A federal appeals court Tuesday overturned a lower court ruling that barred excess cyber risk coverage for Southwest Airlines Co. for costs it sustained responding to a computer failure that disrupted its operations.
A district court in Texas previously ruled in favor of a unit of Liberty Mutual Insurance Co. that the costs incurred by Southwest were discretionary and not covered.
But in Southwest Airlines Co. v. Liberty Insurance Underwriters Inc., the 5th U.S. Circuit Court of Appeals in New Orleans reversed the 2022 summary judgment and remanded the case for further proceedings.
The airline had claimed coverage for $77 million in costs it said it incurred responding to a computer system failure that disrupted flights for 475,839 Southwest customers in 2016.
Weeks before the failure, the airline had bought a cyber risk insurance policy that was led by American International Group Inc. Liberty was a follow-form excess insurer on the coverage tower, providing $10 million in limits above $50 million, court papers say.
Southwest collected on the first $50 million, but Liberty denied the claim, challenging various costs, including: discount codes, travel vouchers and frequent flyer points issued to affected customers, reimbursement of customers’ alternative travel costs, and costs for an advertising campaign the airline extended after the system failure.
Liberty also said coverage was barred under various exclusions in the policy.
The lower court concluded that the costs were not caused by the system failure but by “various and purely discretionary customer-related rewards programs, practices and market promotions,” court papers say. It also ruled that the exclusions barred coverage.
In its appeal, Southwest acknowledged that the costs were incurred due to business decisions it made but argued that they were still covered under the terms of the policy, which defined losses as “costs that would not have been incurred but for a Material Interruption.” A material interruption was defined as “the actual and measurable interruption or suspension of an Insured’s business directly caused by … a System Failure.”
The appeals court agreed that the costs met the definition of losses in the policy, adding that the lower court erred in concluding that the costs were precluded from coverage as a matter of law.
“We do not determine whether the system failure was in fact the sole cause of each of the costs that Southwest claims,” the court stated.
To resolve the dispute, Liberty would need to explain how the costs incurred by Southwest are not recoverable as mitigation costs resulting solely from the system failure and Southwest will have to show how payment of the costs wouldn’t grant it “a windfall,” the ruling states.
On the policy exclusions cited by Liberty, the court ruled among other things that the insurer’s interpretation of an exclusion for “consequential damages” as barring coverage for costs that are not “direct” and “immediate” was too narrow.
Liberty’s interpretation of the exclusion may limit coverage to the cost of technical repairs to Southwest’s systems and “would render much of the coverage under the policy completely illusory,” the court ruled.
The court also ruled that an exclusion barring coverage of losses attributable to “any liability to third-parties” does not include payments to Southwest’s customers.
Liberty Mutual declined to comment on the ruling.
