A recurring question in coverage disputes is whether a sub-limit expands coverage by creating a new, defined grant, or instead operates to restrict coverage that would otherwise be available under the policy.
In CiCi Enters., LP v. HSB Specialty Ins. Co., No. 3:23-CV-2155-L (N.D. Tex. 2026), the court held that a ransomware sub-limit endorsement in a cyber insurance policy did not cap the insured's recovery at $250,000.
Following a ransomware attack, the insured incurred more than $1.2 million in losses, including a ransom payment and incident response costs. The insurer acknowledged coverage under multiple insuring agreements, including cyber extortion, but asserted that the pizzeria's coverage was limited to $250,000 based on a ransomware sub-limit endorsement. The insurer argued that the ransomware sub-limit applied because the event qualified as a "Ransomware Event" and, in its view, functioned as a subset of an extortion threat subject to the endorsement cap.
