Hunton Insurance Recovery Blog

A New Mexico Court of Appeals decision illustrates that when a policy term is undefined and ambiguous, the term must be interpreted liberally and in favor of coverage. In Kane v. Syndicate 2623-623 Lloyd’s of London, 2025 WL 1733046 (N.M. Ct. App. June 16, 2025), the court affirmed summary judgment for a policyholder and held that a cyber liability policy afforded coverage for the policyholder’s loss that resulted from a post-breach fraudulent funds transfer because the preposition “for” was broad enough to afford coverage for a third party claim resulting from a security breach.

When a cyber incident occurs and the insurer pays out the claim, they often face the frustrating reality that pursuing the actual criminals – the threat actors – for indemnification is virtually impossible. Thus, insurers are now turning to subrogation claims against the very cybersecurity vendors entrusted by policyholders to protect their systems. Indeed, insurers are increasingly examining whether outsourced cybersecurity providers may have breached their contractual obligations or failed to deliver adequate protection, leading to the loss. This shift means policyholders may find their cybersecurity vendors facing legal action from their own insurer, creating a new layer of risk in vendor relationships.