Limiting Endorsements Fail to Cap Ransomware Attack Coverage

In the recent decision of Cici Enters., LP v. HSB Specialty Ins. Co., Civil Action No. 3:23-CV-2155-L, 2026 LX 96138 (N.D. Tex. Feb. 23, 2026), a federal court applying Texas law determined a limiting endorsement could not cap a Cyber policy’s coverage for a ransomware attack. On May 21, 2022, CiCi suffered a ransomware attack in which threat actors encrypted CiCi’s systems and demanded $2,000,000 in payment to release them. After negotiations, $400,000 was eventually paid. The policy had a general limit of $3,000,000, but HSB asserted that a $250,000 sublimit applied due to a “Ransomware Sub-Limit Endorsement” that limited policy benefits for any “Ransomware Event.” That term was defined by the endorsement, in relevant part, as “the Insured Organization's receipt of a credible threat or series of related threats first discovered during the Policy Period, and such threats are made by a third party through the use of any malicious software or computer code . . . .” The court determined that it did not unambiguously apply to CiCi’s claim for four reasons.  

First, the court noted that the endorsement stated its sublimit applies “[s]olely with respect to the coverage afforded under this endorsement.” This language was confusing because the endorsement did not clarify what “coverage” it “afforded.”  

Second, the court rejected HSB’s contention that the "Policy's intent is glaringly obvious" and "clearly states that the Endorsement applies to all insuring agreements[.]" Id. at 30–31. The endorsement only stated that it was “added to section II. Limits of Insurance” without making any reference or modification to any of the Insuring Agreements found in Section I.  

Third, HSB conceded in its coverage letter that CiCi’s claim triggered coverage under four distinct Insuring Agreements. One of those (“Insuring Agreement D. Cyber Extortion”) is never addressed in the endorsement. Its text did not even include the term “Cyber Extortion.”  

Fourth, the court highlighted that other policy endorsements “demonstrate[d] the use of express terms to modify a type of afforded coverage under the various Insuring Agreements in the Policy. . . . If HSB wanted the $250,000 sub-limit to apply across the board, regardless of the Insuring Agreement, then it was incumbent upon HSB to expressly and clearly state that. Having not done so, it cannot now complain.” Id. at 32–33