The Ontario Court of Appeal confirmed that coverage analysis turns on the true nature of the loss for which indemnity is sought, not merely the coverage grant on which the insured chooses to rely. While arising from a ransomware attack, the decision serves as a broader reminder that where a policy contains wording specifically directed at a particular category of loss, that wording may govern notwithstanding an insured's attempt to frame the claim under a different coverage provision. This analysis is essential for commercial policyholders, risk managers and coverage counsel evaluating claim recovery strategies or negotiating policy renewals.
In Panasonic Canada Inc. v. XL Specialty Insurance Company, 2026 ONCA 633, the Ontario Court of Appeal held that a ransomware endorsement applied to losses arising from a ransomware attack, even though the insured did not pay a ransom and sought coverage under other coverage grants in the base policy.
The decision underscores that endorsement wording may govern ransomware-related losses based on the nature of the loss, regardless of the specific coverage grant invoked by the insured.
Facts
Panasonic incurred approximately US$2 million in costs responding to a ransomware attack that involved unauthorized access to its network and the exfiltration of confidential information.
Panasonic did not pay a ransom and sought indemnity under several first-party, third-party, and data breach response coverages in its cyber policy. The parties disputed whether the claim was subject to the policy's US$1.5 million retention or the US$3 million retention contained in Endorsement #023, the Ransomware Sublimit Endorsement (the Endorsement).
Lower court's decision
The application judge held that Panasonic's claim was subject to the US$1.5 million retention in the base policy.
The application judge found that the losses were covered under the base policy and that Panasonic was not looking to the Endorsement for its grant of coverage. The judge interpreted the Endorsement as applying only to claims made under the Endorsement itself and concluded that the higher retention did not apply. Panasonic was therefore entitled to recover the amount of its claim exceeding the US$1.5 million retention.
Court of Appeal's decision
Standard of review
The Court held that the interpretation of the Endorsement was reviewable on a correctness standard under Ledcor Construction Ltd. v. Northbridge Indemnity Insurance Co. because 1) the Endorsement formed part of a standard-form insurance contract; 2) its interpretation had precedential value; and 3) there was no meaningful factual matrix unique to the parties. The Court therefore interpreted the policy wording afresh.
Application of the Endorsement
The Court emphasized that endorsements must be read together with the policy as a whole. Because the Endorsement expressly stated that it “changes the policy,” the Court rejected the application judge's conclusion that the Endorsement's definitions were relevant only when coverage was sought under the Endorsement itself.
Instead, it held that the Endorsement governed any loss falling within the definition of “Ransomware Event Loss,” which captures any loss “arising out of, in connection with, or in any way involving” a cyber-extortion threat.
The Court found that Panasonic’s losses arose out of or were connected with a cyber-extortion threat. They therefore constituted a “Ransomware Event Loss” and were subject to the Endorsement's retention provisions.
Because Panasonic's agreed loss amount was less than the US$3 million retention, the claim was wholly self-insured. The Court allowed the appeal, declared that the US$3 million retention applied, and dismissed the application.
Takeaway
The decision highlights the importance of analyzing an insurance policy as a whole, including any endorsements that modify or restrict coverage. Even where an insured seeks coverage under provisions in the base policy, endorsements may govern the loss and determine the applicable retentions, sublimits, or other limitations. It is therefore necessary to determine whether a loss falls within the scope of a specific endorsement, regardless of the coverage grant under which indemnity is sought.
In the cyber insurance context, this means that sublimits related to extortion events may apply to non-extortion costs such as breach counsel fees, forensic investigation, data restoration, credit monitoring or even business interruption.
