Viewpoint: Prudent or Not, an Insured’s Extra Expense Must Be Strictly ‘Necessary’

Core Viewpoint - The Illinois appellate court ruled that payments made by an insured following a cyberattack, which were reasonable but not contractually necessary, do not qualify as insured "extra expense" under the cyber insurance policy [1][5][12] Group 1: Case Background - The case involved Villa Financial Services, which suffered a cyberattack on Kronos Group in 2021, leading to payroll processing issues and resulting in overpayments of $1.2 million to employees [2][3] - Villa sought coverage from its cyber insurance carrier for these overpayments, claiming they were incurred as "extra expense" due to the cyber event [3][4] Group 2: Court Rulings - The trial court ruled in favor of the insurer, stating that Villa failed to demonstrate that the overpayments were "necessarily incurred" as required by the policy [4][5] - The appellate court affirmed this ruling, emphasizing that the policy's language did not support reimbursement for payments that were not contractually required [6][7] Group 3: Policy Interpretation - The cyber policy defined "extra expense" as reasonable sums necessarily incurred to mitigate business interruptions caused by cyber events [4] - The court highlighted that the term "necessarily incurred" implies that expenses must be essential and indispensable for business operations, which Villa could not prove [6][11] Group 4: Comparison with Other Cases - The Villa decision contrasts with the Fifth Circuit's ruling in Southwest Airlines, where the court found that the term "solely" in a different policy context allowed for a broader interpretation of coverage [11] - The Villa case serves as a reminder of the importance of precise language in insurance contracts and the courts' reluctance to create coverage where none exists [12]