The Court of Appeal for Ontario has ruled a $3 million USD retention, not $1.5 million, applies to Panasonic's ransomware claim against XL Specialty.
Panasonic Canada Inc. held a cyber risk policy with XL Specialty Insurance Company that set a $1.5 million USD retention for most first party and third party coverages, including data recovery, data breach response and business interruption. A separate provision, Endorsement #023, set a $3 million USD retention specifically for cyber-extortion reimbursement and ransomware events.
In February 2022, an employee opened a malicious file that let outside attackers into Panasonic's network. The attackers downloaded company files and posted a message warning that data had been encrypted, offering to decrypt two files free of charge. Panasonic's policy was not to negotiate with attackers, and it did not respond to the demand or pay a ransom.
Panasonic hired outside firms to respond to the incident, repaired its network, replaced laptops, and paid staff overtime to manage the fallout. It sought coverage under the base policy's provisions for third party liability, data breach response and crisis management, and business interruption, at the $1.5 million USD retention, and did not invoke Endorsement #023. The parties agreed the claim was worth about $2 million USD.
XL Specialty argued the $3 million USD retention in Endorsement #023 applied instead, because the claim arose from a ransomware event as defined in that endorsement. Justice Janet Leiper of the Superior Court of Justice sided with Panasonic in July 2025, finding the endorsement's definitions applied only to claims brought under the endorsement itself, and that Panasonic had not been required to claim under it.
On appeal, Justice Gillese, writing for the court, found the application judge erred by reading the endorsement's definition of ransomware event loss in isolation from the rest of the endorsement and the base policy. She noted the endorsement expressly states it changes the policy and that its terms control over any inconsistent provision elsewhere in the policy. "Endorsement #023 governs all claims for cyber-extortion and ransomware events," she wrote.
The court also found the interpretation issue engaged a correctness standard of review rather than a deferential one, because the base policy and Endorsement #023 are copyrighted standard forms used across the United States and Canada, and no prior case had interpreted the endorsement's specific wording.
Because Panasonic's claim exceeded the $1.5 million USD retention but fell short of the $3 million USD threshold in Endorsement #023, the Court of Appeal found the loss is wholly self-insured. It allowed the appeal, set aside the application judge's declaration, and dismissed Panasonic's application, awarding XL Specialty costs of $21,000 for the appeal and $88,000 for the application.
