty of care, the insurer's burden of proof), but they do not replace missing cover.¹

For claims handlers, each section below indicates the line of argument that an Estonian policyholder and its counsel can be expected to take, and the statutory limits within which a coverage position has to be built.

1. Distinguishing direct and indirect loss

Many policies, especially in crime insurance, cover only direct pecuniary loss (direct loss). Direct loss is as a rule the immediate pecuniary loss: money taken, property destroyed, direct restoration costs. Indirect loss covers the wider economic impact: lost profit, reputational harm, contractual penalties, lost business opportunities.

The problem arises when the loss cannot be placed clearly in one category. In a fraud, the direct loss is the amount transferred out of the account, but it is accompanied by investigation costs, systems checks, the breakdown of customer relationships and the termination of contracts. The insurer may argue that only the initial monetary loss is covered.

International practice is inconsistent. In 2023 the US Court of Appeals for the Eighth Circuit held in Cargill that additional freight costs of USD 29 million also resulted "directly" from an employee's fraud, because the employee's false data caused the shipments directly. In other cases the requirement of "direct" loss has been interpreted narrowly, so that the loss must result directly from the use of a computer and not from an employee's decision (see the case collection).

From the perspective of Estonian law, "direct loss" is a contractual concept whose content must be interpreted. A standard term is interpreted as a reasonable person similar to the other party would understand it and, in case of doubt, against the user of the term (Law of Obligations Act (võlaõigusseadus, VÕS) § 39); the Supreme Court has stressed that a term is not interpreted according to the definitions of specialists but according to the understanding of a reasonable policyholder.² The general rule of indemnity insurance is that lost profit is compensated only if this has been separately agreed (VÕS § 476 lg 4).³

2. The definition of fraud

Fraud is the central concept of crime insurance, but not every policy covers every scheme. Traditionally, fraud is associated with intentional deception for the purpose of obtaining a pecuniary advantage; today's schemes are more complex.

A payment made by an employee on a fraudster's instructions. In social engineering and fraudulent payment instruction schemes, the insurer may argue that there was no classic fraud because the company itself gave the payment order and there was no direct taking of property. Many policies contain a so-called voluntary parting exclusion, which excludes the loss where the policyholder handed over the money voluntarily, even when it did so under the influence of deception. The social engineering extension was created precisely to fill this hole, but it often comes with a low sub-limit.

Employee dishonesty. In employee dishonesty cover, intentional embezzlement must be distinguished from negligence, and dishonesty must be distinguished from any additional intent requirement in the policy. In the New Zealand case of Vero v Heartland Bank (formerly Marac Finance), an employee had granted loans in breach of the internal rules and concealed problem loans; the policy required, in addition to dishonesty, a clear intention to cause the employer a loss. The Court of Appeal was not persuaded that this intention had been proven, because the employee's conduct was aimed at recovering the debts, and the Supreme Court refused leave to appeal, treating the difference between the lower courts as a question of fact. The case turns on that specific policy wording and is not a general definition of dishonesty; see crime insurance court cases. Crime insurance is not insurance against credit risk or bad business decisions.

Ransomware. In 2021 the Indiana Supreme Court held in G&G Oil that a loss from ransomware may result directly from the use of a computer, because a ransom paid under duress did not break the chain of causation; whether the systems had been obtained "fraudulently" remained a question of fact.

Criminal law does not determine cover. Fraud and computer-related fraud are criminal offences (Penal Code (karistusseadustik, KarS) § 209, § 213), but the insured event is determined by the insurance contract. As a rule, the outcome of criminal proceedings need not be awaited under the insurance contract unless the contract makes it a precondition.⁴

3. Breach of the duty of care

The third central point of dispute is the duty of care, in two senses.

The policyholder's duty of care under the insurance contract. Policies contain safety requirements: multi-factor authentication, backups, double control of payments, a verification call to the supplier. If it turns out after a loss that a requirement was not complied with, the insurer may refuse to indemnify or may reduce the indemnity. Under Estonian law:

• it must first be established whether the term delimits the insured event (an exclusion) or is an obligation relating to the policyholder's conduct; the criterion is whether the term depends on the policyholder's conduct;⁵
• where an obligation is breached, the insurer is released from its performance obligation only within the limits of VÕS § 452 lg 2 and to the extent that the breach affected the occurrence of the insured event or the extent of the loss; a term providing for release irrespective of such effect is void to that extent;⁶
• the breach and its effect must be proved by the insurer; the policyholder has a duty to cooperate.⁶

The board's duty of care towards the company. In a D&O dispute, the question is whether the board should have foreseen the risk and responded to it. A board member must prove that he or she performed the duties with the diligence of a prudent businessperson (Commercial Code (äriseadustik, ÄS) § 187).⁷ Within the scope of the Cybersecurity Act (küberturvalisuse seadus, KüTS), the role of the board is laid down separately by law (KüTS § 6¹).⁸ The same question carries over into insurance: the insurer may argue that there was a conscious and unjustified risk that comes close to intent.

4. Intent as a narrow exclusion, not a general principle

In coverage disputes the concept of intent is often used more broadly than is justified: any conscious or risky conduct is presented as intentional in order to exclude cover. This is not consistent with the logic of insurance law.

• Intent must be assessed under the applicable statutory provision and policy wording. It presupposes that the consequence named in the provision or term was the aim of the person's conduct or at least a consciously accepted consequence of it (indirect intent); a merely deliberate act is insufficient.
• Intent as to the act must be distinguished from intent as to the event to which the provision or term refers. Under VÕS § 452 lg 1, intent must extend to the occurrence of the insured event.
• In liability insurance, the insurer is released from its obligation to perform if the policyholder intentionally and unlawfully caused the event giving rise to its liability towards the injured party (VÕS § 513); indirect intent may suffice, and the policy may additionally require intent to cause loss for the exclusion to apply.⁹ The Supreme Court has treated the absence of cover for intentional acts as a general principle of insurance; in a case on the compulsory liability insurance of a bankruptcy trustee, the insurer could on that basis rely on the term applicable in that case, which excluded the trustee's own intentional breach of official duties, because the Bankruptcy Act (pankrotiseadus, PankrS) § 64 lg 2 permits such an exclusion.¹⁰ In crime insurance, however, it must be established separately under the policy whose intentional conduct is the insured risk.
• In the case of gross negligence, release is possible only by agreement and within the limits of the law.¹¹

In D&O policies, the intent and fraud exclusion is usually tied to a final adjudication: defence costs are advanced and must be repaid if intent is established by a judgment that has entered into force. A severability clause ensures that one director's intent is not imputed to the others.

Under Estonian law, the line between intent and gross negligence leaves considerable room for interpretation, and the dispute often focuses on the classification of the specific conduct.

5. Pre-contractual information

In cyber insurance, a growing point of dispute is the information given in the proposal form about security measures. In the US Cottage Health case, the insurer sought to set the contract aside retroactively, arguing that the security measures described in the proposal had not been in operation; the dispute ended in a settlement.

Under Estonian law, the legal consequences of such a situation can be distinguished:

• on concluding the contract, the policyholder must disclose the circumstances known to it that are material for assessing the risk (VÕS § 440);
• if this duty is breached, the insurer may withdraw from the contract (taganemine, VÕS § 441, § 442), but only within one month of the time when it learned or should have learned of the breach, and not after three years have passed from the conclusion of the contract (VÕS § 442 lg 1); withdrawal releases the insurer from its performance obligation, but if it withdraws after an insured event and the undisclosed circumstance had no effect on the occurrence of the insured event and does not exclude or limit its obligation to perform, the insurer must nevertheless perform, taking into account the ratio of the premiums paid to those that would have been payable had the circumstance been disclosed (VÕS § 442 lg 2);¹²
• in the case of fraud, the insurer may avoid the contract (tühistamine, General Part of the Civil Code Act (tsiviilseadustiku üldosa seadus, TsÜS) § 94), with the consequence that the contract is void from the outset.¹³

The English term rescission is therefore not automatically either withdrawal or avoidance: it must be established which ground the insurer relies on and what its consequence is under Estonian law (see nullity, avoidance and termination in the Supreme Court's case law).

6. Causation and multiple causes

A loss often results from several causes acting together: malware plus an employee's mistake plus deficient backups; fraud plus delay by the bank. A dispute arises when one cause is covered and the other is excluded.

• Contractual causation clauses. International policies use wording such as "resulting directly from", "arising out of" or "in any way connected with". The broader the causal wording of an exclusion, the more loss it excludes.
• Under Estonian law, the insured event and the exclusion are interpreted on the basis of the parties' intention and, for standard terms, the understanding of a reasonable policyholder (VÕS § 39).² For breaches of a duty of care, the law itself sets a causation requirement: the insurer is released only to the extent that the breach affected the occurrence of the insured event or the extent of the loss.⁶

7. One or several insured events

Whether several successive frauds or attacks constitute one or several insured events affects the limit and the deductible:

• one event: one limit, one deductible;
• several events: a separate limit and deductible for each event, but the aggregate limit may be exhausted.

Policies usually contain an aggregation clause (for example, all acts of one person or of the same scheme are one event). In the US case National Bank of Blacksburg v Everest, the insurer treated two attacks as a single event (see the case collection). The same question arises in long-running internal fraud and in the many claims that follow a data breach.

Related pages

• Reservation of rights and declination letters under Estonian law
• Estonian Supreme Court: intent, exclusions and scope of cover
• Estonian Supreme Court: safety obligations and proportionality
• Estonian Supreme Court: nullity, avoidance and termination
• Case collection

References