Court Reverses Decision Denying Southwest Airlines Cyber Risk Coverage, Signaling Implications for Insurance Interpretation

In a significant development, the 5th U.S. Circuit Court of Appeals in New Orleans overturned a district court ruling that had denied Southwest Airlines Co. excess cyber risk coverage for costs incurred in responding to a computer failure, according to an article by Business Insurance Magazine.

The lower court had sided with Liberty Mutual Insurance Co.’s unit, stating that the costs were discretionary and not covered. Southwest sought coverage for $77 million in costs related to a 2016 computer system failure affecting nearly 476,000 customers.

Southwest had purchased a cyber risk insurance policy led by American International Group Inc., with Liberty as a follow-form excess insurer providing $10 million in limits above $50 million. While Southwest collected the initial $50 million, Liberty denied the claim, challenging various costs, including discount codes, travel vouchers, and advertising expenses post-failure.

The lower court contended that the costs were unrelated to the system failure, attributing them to discretionary customer programs and market promotions. Southwest, in its appeal, argued that these costs were covered under the policy’s definition of losses as “costs that would not have been incurred but for a Material Interruption” caused by a “System Failure.”

The appeals court agreed, stating the lower court erred in concluding that the costs were not covered. It clarified that it did not determine if the system failure was the sole cause of the costs but emphasized that Liberty needed to explain why Southwest’s costs were not recoverable as mitigation costs solely resulting from the system failure. Southwest, on the other hand, must demonstrate that payment wouldn’t lead to a “windfall.”

Regarding policy exclusions, the court ruled against Liberty’s narrow interpretation, emphasizing that an exclusion for “consequential damages” should not be limited to “direct” and “immediate” costs. It also clarified that an exclusion for losses attributable to “any liability to third-parties” does not include payments to Southwest’s customers. The ruling has significant implications for cyber risk insurance coverage interpretation and may impact similar cases in the future. Liberty Mutual declined to comment on the decision.