Cyber Insurance Complexities: University of California’s Legal Battle with Lloyd’s

In a legal battle that sheds light on crucial aspects of cyber insurance, the University of California has initiated a lawsuit against insurance companies operating in the Lloyd’s of London market. The university seeks damages following the insurers’ refusal to honor a payout after a cyberattack targeted the University of Los Angeles Health (UCLAH) in 2014.

The cyberattack on UCLAH resulted in the theft of sensitive patient data. Although the attack occurred in 2014, a year later the full scope of the breach came to light, revealing that millions of users were victims. The university faced multiple class action lawsuits and eventually paid out over $7.5 million in compensation to affected individuals.

However, when the University of California sought reimbursement through their cyber insurance policies, the insurers denied coverage, claiming that a statute of limitations had passed. Additionally, they alleged that the university had failed to comply with the regulatory requirements outlined in the cyber insurance policy.

Contrary to the insurers’ stance, the university asserts that it diligently adhered to all policy requirements and asserts that it has been unjustly denied the opportunity to engage in a dispute resolution process with the insurers. The elapsed time since the cyberattack may have created disparities between the university’s cybersecurity measures at the time and the insurers’ expectations, further complicating the settlement process.

The University of California’s legal battle serves as a stark reminder of the critical need for businesses to meticulously review and comprehend the fine print within cyber insurance policies. Furthermore, it emphasizes the value of establishing robust and transparent lines of communication between organizations and insurers to ensure clarity and alignment in times of cyber crises.