In Panasonic Canada Inc. v. XL Specialty Insurance Company, 2026 ONCA 633 (September 9, 2026), the Ontario Court of Appeal reversed a lower court ruling and held that a ransomware sublimit endorsement, with its higher self-insured retention, applied to an insured’s cyber-incident claim, even though the insured had framed its claim exclusively under the base policy’s general coverage grants.
The case arose from a February 2022 ransomware attack on Panasonic Canada Inc. Attackers gained unauthorized access to Panasonic’s network after an employee downloaded a malware-infected file. The attackers exfiltrated confidential data, posted it online, and demanded a ransom. Panasonic’s policy was not to negotiate with such attackers, and it did not pay. Instead, Panasonic incurred approximately $2 million USD in response costs, including hiring cybersecurity specialists, engaging law firms, repairing its network, and purchasing replacement equipment.
Panasonic was insured under a cyber risk policy issued by XL Specialty Insurance Company. The base policy carried a $1.5 million USD retention across most coverage categories. However, the policy also included Endorsement #023, a “Ransomware Sublimit Endorsement” which amended the base policy with respect to cyber-extortion reimbursement and ransomware events and imposed a $3 million USD retention for those categories. Panasonic submitted its claim under the base policy’s general coverage provisions and argued that the $1.5 million USD retention applied. XL countered that the claim arose from a ransomware event and was therefore governed by Endorsement #023’s $3 million USD retention.
The application judge at the Superior Court sided with Panasonic, finding that the definitions in clause 5 of Endorsement #023 applied “solely for the purposes of this Endorsement” and that because Panasonic did not seek coverage under the endorsement, its higher retention did not apply. The application judge also drew on motor vehicle insurance law for the proposition that an insured may elect the more advantageous claim absent a clear policy limitation.
Writing for a unanimous panel, Justice Gillese allowed the appeal.
On the preliminary question of the standard of review, the Court of Appeal applied the correctness standard set out in Ledcor Construction Ltd. v. Northbridge Indemnity Insurance Co., 2016 SCC 37, The Court of Appeal found that the policy was a standard form contract of precedential value with no meaningful factual matrix specific to the parties. The Court of Appeal noted that both the base policy and Endorsement #023 were copyrighted forms used throughout the United States and Canada, and that this was the first judicial interpretation of the endorsement.
On the substantive question, the Court of Appeal held that the application judge erred by interpreting clause 5 of Endorsement #023 in isolation rather than reading it together with clauses 1 through 4, which unambiguously replaced the base policy’s cyber-extortion and ransomware provisions. Justice Gillese relied on the Supreme Court of Canada’s recent decision in Emond v. Trillium Mutual Insurance Company, 2026 SCC 3, which held that endorsements are not standalone contracts but are “built on the foundation of the policy” and must be read in conjunction with it.
The Court of Appeal found that the attackers’ communication to Panasonic fell squarely within the endorsement’s definition of a “cyber-extortion threat” and that Panasonic’s response costs constituted a “ransomware event loss” defined as “any and all loss for, arising out of, in connection with, or in any way involving a cyber-extortion threat”. The Court of Appeal further noted that the application judge had failed to consider clause 15 of the endorsement, which provided that where the endorsement’s provisions are inconsistent with the base policy, the endorsement controls.
As the agreed-on claim amount was less than the $3 million USD retention, Panasonic’s claim was wholly self-insured and the application was dismissed. The Court of Appeal awarded costs to XL in the amount of $21,000 for the appeal and $88,000 for the application below.
This decision is a significant reminder for policyholders that an insurer’s obligation to pay, and the applicable retention, is determined by the nature of the underlying event, not by how the insured characterizes its claim. Organizations that hold cyber risk policies with ransomware-specific endorsements should carefully review those endorsements, as the higher retention or sublimit may apply to all losses arising from a ransomware event, including incident-response costs, even where no ransom is paid and no claim is made under the endorsement itself. A PDF version is available for download here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]