Rescission: when a cyber policy is treated as never issued

SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. This page explains vocabulary; it is not legal advice, not insurance advice, and not a coverage determination, no attorney-client relationship arises from reading it, and the answer in any real matter turns on your own policy wording and the law of your state.

Definition

Cancellation ends a policy going forward. Rescission goes further and treats it as void from inception, unwound as though it had never been issued. The carrier generally returns the premium. Everything the policy would have covered disappears with it, which is why rescission is the most severe outcome available in an application dispute and the reason it is pursued relatively rarely.

In cyber the ground is almost always a material misrepresentation on the application. The carrier argues that it would not have issued the policy, or would not have issued it on those terms, had the answer been accurate.

How it works in a cyber policy

A carrier seeking rescission is generally required to show three things, and the details vary by state.

The statement was inaccurate. This is the easiest element on a cyber form, because control state is enumerable after the fact from logs and configuration.

The statement was material, meaning it would have changed the underwriting decision. Carriers evidence this with their own underwriting guidelines and with the referral rules that route a submission differently when an answer flips. A control that is a condition of quoting in the market, such as MFA on remote access, carries a strong materiality argument almost automatically.

The carrier relied on it. The incorporation clause on the application, which the signer attests to, is what supplies this element in most cyber policies.

Several states then add their own gloss. Some require the misstatement to have been knowing or fraudulent before a policy can be rescinded; some restrict the remedy where the carrier had the means to discover the truth and did not look. There is no contestability period here: that is a life and health concept and US commercial cyber forms do not carry one. The nearest equivalents are negotiated rather than statutory, in the form of a severability of application clause, which confines the consequences of an inaccurate answer to the person who knew it was inaccurate rather than imputing it to every insured, or a non-rescindable endorsement, which removes the remedy altogether. Both are worth asking a broker about; neither appears by default. This is why a general statement about what happens is worth less than a specific one about your own wording and governing law.

What these two disputes actually show

Two US disputes are cited constantly in this area, and both are cited more confidently than the record supports. It is worth being precise about what each one actually decided, because the difference changes how much weight the answer on your form carries.

Columbia Casualty Co. v. Cottage Health System. Columbia Casualty, a CNA unit, had issued a NetProtect360 policy to a Southern California hospital group that, according to the complaint and contemporaneous reporting, experienced a 2013 exposure of roughly 32,500 patient records. Columbia agreed to fund a $4.125 million class settlement under a complete reservation of rights, then sued for a declaration that it owed neither defence nor indemnity and for reimbursement of everything it had paid or would pay. Its theory rested on the application. Columbia's complaint alleged that Cottage had completed a Risk Control Self Assessment answering yes to a series of security questions, and that those answers were false. Cottage did not concede the allegations, and no federal court ruled on them. The complaint pleads two separate hooks for that theory: a Minimum Required Practices exclusion barring loss arising out of "[a]ny failure of an Insured to continuously implement the procedures and risk controls identified in the Insured's application," and, in the conditions, a matching requirement that the insured "warrants, as a condition precedent to coverage under this Policy," that it shall "maintain all risk controls identified in the Insured's Application." The same set of answers was therefore wired into the policy twice, once as an exclusion and once as a condition precedent.

The court never reached whether the answers were false. On 17 July 2015 it dismissed the case without prejudice. The policy sent all disputes to an alternative dispute resolution process and, where mediation was the chosen method, barred any judicial proceeding until the mediation had terminated and sixty days had passed. Columbia sued without doing that, and the court held the failure to exhaust was clear on the face of the complaint and dismissed under Rule 12(b)(6), noting that Columbia had not argued it would be prejudiced by dismissal rather than a stay. The carrier's own suit was ended by a procedural precondition in its own policy.

Columbia refiled on 31 May 2016 and that action reached the merits no more than the first. On 2 December 2016 the court granted the insured's motion in part and stayed the case in favour of a parallel coverage action in the Santa Barbara County Superior Court, placing it on the inactive calendar. Columbia appealed the stay to the Ninth Circuit, No. 16-56872. The stay was continued through 2017, and on 25 January 2018 Columbia stipulated to dismissal under Rule 41(a)(1)(A)(i) in favour of the state proceeding; the appeal was dismissed by stipulation the following day. No federal court ever ruled on whether the self assessment answers were false or material. The dispute itself carried on in the state court, so what the federal docket establishes is that no federal judge decided the question, not that the question went undecided.

Travelers Property Casualty Co. of America v. International Control Services, Inc.. Travelers alleged that the insured, an Illinois electronics manufacturer, had suffered a ransomware incident on a server that was not protected by multi-factor authentication. Those allegations were never tested; the case ended by stipulation before any finding of fact. Travelers alleged that the misstatement was made not in the body of the application but on a separate signed Multi-Factor Authentication Attestation dated 10 March 2022, a standalone one-page document of the kind that is now market standard, on which the applicant answered yes to enterprise-wide, remote-access, and internal privileged-access MFA. Travelers pleaded that MFA in fact protected only the firewall, and sought rescission on the ground that the misstatement materially affected its acceptance of the risk. On 30 August 2022 the court granted an agreed motion: the policy was declared null and void from its inception, no coverage was available to any person or entity under it, and the case was dismissed with prejudice. The order itself records only that Travelers "asserts" the statements were incorrect; it makes no finding that they were.

That outcome is often described as a court holding that a wrong MFA answer voids a policy. It is not. It is a policyholder agreeing not to contest rescission. What the record does show is that a carrier was willing to spend litigation money to unwind a policy over one application answer, and that the policyholder chose to stipulate rather than litigate. The stipulation records no reason, and no admission should be inferred from it.

What this means for the answer you are about to sign

The asymmetry is what makes rescission worth managing rather than worrying about. A carrier does not need to prove your entire security programme was misdescribed. It needs one material answer that the incident report contradicts. Meanwhile, the answer that would have avoided the whole argument was usually available to you for free at signing time, from a system you already own.

The practical hedge is a dated record. If you can show that on the day you signed, a dated reading of the environment matched the coverage you claimed, you are no longer arguing about memory. You are arguing from evidence, and a carrier that wants to rescind now has to dispute a measurement rather than an assertion. This is also why a measurement taken once at renewal is weaker than a continuous one: policies increasingly carry ongoing conditions, and control drift between renewals is invisible until somebody looks.

Where the evidence for that answer lives

The answers that most often become rescission arguments are the ones a live read settles cleanly: multi-factor coverage across email, remote access, and privileged accounts; backup immutability and restore testing; endpoint detection coverage; and the claims and circumstances questions, where accuracy is a matter of disclosure rather than configuration.

Frequently asked

What is rescission in cyber insurance?

Rescission is an insurer's remedy that treats the policy as void from inception rather than cancelled going forward, usually sought on the ground that a material misstatement appeared on the application. The premium is generally returned and coverage disappears for all claims under the policy, not only the one in dispute. Whether a rescission succeeds depends on materiality, the policy wording, and the law of the governing state.

How is rescission different from a claim denial?

A denial refuses one claim and leaves the policy standing for everything else. Rescission removes the policy itself, retroactively, so other claims under it fall away too. Carriers sometimes plead both, seeking rescission and arguing in the alternative that the claim is not covered.

Has a US court ever rescinded a cyber policy over an MFA answer?

A federal court in the Central District of Illinois entered judgment rescinding a cyber policy in the Travelers v. International Control Services matter in August 2022, but by stipulation of the parties rather than after a contested ruling. The policyholder agreed to the rescission. That is meaningfully different from a court deciding the question on the merits.

Is the premium returned?

Rescission generally involves returning the premium, since the remedy treats the contract as never having existed. Returned premium is a small figure set against an uncovered ransomware loss.

Can rescission reach a claim the carrier already paid?

That is exactly what a carrier pursuing reimbursement is trying to do. In the Cottage Health matter the insurer sued to recover the $4.125 million it said it had spent settling the underlying class action. The court dismissed that suit on a procedural ground without deciding whether the recovery was available.

Sources

Every statement about a court case on this page is drawn from the documents and reporting below. Links open on the publisher's own site.

• Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432 (C.D. Cal.), docket CourtListener, RECAP
• Columbia Casualty complaint filed 7 May 2015, pleading the Risk Control Self Assessment, the Minimum Required Practices exclusion and the matching condition precedent (docket entry 1) CourtListener, RECAP
• Order granting the motion to dismiss for failure to exhaust the policy’s alternative dispute resolution clause, entered 17 July 2015 (docket entry 22) CourtListener, RECAP
• Columbia Casualty Co. v. Cottage Health System, No. 2:16-cv-03759 (C.D. Cal.), refiled action docket: stayed 2 December 2016, dismissed by stipulation 25 January 2018 CourtListener, RECAP
• Cyber insurer seeks to void data breach coverage because of purported misstatements in policy application (16 June 2016) Covington, Inside Privacy
• Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145 (C.D. Ill.), docket CourtListener, RECAP
• Order granting the agreed motion for rescission and dismissal, entered 30 August 2022 (docket entry 5) CourtListener, RECAP
• Travelers complaint filed 6 July 2022, pleading the application and the signed MFA attestation (docket entry 1) CourtListener, RECAP
• Travelers, policyholder agree to void current cyber policy (30 August 2022) Insurance Journal
• Travelers v. ICS underscores need to respond carefully to cyber insurance application questions (15 September 2022) Lockton

Full captions: Columbia Casualty Co. v. Cottage Health System, No. 2:15-cv-03432-DDP-AGR (C.D. Cal., filed 7 May 2015, dismissed without prejudice 17 July 2015 by Pregerson, J.), refiled as No. 2:16-cv-03759-JAK-AGR (C.D. Cal., filed 31 May 2016, stayed 2 December 2016 by Kronstadt, J., dismissed by stipulation 25 January 2018); Travelers Property Casualty Co. of America v. International Control Services, Inc., No. 2:22-cv-02145-CSB-EIL (C.D. Ill., Urbana Division, filed 6 July 2022, agreed order of rescission and dismissal entered 30 August 2022 by Bruce, J.). Every docket and filing cited below is linked directly.

Sources are cited only for the facts attributed to them. The publishers listed are unaffiliated with Insurance Posture and SecValley, have not reviewed or endorsed this page, and their inclusion implies no relationship.

Related terms

Back to the glossary