Federal Court of Australia

Inchcape Australia Limited v Chubb Insurance Australia Limited [2022] FCA 883

ORDERS

THE COURT ORDERS THAT:

1.    The separate questions in the Court’s orders of 11 May 2022 be amended in accordance with the numbering set out in [1] of the reasons for judgment published today.

2.    Separate question 2(a) be amended to read:

“whether the cover available under Insuring Agreement 2 and Insuring Agreement 3 is limited to the cost of the blank media plus the cost of labour for the actual transcription or copying of data if such data (etc) is actually reproduced by other Electronic Data, Electronic Media or Electronic Instruction of the same kind of quality”.

3.    The separate questions be answered as follows:

Question 1: no.

Question 2(a): yes.

Question 2(b): no.

Question 2(c)(i), (ii), (iii), and (iv): as to each, no.

Question 3: general condition 4(i) in respect of Electronic Data (etc) applies to both the loss identified in 2(a) above or also applies to the loss identified in 2(c) above.

4.    Within seven days of these orders, the parties confer and either file agreed orders for the future conduct of the matter or nominate a mutually convenient date for a case management hearing in the following seven days.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

JAGOT J:

The separate questions

1    On 11 May 2022 I ordered that the following questions be answered separately from any other questions in the proceeding (renumbered to make sense):

1    Whether cover is only available under Insuring Agreement 2 and Insuring Agreement 3 if cover is available under Insuring Agreement 1;

2    Whether the expression “direct financial loss resulting directly from” in Insuring Agreement 2 and Insuring Agreement 3:

(a)    is limited to only the cost of actually reproducing damaged or destroyed Electronic Data, Electronic Media or Electronic Instruction (as defined);

(b)    is limited to only loss of money or financial instruments; or

(c)    includes financial loss incurred, as a result of damage or destruction to Electronic Data, Electronic Media or Electronic Instruction, in relation to:

(i)    investigating the ransomware attack and preventing further effects of the attack;

(ii)    replacing computer hardware;

(iii)    ancillary tasks in respect to reproducing damaged or destroyed Electronic Data, Electronic Media or Electronic Instruction (as defined); and/or

(iv)    manual processing of orders.

3    Whether General Condition 4(i) applies only to the loss identified in 2(a) above or also applies to the loss identified in 2(c) above.

The policy

2    The policy is the Chubb Financial Institutions Electronic and Computer Crime Policy.

3    The policy provides that in “consideration of the payment of the Premium… Chubb agrees to pay the Insured for” certain nominated matters. Those matters appear under the headings as follows:

1.    Insuring Agreements

…

4    The policy has a “Definitions” section which, relevantly, is as follows:

2.    Definitions

…

(b)    “Computer System” means a computer and all input, output, processing, storage and communications facilities and off-line media libraries which are connected to a computer.

(c)    “Customer Communication System” means those communications systems which provide customers of the Insured with direct access to the Insured’s Computer System.

(d)    “Direct Financial Loss” means direct financial loss first discovered by an officer of the Insured during the Policy Period.

…

(f)    “Electronic Data” means facts or information converted to a form useable in a Computer System and which is stored on Electronic Media for use by computer programs.

(g)    “Electronic Funds Transfer Systems” means those systems which operate automated teller machines, point of sale terminals and other similar operating systems, Internet access facilities, or other similar facilities for such systems, in which the Insured participates.

(h)    “Electronic Instruction” means computer programs converted to a form useable in a Computer System to act upon Electronic Data.

(i)    “Electronic Media” means the punched cards, magnetic tapes, punched tapes or magnetic discs or other bulk media on which data is recorded.

…

(k)    “Insured” means the Insured named in Item 2 of the Schedule and any Subsidiary thereof.

(l)    “Insured’s Computer System” means a Computer System that is under the control or supervision of the operating systems or applications software used by the Insured.

(m)    “Money” means a medium of exchange in current use authorised or adopted by a domestic or foreign government as part of its currency.

…

(q)    “Service Entity” means a natural person, partnership or corporation authorised by written agreement to perform data processing services using Computer Systems.

(r)    “Service Entity’s Computer System” means those Computer Systems operated by a Service Entity and which are either owned by or leased to a Service Entity.

…

5    The policy then specifies exclusions in these terms:

3. Exclusions

This Policy does not cover:

…

(d)    Loss of potential income, including but not limited to interest and dividends not realised by the Insured or by any customer of the Insured.

(e)    Indirect or consequential loss of any nature.

…

   (g)    All fees, costs and expenses incurred by the Insured

(1)    in establishing the existence of or amount of loss covered under this Policy; or

(2)    as a party to any legal proceeding except as provided by Insuring Agreement (10).

6    The general conditions of the policy in section 4 include:

(i)    Valuation

Money

Any loss of Money, or loss payable in Money, shall be paid in the Money of the Commonwealth of Australia or the dollar equivalent of it, determined by the free market rate of exchange in effect at the time of payment of such loss.

…

Securities

The value of Securities, foreign funds, currencies or precious metals for the loss of which a claim shall be made, shall be determined by their closing market value on the last business day prior to the discovery of the loss.

…

Electronic Data, Electronic Media, or Electronic Instruction

In case of loss of, or damage to, Electronic Data, Electronic Media or Electronic Instruction used by the Insured in its business, Chubb shall be liable under this Policy only if such items are actually reproduced by other Electronic Data, Electronic Media or Electronic Instruction of the same kind of quality and then for not more than the cost of the blank media plus the cost of labour for the actual transcription or copying of data which shall have been furnished by the Insured in order to reproduce such Electronic Data, Electronic Media or Electronic Instruction, subject to the applicable Aggregate Limit of Indemnity and/or One -Loss Sub-Limit.

However, if such Electronic Data cannot be reproduced and such Electronic Data represents securities, or financial instruments having a value then the loss will be valued as indicated in the Securities and Other Property paragraphs of this Section.

Other Property

The value of any loss of property other than as stated above shall be the actual cash value or the cost of repairing or replacing such property with property of like quality and value, whichever is less. Where a dispute arises between Chubb and the Insured as to the cash value or as to the adequacy of repair or replacement, such dispute at the request of both Chubb and the Insured shall be referred to Arbitration…

Question 1

7    Inchcape claims indemnity for a “ransomware attack” on its computer system which, according to Inchcape, encrypted its primary server, deleted the primary and offsite backups, deployed malicious software to laptops and desktop computers, and copied data from a shared drive and published it on the dark web. Inchcape claims that this ransomware attack caused it to incur, and continue to incur, financial losses in repairing and/or replacing hardware, software and data, including investigation costs, hardware costs, resources costs, additional staffing costs, and data recovery costs. Inchcape’s claim for indemnity is based on insuring agreement (IA) 2 and IA 3.

8    Question 1 is posed because Chubb contends there can be no indemnity under IA 2 or IA 3 unless IA 1 is also satisfied. Inchcape’s claim does not engage IA 1 so Chubb’s contention is potentially determinative of Inchcape’s claim.

9    Chubb contends that its position is supported by these matters:

(1)    of the 10 insuring agreements, only IA 2 and IA 3 contain a cross-reference to IA 1;

(2)    on the express terms of IA 2 and IA 3, for cover to be available there must first be a “Direct Financial Loss …covered under Insuring Agreement 1”;

(3)    this makes sense as IA 1 addresses the most significant risk covered by a “financial institutions” policy, being the loss of funds by reason of fraudulent interference with the computer infrastructure of the insured, a customer whose computer system provides direct access to the insured’s computer system, or an intermediary;

(4)    IA 2 and IA 3 are extensions to the cover under IA 1, but the bookends to that extended cover are “Direct Financial Loss” and “covered by Insuring Agreement 1”;

(5)    the cross-references in IA 2 and IA 3 are “covered under Insuring Agreement 1”. However, the phrase “covered by” elsewhere in the policy always means indemnified (eg, IA 9, the opening words of cl 3 and cll 3(g)(1), 3(j)(2) and 3(l)(3), general conditions cll 4(b), (c), (d), (e), (f), (j), (l), (o), (q));

(6)    the definitions in cl 2 describe the relevant systems in IA 1 so there is no basis to read the words “covered under Insuring Agreement” as merely descriptive – if that had been intended, IA 2 and IA 3 could simply have used the defined terms; and

(7)    other insuring agreements refer to the systems listed in IA 1 by their definitions, and without reference to them being covered by IA 1 (see IA 4, IA 6 and IA 8). That confirms the intention underlying the use of the particular expression in IA 2 and IA 3 to invoke the scope of indemnity offered by IA 1.

10    I am not persuaded by these arguments.

11    The text of IA 2 and IA 3 does not support Chubb’s contentions. IA 2 and IA 3 do not say “Direct Financial Loss… covered under Insuring Agreement 1”. They say “Direct Financial Loss… resulting directly from the [damage or destruction/fraudulent modification of data]…. while stored within a Computer System covered under Insuring Agreement 1”. The natural and ordinary meaning of the text is that it is the Computer System that must be covered under IA 1, not the Direct Financial Loss. The Computer System covered under IA 1 (recognising that Computer System is defined as “a computer” etc, not, for example, confined to the Insured’s Computer System or a Customer Communication System which are separately defined) is one or more of the systems described in IA 1 (1)–(4).

12    The fact that it is only IA 2 and IA 3 which contain this cross-reference to IA 1 does not support Chubb’s contention. IA 2 and IA 3 are about damage to or destruction of data itself. Contrary to Chubb’s contentions, it would be incongruous if IA 2 and IA 3 depended on a transfer (etc) of funds or property. The fact that the policy title refers to “financial institutions” is of no significance for this issue of construction. There is no definition of a “financial institution” in the policy and the policy provides for Chubb to pay the Insured in consideration of the payment of the Premium; the status of the Insured is irrelevant. Even if the name of the policy was material to this issue of construction, the fact that the main risk for a financial institution may well be the transfer (etc) of money does not mean the policy excludes cover for other risks.

13    No other aspect of the policy supports Chubb’s contention. In the other provisions of the policy to which Chubb referred, the phrase used is, or is the equivalent of, “loss covered/not covered by this policy”. In this context, the text means within the scope of the agreed indemnity. As noted, that is not what IA 2 or IA 3 say. They are not referring to loss covered by the policy, but to Computer Systems covered under IA 1.

14    IA 2 and IA 3 could have been drafted in more lengthy terms including specific references to the Computer Systems in IA 1(1)–(4). But the fact that those Computer Systems had already been identified in IA 1 means that there was no need for them to be repeated in IA 2 and IA 3. The cross-reference is a mere matter of drafting convenience. The fact that other insuring agreements refer to specific types of Computer Systems may be inferred to be a consequence of the fact that none of those other insuring agreements refer to every one of the Computer Systems in IA 1(1)–(4).

15    For these reasons question 1 is answered “no”.

Question 2(a)

16    Chubb contends that indemnity under IA 2 and IA 3 is confined to the cost of actually reproducing damaged or destroyed Electronic Data, Electronic Media or Electronic Instruction by operation of general condition 4(i). Question 2(a) should be understood as posing the question whether this is correct or incorrect. I note that, as drafted, question 2(a) wrongly focuses on the words “direct financial loss resulting directly from” in IA 2 and IA 3, when the correct question is “whether the cover available under Insuring Agreement 2 and Insuring Agreement 3 is limited to the cost of the blank media plus the cost of labour for the actual transcription or copying of data if such data (etc) is actually reproduced by other Electronic Data, Electronic Media or Electronic Instruction of the same kind of quality”. I proceed on this basis.

17    According to Chubb:

(1)    general condition 4(i) in respect of Electronic Data (etc) identifies the damage for which “Chubb shall be liable under this Policy” and effect must be given to this limiting condition in respect of the operation of IA 2 and IA 3;

(2)    the fact that general condition 4(i) deals separately with Money, Securities, Electronic Data (etc), and Other Property supports Chubb’s position that insofar as Electronic Data (etc) are concerned, Chubb’s liability is confined to the heads of loss specified thereunder;

(3)    the loss claimed and pleaded in the present case is loss of/damage to Electronic Data (etc) and, accordingly, general condition 4(i) in respect of Electronic Data (etc), is engaged; and

(4)    it follows that the extent of Chubb’s liability for the claim is:

(a)    in respect of Electronic Media, the cost of replacement with “the same kind of quality and then for not more than the costs of the blank media”; and

(b)    in respect of Electronic Data, “not more than ... the costs of labour for the actual transcription or copying of data”. That data specifically “shall have been furnished by the Insured” (that is, at its own expense).

18    I accept Inchcape’s argument that IA 2 and IA 3 are not concerned only with the loss of or damage to Electronic Data (etc). They refer to “Direct Financial Loss by reason of the loss resulting directly from the damage or destruction of Electronic Data” (etc) in IA 2 and “Direct Financial Loss resulting directly from … the fraudulent modification of Electronic Data” (etc) in IA 3. IA 2 and IA 3 could have read “damage or destruction of Electronic Data” (etc) in IA 2 and “fraudulent modification” of Electronic Data (etc) in IA 3. Then the field covered by those insuring agreements would clearly coincide with the field covered by general condition 4(i) in respect of Electronic Data (etc). As drafted, however, the field covered by IA 2 and IA 3 appears broader than the field covered by general condition 4(i) in respect of Electronic Data (etc).

19    Further, I accept Inchcape’s argument that general condition 4(i) in respect of Electronic Data (etc) refers to “loss of, or damage to, Electronic Data” (etc). In this context, the “loss of” Electronic Data (etc) means the data itself being no longer available to the insured by reason of damage, destruction, or some other action within the scope of IA 2 or IA 3. That is, at a conceptual level, the loss of Electronic Data (etc) is not the same as loss resulting from the loss of Electronic Data (etc). Further, it would have been easy for the policy, in general condition 4(i) in respect of Electronic Data (etc), to say “in case of any loss resulting from loss of, or damage to, Electronic Data” (etc) or “in case of Direct Financial Loss covered by IA 2 or IA 3” or words to that effect. But that is not what general condition 4(i) in respect of Electronic Data (etc) says.

20    I accept that all of these matters appear to support Inchcape’s approach to general condition 4(i) in respect of Electronic Data (etc).

21    Closer examination of all of the provisions, however, indicates that Chubb’s approach is correct. This is because it is necessary to understand that the opening words to general condition 4(i) in respect of Electronic Data (etc) are not confining the scope of the limitation to loss of or damage to Electronic Data (etc), but are identifying a condition or event on which the operation of the condition depends and the condition or event which is relevant is necessarily an event within IA 2 or IA 3.

22    The words in general condition 4(i) in respect of Electronic Data (etc) are “in case of loss of, or damage to, Electronic Data (etc)”. The kinds of events described in IA 2 and IA 3 all fall within the scope of the concepts of loss of or damage to Electronic Data (etc). In IA 2 the events are damage or destruction of Electronic Data (etc). In IA 3 the events are the fraudulent modification, robbery, burglary, larceny or theft, damage or destruction of Electronic Data (etc). Accordingly, every possible insured event under IA 2 and IA 3 will involve a loss of, or damage to, Electronic Data (etc) within general condition 4(i) in respect of Electronic Data (etc). General condition 4(i) in respect of Electronic Data (etc) operates if that condition or contingency is satisfied.

23    It is also necessary to test the potential operation of the provisions by reference to the competing constructions: LCA Marrickville Pty Limited v Swiss Re International SE [2022] FCAFC 17; (2022) 401 ALR 204 at [57] per Derrington and Colvin JJ. Assume a loss (by relevant destruction or theft) of Electronic Data (etc). IA 2 and IA 3 cover Direct Financial Loss by reason of the loss resulting directly from the destruction of the Electronic Data and Direct Financial Loss resulting directly from the modification/destruction of the Electronic Data. General condition 4(i) in respect of Electronic Data (etc) applies to the loss of the Electronic Data. On Chubb’s approach it also applies to any Direct Financial Loss by reason of the loss resulting directly from the destruction of the Electronic Data and Direct Financial Loss resulting directly from the destruction of the Electronic Data. On Inchcape’s approach it does not apply to any Direct Financial Loss by reason of the loss resulting directly from the destruction of the Electronic Data and Direct Financial Loss resulting directly from the destruction of the Electronic Data.

24    Chubb’s approach correctly treats the words “in case of loss of, or damage to, Electronic Data (etc)” in general condition 4(i) in respect of Electronic Data (etc) as meaning “in the event of” or “if there is” such loss or damage. That is, the words “in the case of” are a condition precedent to the operation of general condition 4(i) in respect of Electronic Data (etc). Inchcape’s approach treats those words as defining the scope of the limitation in the general condition. That is, the words mean “for loss of, or damage to, Electronic Data (etc)”.

25    Chubb’s approach accords better with the text and context of the provision. Chubb’s approach gives effect to the words in general condition 4(i): “Chubb shall be liable under this Policy only if…and then for not more than…”. On Inchcape’s approach in the case of loss of, or damage to, Electronic Data (etc) Chubb shall be liable under the policy not “only if…and then for not more than…” as specified. On its approach Inchcape could suffer loss of Electronic Data (etc). It could decide not to reproduce that data. It could then seek to claim some financial loss as a Direct Financial Loss resulting directly from the loss of the Electronic Data (etc). Leaving aside the requirement of directness and the exclusion of indirect or consequential loss of any nature in cl 3, this outcome seems incongruous. It fails to give effect to the fact that: (a) all potential events covered by IA 2 and IA 3 involve the loss of or damage to Electronic Data (etc) as referred to in the general condition, and (b) the words “Chubb shall be liable under this Policy only if…and then for not more than…”. This conclusion also accords with the fact that IA 2 and IA 3 cover only Direct Financial Loss resulting directly from the specified matters and exclusion 3(e) of any indirect or consequential loss.

26    General condition 4(i) in respect of Other Property refers to the “value of any loss of property other than as stated above”. But the relevant loss is the loss of “property”. It is not financial loss resulting from the loss of property. Further, Electronic Data (etc) is property. The loss of Electronic Data (etc) is a “loss of property as stated above” within the meaning of general condition 4(i) in respect of Other Property. Accordingly, general condition 4(i) in respect of Other Property cannot apply.

27    For completeness, assume there has been both loss of, or damage to, Electronic Data (etc) and Direct Financial Loss by reason of an event covered under IA 1. In those circumstances, the Direct Financial Loss resulting directly from the insured events under IA 2 and IA 3 are subject to the limitation in general condition 4(i) in respect of Electronic Data (etc). The Direct Financial Loss by reason of an event covered under IA 1 is not subject to that limitation. The value of that Direct Financial Loss is determined under general condition 4(i) in respect of Money or Securities as applicable. Chubb’s approach is harmonious with the provisions as a whole.

28    Once it is recognised that: (a) all potential events covered by IA 2 and IA 3 involve the loss of or damage to Electronic Data (etc) as referred to in general condition 4(i), (b) the words “Chubb shall be liable under this Policy only if…and then for not more than…”, and (c) the words “in case of” in general condition 4(i) mean “in the event of” or “if there has been”, so that the event of loss or damage to Electronic Data (etc) is a condition to the operation of general condition 4(i) in respect of Electronic Data (etc), then it is apparent that the policy operates as a coherent whole on Chubb’s approach to this issue of construction.

29    The only potential infelicity on Chubb’s construction is that general condition 4(i) in respect of Other Property refers to “loss of property other than as stated above”, not “loss of or damage to property other than as stated above”. Assume damage to but not loss of Electronic Data (etc). Is that then potentially within general condition 4(i) in respect of Other Property? I consider that general condition 4(i) in respect of Electronic Data (etc), on its own terms, would still apply to such damage to Electronic Data (etc), and confine the scope of Chubb’s liability under the policy.

30    For these reasons question 2(a) (as it should be stated in the amended form above) is answered “yes”.

Question 2(b)

31    Question 2(b) is another version of question 1. Chubb’s contention is that “Direct Financial Loss” in IA 2 and IA 3 requires loss of money or financial instruments because these are the events covered by IA 1.

32    For the reasons already given, IA 2 and IA 3 do not depend on the operation of IA 1. Further, the events in IA 1 extend to “the Insured having debited any account, paid or delivered any funds or property, given any value or transferred, paid or delivered any funds or property”.

33    For these reasons question 2(b) is answered “no”.

Question 2(c)

34    Given my answer to question 2(a), question 2(c) does not arise because the limitation on Chubb’s liability under general condition 4(i) in respect of Electronic Data (etc) applies.

35    If my conclusion about general condition 4(i) in respect of Electronic Data (etc) is wrong, question 2(c) does arise. Chubb’s contention is that the losses identified are not “Direct Financial Loss…resulting directly from…”. Rather, the losses are insufficiently direct for the purpose of IA 2 and 3, or are indirect or consequential losses excluded by cl 3(e).

36    Chubb’s reference to the dispute in the United States about the meaning of “direct” (“direct means direct” causally and temporally or “direct means proximate”), by reference to Tooling, MFG and Technologies v Hartford Fire 693 F.3d 665 (6th Cir. 2012), is interesting but not material. I am concerned with this policy which was issued in Australia to an Australian entity which should be construed in accordance with Australian law.

37    I accept that it is common place for insurance policies to involve redundancy and “overkill” in drafting to “obliterate the conceptual target”, so construction arguments based on redundancy are fraught: Tektrol Ltd v International Insurance Co of Hanover Ltd [2005] EWCA Civ 845; [2005] 2 Lloyd’s Rep 701 at [16], citing Tea Trade Properties Ltd v CIN Properties Ltd [1990] 1 EGLR 155 at 158. In this policy, the cover is not for Direct Financial Loss (meaning “direct financial loss”). The cover is for “Direct Financial Loss” “resulting directly from” the insured event.

38    In Australian Capital Financial Management Pty Ltd v Australian Financial Complaints Authority Limited [2021] NSWSC 1577 Ball J said:

[69]    The expressions “direct financial loss” and “indirect financial loss” are not terms of art, and their meaning depends on the context in which the issue arises. The expressions invite consideration of the question whether there is a sufficiently clear and direct connection between the breach and the loss that it can be said that the loss is a direct consequence of the breach or whether the connection falls short of that requirement. As Mitchell J explained in Patersons Securities Ltd v Financial Ombudsman Service Ltd [2015] WASC 321 “the essence of the distinction evoked by that meaning is, in general terms, between direct loss which flows naturally from the breach without other intervening cause and indirect loss which does not so flow. Whether particular loss – including loss of profits – is direct or indirect depends on all the circumstances of the particular case”: at [132] (citations omitted).

[70]    In the present case, there is a question whether there is a sufficient connection between ACFM’s conduct in failing to provide adequate information to the guarantors and the legal costs they ultimately incurred to say that one is a direct consequence of the other. In my opinion, there is not. The obligation to pay legal costs did not arise from the guarantees…They were not a ““normal loss” … [being] loss that every plaintiff in a like situation will suffer …” to quote from the judgment of Nettle JA in Environmental Systems Pty Ltd v Peerless Holdings Pty Ltd (2008) 19 VR 358 at [87], [93]. (emphasis added).

39    In Lasermax Engineering Pty Ltd v QBE Insurance (Australia) Limited [2005] NSWCA 66; (2005) 13 ANZ Ins Cas 61-643 the Court concluded that “direct” meant “proximate” in an insuring policy and did not exclude the possibility of intervening events: [82]–[83], [101]. However, in Lasermax, McColl JA (with whom Ipp and Tobias JJA agreed) was careful to stress that “the expression “directly caused by” in an insurance contract is, subject to the terms of the policy, to be construed as referring to the concept of proximate cause” and did not exclude all claims involving a “step between the cause and the consequence” (emphasis added): [83].

40    In Outerbridge t/as Century 21 Plateau Lifestyle Real Estate v Hall [2020] NSWCA 205; (2020) 102 NSWLR 921, Beech-Jones J (with whom Leeming JA and Emmett AJA agreed) explained at [60] that, in the context of a contractual right to a sales commission (where the concept of “effective cause” applies):

A test requiring proof of “effective cause” is different from and more stringent than the test of proximate cause which is often applicable to insurance contracts which in turn is more stringent than the ‘but for’ test of causation (Moneywood Pty Ltd v Salamon Nominees Pty Ltd (2001) 202 CLR 351; [2001] HCA 2 at [83] per Gummow J…

41    The application of these authorities means that “loss resulting directly from” as used in IA 2 and IA 3 means loss the proximate cause of which is an insured event. However, it is not any “loss” which is covered. It is only “Direct Financial Loss”. As such, the cover in IA 2 and IA 3 is for direct financial loss a direct (that is, proximate) cause of which is an insured event. This cover is also subject to the exclusion of any indirect or consequential loss by cl 3(e). On this basis, I consider that for there to be direct financial loss a proximate cause of which is an insured event, the connection required excludes the prospect of any intervening step and losses that would not be necessarily and inevitably incurred by every insured given the occurrence of the insured event. This is consistent with Lasermax and other authorities because it gives effect to the fact that IA 2 and IA 3 require not merely any loss resulting directly from an insured event, but direct financial loss resulting directly from an insured event which any and every insured would have suffered by reason of the insured event. As noted, the conclusion in Lasermax was said to be “subject to the terms of the policy” (at [83]) and this policy requires more than merely any loss resulting directly from an insured event.

42    If my conclusion about general condition 4(i) in respect of Electronic Data (etc) is wrong, then I would also reach the following conclusions about the requirements of IA 2 and IA 3 for “direct financial loss” resulting directly from the insured events.

43    The costs of investigating the ransomware attack and preventing further effects of the attack (separate question 2(c)(i)) are not direct financial losses resulting directly from the insured events because they required the intervening step of Inchcape deciding to investigate the ransomware attack and prevent further effects of the attack. It is also not apparent that these costs would necessarily have been incurred by every insured in the same circumstances. There is no suggestion that the Electronic Data stolen during the ransomware attack itself involved direct financial loss to Inchcape. Such costs are also indirect or consequential losses excluded by cl 3(e).

44    The costs of replacing computer hardware (which I infer to be the servers, laptops and PCs identified in Inchcape’s claim dated 13 August 2021) (separate question 2(c)(ii)) are not direct financial losses resulting directly from the insured events because they required the intervening step of Inchcape deciding to replace the hardware, and it is not apparent that these costs would necessarily have been incurred by every insured in the same circumstances. Again, such costs are also indirect or consequential losses excluded by cl 3(e). Further, it is relevant that this is not a policy covering loss resulting from damage to or destruction of the Insured’s Computer Systems. The policy relates to Direct Financial Loss directly resulting from (relevant) things done to Electronic Data (etc). The replacement of Inchcape’s computer hardware was undoubtedly caused by and resulted from the ransomware attack in the sense that “but for” the ransomware attack Inchcape would not have had to replace the computer hardware. But I do not accept that Inchcape having to buy the replacement computer hardware involves a direct financial loss resulting directly from the insured events. In any event, that cost is a consequential loss to Inchcape excluded by cl 3(e).

45    The costs of “ancillary tasks in respect to reproducing damaged or destroyed Electronic Data, Electronic Media or Electronic Instruction (as defined)” (separate question 2(c)(iii)) must be capable of being Direct Financial Loss directly resulting from events insured under IA 2 and IA 3 because this is the foundation of the limitation in general condition 4(i) in respect of Electronic Data (etc) – that is, the limitation of Chubb’s liability under the policy to circumstances where:

such items are actually reproduced by other Electronic Data, Electronic Media or Electronic Instruction of the same kind of quality and then for not more than the cost of the blank media plus the cost of labour for the actual transcription or copying of data which shall have been furnished by the Insured.

46    On this basis, Chubb’s liability does not extend to the costs Inchcape incurred in retrieving or reconstituting the Electronic Data (etc). This is an item “which shall have been furnished by the Insured”. Chubb’s liability is for the cost of the blank media plus the cost of actually transcribing or copying the data into the (new) Computer System.

47    If general condition 4(i) in respect of Electronic Data (etc) does not operate in this manner (the assumption for this part of the discussion) then there is a disjunct between general condition 4(i) in respect of Electronic Data (etc) and IA 2 and IA 3. The disjunct is that (again) while I accept that reproducing damaged or destroyed Electronic Data (etc) was caused by and resulted from the ransomware attack in the sense that “but for” the ransomware attack Inchcape would not have had to reproduce that data, I am unable to accept these are direct financial losses resulting directly from the damage to or destruction of the Electronic Data (etc) because they require an intervening step of Inchcape deciding that it should reproduce that data and they are not losses which every insured would necessarily incur as a result of the insured event.

48    The costs of “manual processing of orders” (separate question 2(c)(iv)) are not direct financial losses resulting directly from the insured events because they required the intervening step of Inchcape deciding to manually process orders, and it is not apparent that these costs would necessarily have been incurred by every insured in the same circumstances. These costs are indirect or consequential upon the insured events.

49    Question 2(c)(i), (ii), (iii), and (iv) are each answered “no”.

Question 3

50    Question 3 is another version of question 2(a) above.

51    For the reasons already given, general condition 4(i) in respect of Electronic Data (etc) applies to limit Chubb’s liability under the policy if there has been loss of or damage to Electronic Data (etc). General condition 4(i) in respect of Electronic Data (etc) is not confined to the cost of actually reproducing damaged or destroyed Electronic Data (etc) but applies to all loss said to be Direct Financial Loss directly resulting from loss of or damage to Electronic Data (etc).

52    It follows that question 3 must be answered “general condition 4(i) in respect of Electronic Data (etc) applies to both the loss identified in 2(a) above or also applies to the loss identified in 2(c) above”.

Next steps

53    The parties should be given an opportunity to consider these reasons for judgment including the making of orders to enable any appeal or, if necessary, application for leave to appeal. I would be willing to consider any application for leave to appeal, if final orders cannot or should not be made as a result of my answers to the separate questions.

Associate:

Dated:    1 August 2022