A dispute over which retention applied to a ransomware-related insurance claim — $1.5M USD under the base policy or $3M USD under a specialized endorsement — was resolved by the Court of Appeal for Ontario in favour of the insurer. In a decision allowing XL Specialty Insurance Company's appeal, the court declared that Endorsement #023's $3M USD retention applied to Panasonic Canada Inc.'s claim, leaving it entirely self-insured.

The ransomware attack

The appeal arose from a declaratory judgment in an insurance matter before the Superior Court of Justice of Ontario. Panasonic Canada Inc. was insured by XL Specialty Insurance Company under a cyber risk policy (the Base Policy), effective April 1, 2021 to April 1, 2022. The Base Policy carried a retention of $1.5M USD for each distinct coverage.

In February 2022, people outside the company obtained unauthorized access to Panasonic's network after a Panasonic employee downloaded and opened a malware-infected file. The attackers downloaded confidential and sensitive files and posted them online. They also posted a message warning that data had been encrypted and implied a ransom was required to release the remainder. Panasonic did not respond to the demand, did not pay a ransom and did not claim indemnity for cyber-extortion expenses.

Panasonic sought indemnity under the Base Policy's first party coverage, third party liability coverage, and data breach response and crisis management coverage. The parties agreed the Panasonic Claim was for approximately $2 million USD.

Endorsement #023, entitled "Ransomware Sublimit Endorsement" amended the Base Policy in respect of coverage for cyber-extortion reimbursement and ransomware events, with a retention of $3M USD for each. "Ransomware Event Loss", which was defined as "any and all loss for, arising out of, in connection with, or in any way involving a cyber-extortion threat" was also included in the coverage.

Panasonic did not seek coverage under Endorsement #023, and the agreed-on amount of its Claim was less than the $3M USD retention. XL conceded that Panasonic made no claim directly related to the cyber-extortion threat.

Justice Janet Leiper of the Superior Court of Justice found in Panasonic's favour by judgment dated July 30, 2025. She declared the applicable retention was $1.5M USD and ordered XL to pay Panasonic the agreed-on amount exceeding that retention. She interpreted the "Ransomware Event Loss" clause of Endorsement #023 as meaning that its definitions applied only to claims brought under the Endorsement itself. XL appealed to the Court of Appeal for Ontario.

Which retention applies?

Panasonic maintained that its Claim was subject to the $1.5M USD retention, on the basis that it had established the Claim under the Base Policy provisions, and that only Endorsement #023 in the Base Policy referred to a $3M USD retention. Panasonic maintained that the application judge had correctly interpreted the "ransomware event loss" clause, in that it only applies if the insured presents a claim under Endorsement #023.

XL maintained that Endorsement #023 governed ransomware events, that the Claim was connected to a ransomware event, and therefore the $3M USD retention applied.

Why the endorsement prevailed

On the merits, the court found that the application judge erred by interpreting the "ransomware event loss" clause without considering the clear and unambiguous meaning of the other clauses of Endorsement #023. Read together, those clauses were unambiguous: Endorsement #023 governs all claims for cyber-extortion and ransomware events. The definition of "Ransomware Event Loss" required that it be read in conjunction with previous clauses. The application judge also erred by failing to consider clause 15, which provides that the Endorsement's provisions prevail over any inconsistent provision in the policy.

The Court of Appeal concluded that the ransomware event provisions in Endorsement #023 apply to the Panasonic Claim. The Claim constitutes a "ransomware event loss" within the meaning of Endorsement #023, and the applicable retention is $3M USD. Because the agreed-on amount of the Claim was less than $3M USD, the Claim was entirely self-insured.

The appeal was allowed with costs to XL fixed at the agreed-on sum of $21,000, inclusive of all charges. The application was dismissed with costs to XL in the agreed-on sum of $88,000, inclusive of all charges.