Executive Summary: Key Legal and Evidentiary Issues

• Panasonic Canada Inc. sought a declaration that a $1.5 million USD retention under its cyber risk policy applied to costs incurred after a 2022 ransomware attack.
   
• XL Specialty Insurance Company argued that Endorsement #023, with a $3 million USD retention, governed the claim instead.
   
• A central issue was whether the definitions in clause 5 of Endorsement #023 applied only to claims made under that endorsement or to the policy as a whole.
   
• Standard of review was contested, with XL relying on Ledcor Construction Ltd. v. Northbridge Indemnity Insurance Co. to argue for correctness review of a standard form contract.
   
• The Court of Appeal considered whether the application judge erred by interpreting clause 5 in isolation from the rest of the endorsement.
   
• Ultimately, the outcome turned on whether Panasonic's claim fell within the endorsement's definition of "ransomware event loss."
   

Facts of the case

Panasonic Canada Inc. was insured by XL Specialty Insurance Company under a cyber risk policy. In February 2022, Panasonic suffered a ransomware attack: attackers gained unauthorized access to its network after an employee opened an infected file, downloaded confidential files, posted them online, and demanded contact from Panasonic while implying a ransom was required to release further data. Panasonic did not negotiate with the attackers or pay a ransom. Instead, it hired cyber-response firms and law firms, repaired its network, replaced laptops, and paid employee overtime to manage the incident. The parties agreed Panasonic's claim was worth approximately $2 million USD. Panasonic sought indemnity under the Base Policy's first-party and third-party coverages, which carried a $1.5 million USD retention. It did not claim under Endorsement #023, the "Ransomware Sublimit Endorsement," which carried a $3 million USD retention for cyber-extortion and ransomware events. When the parties disagreed on which retention applied, Panasonic brought an application for a declaration that the $1.5 million USD retention governed. Justice Janet Leiper of the Superior Court of Justice found in Panasonic's favour and declared the lower retention applicable, ordering XL to pay the amount of the claim exceeding that retention. XL appealed to the Court of Appeal for Ontario.

Policy and legislative provisions at issue

The Base Policy's Declaration Page set retentions of $1.5 million USD for most first-party and third-party coverages, including data breach response, business interruption, and data recovery, but set a $3 million USD retention specifically for "Cyber-Extortion and Ransomware." Endorsement #023 stated at its outset that it "changes the Policy" and amended the Base Policy by adding an Endorsement Schedule under which both cyber-extortion reimbursement and ransomware events carried a $3 million USD retention. Clauses 2 through 4 of the endorsement replaced the Base Policy's definitions relating to cyber-extortion coverage and cyber-extortion threat. Clause 5 introduced new definitions of "Threat Communication" and "Ransomware Event Loss," stating these definitions applied "solely for the purposes of this Endorsement." Ransomware Event Loss was defined broadly as any loss arising out of or connected to a cyber-extortion threat, regardless of the form the loss took. Clause 15 provided that where any provision of the endorsement was inconsistent with the balance of the policy, the endorsement's terms would control.

Reasoning and analysis

The Court of Appeal first addressed the standard of review, applying the two-factor test from Ledcor Construction Ltd. v. Northbridge Indemnity Insurance Co., 2016 SCC 37. It found the Base Policy and Endorsement #023 were copyrighted standard forms used throughout the United States and Canada, and that Endorsement #023 was worded identically to an endorsement in a related Panasonic North America policy. Because no case had previously interpreted Endorsement #023, and because consistent interpretation of standard form insurance contracts benefits both insurers and policyholders, the court held both Ledcor factors were satisfied and applied a correctness standard. Turning to the substantive interpretation, the court held that the application judge erred by reading clause 5 of Endorsement #023 in isolation. Clauses 1 through 4, read together, unambiguously brought all claims for cyber-extortion and ransomware events under the endorsement, and clause 5's definitions had to be read alongside clause 4's definition of "cyber-extortion threat." Applying those definitions, the court found the attackers' communication to Panasonic fell within the meaning of a threat communication and that Panasonic's loss met the definition of "ransomware event loss," even though Panasonic had not paid a ransom or claimed cyber-extortion expenses specifically. The court also relied on clause 15, the endorsement's paramountcy provision, and on the Supreme Court of Canada's recent guidance in Emond v. Trillium Mutual Insurance Company, 2026 SCC 3, that endorsements must be read together with, not apart from, the base policy they amend. On this basis, the court concluded that Endorsement #023 governed the claim regardless of the coverage grant under which Panasonic had actually claimed.

Ruling and overall outcome

The Court of Appeal for Ontario allowed XL's appeal, holding that Endorsement #023 and its $3 million USD retention applied to Panasonic's claim. Because the agreed claim amount of approximately $2 million USD fell below that retention, the loss was found to be wholly self-insured, and Panasonic's application for a declaration was dismissed. The court substituted a declaration that the $3 million USD Endorsement #023 ransomware event retention applied and that Panasonic's claim was wholly self-insured within that retention. XL was awarded costs of the appeal fixed at $21,000 and costs of the application fixed at $88,000, both inclusive amounts agreed on by the parties.