10 November 2026 | Legal Affairs | General | Donald Dinnie, Director at Deneys and Yuveshen Naidoo, Associate at Deneys
In September 2026 the Ontario Court of Appeal found that a ransomware endorsement, with its higher retention, governed a claim for the costs of a ransomware attack.
This was so even though the insured paid no ransom and claimed only under the general cover in the base policy. The nature of the loss decided which retention applied, not the cover the insured chose.
In February 2022 attackers entered the insured’s network after an employee opened an infected file. They published confidential files and implied that a ransom was needed to decrypt the data. The insured ignored the demand. It hired specialists and lawyers, repaired its network and replaced laptops. Its agreed loss was about US$2 million.
The policy had a retention (which works like a deductible) of US$1.5 million for most covers. A ransomware endorsement set a US$3 million retention for cyber-extortion and ransomware events. The insured claimed under the base covers. The insurer relied on the endorsement, which would leave the whole loss within the retention.
The court held that the endorsement applied. An endorsement is not a standalone contract and must be read with the policy it amends. This endorsement precedence clause stated that it changed the policy and replaced its cover and definitions for ransomware events.
The endorsement defined ransomware event loss as any loss “in any way involving” a cyber-extortion threat, including damages and first-party costs. The attackers’ message was that kind of threat. The words “solely for the purposes of this Endorsement” did not limit the endorsement to claims made under it. A further clause provided that the endorsement prevails over any inconsistent provision of the policy.
The US$3 million retention therefore applied and the loss was wholly self-insured. The court stressed that the wording is a standard form used in the United States and Canada, so consistent interpretation matters to insurers and policyholders alike.
An insured cannot avoid a retention by choosing a different cover. If the loss falls within the endorsement’s wording, its sublimits and retentions apply. Not paying a ransom does not change this, because response, recovery and liability costs connected to an extortion threat may all be caught.
Insurers, insureds and brokers should read the policy as a whole, including endorsements and precedence clauses. A higher ransomware retention can remove recovery for a mid-sized incident, so it should be understood and negotiated at placement and renewal, not after an attack. For insurers, the decision shows the value of broad, precise wording and a clear precedence clause.
South African courts interpret insurance contracts like any other contract, considering language, context and purpose together. A provision is read in light of the document as a whole, which supports reading an endorsement with the policy it amends. The insurer must spell out clearly the risks it wishes to limit. If the wording is as clear as it was in this case, a similar outcome is likely. Many cyber policies in the local market follow international standard forms, so insurers, insureds and brokers here should check how their ransomware endorsements and retentions interact with the base cover.
[Panasonic Canada Inc v XL Specialty Insurance Company 2026 ONCA 633]
Click here to read more…
!function(f,b,e,v,n,t,s)
{if(f.fbq)return;n=f.fbq=function(){n.callMethod?
n.callMethod.apply(n,arguments):n.queue.push(arguments)};
if(!f._fbq)f._fbq=n;n.push=n;n.loaded=!0;n.version=’2.0′;
n.queue=[];t=b.createElement(e);t.async=!0;
t.src=v;s=b.getElementsByTagName(e)[0];
s.parentNode.insertBefore(t,s)}(window, document,’script’,
‘https://connect.facebook.net/en_US/fbevents.js’);
fbq(‘init’, ‘2193759890744328’);
fbq(‘track’, ‘PageView’);
Click Here For The Original Source.
——————————————————–
