A New Mexico Courtroom of Appeals resolution illustrates that when a coverage time period is undefined and ambiguous, the time period have to be interpreted liberally and in favor of protection. In Kane v. Syndicate 2623-623 Lloyd’s of London, 2025 WL 1733046 (N.M. Ct. App. June 16, 2025), the courtroom affirmed abstract judgment for a policyholder and held {that a} cyber legal responsibility coverage afforded protection for the policyholder’s loss that resulted from a post-breach fraudulent funds switch as a result of the preposition “for” was broad sufficient to afford protection for a 3rd celebration declare ensuing from a safety breach.
Background
After New Mexico Well being Connections’ (NMHC) e-mail system was hacked, a foul actor emailed fraudulent invoices on the shape that certainly one of NMHC’s distributors used for its invoices. The fraudulent invoices altered the receiving checking account info and requested over $4 million earlier than sending them to NMHC’s accounting division. NMHC wired cost to the fraudulent checking account listed on the invoices, believing that it was paying its vendor. Ultimately, the seller contacted NMHC searching for cost for the precise invoices, which brought on NMHC to find the safety breach.
NMHC didn’t pay the seller who was awaiting cost for the seller’s authentic invoices. The seller then demanded cost from NMHC. NMHC then tendered the seller’s demand to its insurer and requested protection and indemnification. The insurer denied third celebration protection for the declare taking the place that the seller’s declare for the unpaid bill quantities didn’t set off third-party legal responsibility protection beneath the coverage for a safety breach, and even when it did, the coverage’s lack of cash exclusions barred protection for the third-party declare. In response, NMHC filed a lawsuit in district courtroom in opposition to the insurer for breach of the coverage’s third-party legal responsibility provision.
Whereas the events didn’t dispute that the coverage’s fraudulent instruction protection utilized, their dispute rested on whether or not the seller’s third-party declare for the unpaid invoices was a declare “for” a safety breach.
The district courtroom granted abstract judgment in NMHC’s favor and concluded that the coverage’s third-party legal responsibility provision coated the seller’s declare in opposition to “for” a safety breach as a result of the declare “arose from” a safety breach and “flowed from a safety breach.” The district courtroom additionally held that the exclusions cited by the insurer had been inapplicable.
Courtroom of Appeals Resolution
The insurer appealed to the New Mexico Courtroom of Appeals asserting, because it did within the district courtroom, that the coverage’s third-party legal responsibility protection doesn’t apply as a result of the seller’s declare was not a declare “for” a safety breach and that the coverage’s exclusions regarding lack of cash barred protection.
The Courtroom of Appeals examined the coverage’s third-party protection knowledge and community legal responsibility protection which offered protection for, amongst different issues, any declare first made in opposition to an insured throughout the coverage interval “for . . . a safety breach.” There was no dispute in regards to the time period “safety breach” or whether or not the fraudulent and unauthorized invasion of NMHC’s e-mail constituted a safety breach. Nonetheless, the events tussled over what the time period “for” meant. The insurer claimed that the preposition “for” within the coverage phrase solely meant “equal to” and concluded that protection is offered just for a loss straight related to the safety breach, and never for the associated fraudulent funds switch. NMHC, alternatively, construed “for” as that means “due to,” “arising out of,” or “on account of.”
The Courtroom of Appeals first regarded to the dictionary whereas analyzing the coverage’s that means of the phrase “for.” The courtroom acknowledged that each events’ most popular meanings of “for” had been included within the frequent utilization of the phrase, which demonstrated ambiguity. The Courtroom of Appeals additionally mentioned that lack of consensus amongst courts in deciphering the that means of a coverage time period, resembling “for,” is indicative of ambiguity. The courtroom finally accepted the reasoning of the policyholder and the district courtroom and decided that “for” might moderately be understood to both imply “straight related” to or “causally related” to a safety breach.
The Courtroom of Appeals additionally regarded to the coverage’s knowledge restoration prices protection provision, which coated prices incurred “as a direct results of a safety breach.” The courtroom reasoned that as a result of the legal responsibility protection offered protection “for a safety breach” with out limiting protection to occasions the place a breach or loss have to be “direct,” that it might embody each “direct and oblique” losses.
The Courtroom of Appeals additionally rejected the insurer arguments that varied coverage exclusions regarding lack of cash utilized to preclude protection for the third-party declare, discovering that the exclusions didn’t clearly and unambiguously apply to the state of affairs at hand.
For policyholders, the Kane resolution reinforces that even a single-word preposition may be ambiguous when it ends in at the very least two cheap interpretations. Certainly, policyholders want solely reveal {that a} coverage phrase or phrase is open to 2 cheap interpretations, whereas insurers should show that their interpretation is the one cheap one.
