A business that sought an additional payout on a cyberattack claim has lost its bid before the complaints authority and been told it must show it has incurred further losses.  

The air-conditioning and roofing company lost six months of data – from December 2021 to June 2022 – and was unable to enter new records for six weeks after the breach.  

It claimed for data recovery across seven months, plus costs related to lost revenue, director overtime and unclaimed green energy rebates.  

Lloyd’s Australia agreed to pay $109,166, including $57,354 for data recovery costs.  

But the claimant argued it should have received the policy’s maximum benefit of $500,000, including a payout for future data recovery costs that have yet to be incurred.  

An Australian Financial Complaints Authority panel notes the claimant relied on an estimation of its future data recovery costs. The business compared the breach period with other periods to show the number of jobs completed in the former, and calculated the cost of recovery based on average data re-entry time. 

The panel says the insurer is liable only for reasonable costs and expenses proven to have been incurred. 

The insurer said it was unreasonable for the claimant to seek to recover all lost data because it had been “re-entering data on an ad hoc basis for jobs subject to warranty claims”, and had since resumed operations.  

But AFCA disagrees, saying: “The ambit of the policy is to provide cover for data recovery costs incurred for data lost in a cyber event, to which the policy responds.  

“The panel accepts the insurer is only required to pay the reasonable costs and expenses of data recovery costs incurred. However, it is not a matter for the insurer to decide what lost data is reasonable to recover. This is a matter for the complainant.”  

The panel says the claimant should confirm with the insurer a reasonable rate per hour should future data re-entry costs be incurred and claimed.  

AFCA has rejected the business’ other claimed losses.

See the ruling here. 

From the latest Insurance News magazine: FM's chief engineer for Australia on lessons learnt from a 'history of natural catastrophes'