An Illinois Appellate Court, applying Illinois law, has held
that an insured's payroll overpayment following a ransomware
attack on the insured's payroll service provider was not
"necessarily incurred," such that coverage was
unavailable under the insured's cyber policy because the
insured's overpayments did not fall within the policy's
definition of "extra expense." Villa Fin. Servs., LLC v.
Underwriters at Lloyd's of London and Other Ins. subscribing to
Policy No. ESK0339447455, 2025 WL 3278947 (Ill. App. Ct. Nov.
24, 2025).
The insured, a management care company for nursing care
facilities, contracted with an outside vendor for payroll
compliance services to pay the employees of those care facilities.
The outside vendor sustained a ransomware attack. To meet its
payroll obligations, the insured used data from prior payroll
periods because it did not have access to its payroll records,
which resulted in a payroll overpayment of approximately $1.2
million to the
