Southwest Airlines' Cyber Coverage Suit Takes Off

• Published date: 13 February 2024
• Subject Matter: Insurance, Insurance Laws and Products
• Law Firm: Barnes & Thornburg
• Author: Avedis Bekhloyan and Scott Godes

Highlights

The Fifth Circuit recently reversed a district court's denial of a cyber insurance claim resulting from a widespread system failure, despite suggestions that costs were voluntarily incurred by the insured and the result of discretionary business decisions

Courts typically avoid interpretations of provisions in an insurance policy that would render coverage illusory or effectively wipe out entire portions of the policy

Policyholders should not be afraid to second guess insurers' narrow policy interpretations of key insurance policy terms

With a new year lands a new court decision to consider as companies grapple with losses resulting from a computer system failure under a cyber insurance policy. This decision is important for corporate policyholders because it refuses to take a narrow view of which first-party business income losses are covered under a cyber insurance policy.

The matter started when Southwest Airlines suffered a computer failure that caused approximately 475,839 Southwest customers to experience flight cancelations or delays of two hours or more. As a result, Southwest incurred more than $77 million in losses, including those from 1) discount codes, 2) travel vouchers, 3) cover refunds (to compensate customers for alternate travel arrangements), 4) Rapid Rewards Points (redeemable for airline tickets for members of its frequent flyer program), and 5) advertising costs (incurred to extend a sale that Southwest was conducting at the time of the system failure). Southwest sought reimbursement from its cyber risk insurance that included a series of follow form excess policies. Southwest recovered $50 million from its primary insurer and the first three layers of its excess insurance.

But then Liberty Insurance Underwriters Inc. denied coverage on the five loss categories and the claim for reimbursement under its cyber risk insurance policy. After Southwest filed suit for breach of contract, bad faith, and declaratory judgment, the U.S. District Court for the Northern District of Texas granted summary judgment for Liberty.¹ The district court concluded the sought costs were either not covered or excluded under the policy. On Jan. 16, 2024, the U.S. Court of Appeals for the Fifth Circuit reopened the runway for Southwest's claim and reversed the district court's decision.²

Liberty argued that the five categories of Southwest's claimed losses were not covered or were subject to various exclusions and, on that basis, denied Southwest's...