Court Considers Damage Calculation for Cyber Attack

    The court was asked to determine the correct methodology for calculating Business Income Loss under the Smart Cyber Insurance Policy after the insured suffered from a cyber attack. Heritage Co., Inc. v. Hudson Excess Ins. Co., 2024 U.S. Dist. LEXIS 91714 (E.D. Ark. May 22, 2024).

    Heritage suffered from a ransomware attack that disrupted its business for months. Hudson covered business interruption losses as set forth in the policy. The policy provided,

Business Income Loss and Extra Expenses incurred during the Interruption Period directly as a result of the total, or partial, or intermittent interruption or degradation in service of an Insured's Computer System caused directly by a Privacy Breach, Security Brech, Administrative Error or Power Failure.

The policy's definition of Business Income Loss excluded, among other items, "other consequential loss or damage" and "extra expenses." Extra Expenses were included, however, in the coverage of the business interruption agreement. Extra Expenses included "Reasonable and necessary extra costs incurred by the Insured to temporarily continue as nearly normal as practicable in the conduct of the Insured's business during the Interruption Period . . ." 

    Hudson paid certain sums with a stipulation between the parties that Heritage's acceptance of the payments was not a waiver of additional payments. The parties filed cross motions for summary judgment.

    The policy definition of Business Income Loss included "net profit before income taxes that the Insured is prevented from earning during the Interruption Period."  The court found that "net profit" referred to when revenues exceeded expenses. This definition made it clear that Business Loss coverage was meant to insure any lost profit incurred during the Interruption Period resulting from a covered loss as if the loss had not occurred. The policy further limited these lost net profits to those caused directly as a result of the ransomware attack. 

    Section (b) of the Business Loss provision unambiguously provided for coverage for the shortfall a business might experience due to incurring "normal operating expenses" while also incurring abnormally low revenue during an Interruption Period. An insured could still earn some revenue, albeit abnormally low, while incurring unavoidable "normal operating expenses." Therefore, to the extent Heritage incurred a partial or whole loss of its revenue to cover normal operating expenses during the Interruption period, Heritage would be entitled to recover this shortfall but only to the extent of the normal expenses incurred.

    The court found Hudson's interpretation of section (b) of the definition of Business Income Loss correct. The correct methodology to determine Heritage's covered business income loss was to subtract from coverage "normal operating expenses" this that Heritage was able to pay from revenue it received during the Interruption Period. To the extent Heritage was able to pay these expenses, they did not constitute a loss. Therefore, to recover for them would place Heritage in a better position than it would have been in had there been no interruption in business. As a result, Hudson's motion for partial summary judgment was granted, and Heritage's motion was denied.