The debate here is whether it was a covered claim or not.
A reasonable person would certainly think that a policy sold as cyber insurance would cover a cyber attack. And presumably a large multinational like Mondelez would have had the policy reviewed by their legal department before signing and paying the premiums.
So far as regulations - in the US standard types of policies (such as auto, home, etc.) are regulated by the states not the feds. A policy that isn't one of those likely has very few regulations around it. In which case the policy language (aka the contract) governs the relationship.
If Zurich wanted to limit the total damages, they should have put that in the policy. And then resell some of that risk to a reinsuror.
This is going to have to be settled in the courts. But in the meantime, I would be hesitant to purchase any cyber insurance from Zurich (or any other insuror) because of the uncertainty that a claim would be paid that this action introduces.
A reasonable person would certainly think that a policy sold as cyber insurance would cover a cyber attack. And presumably a large multinational like Mondelez would have had the policy reviewed by their legal department before signing and paying the premiums.
So far as regulations - in the US standard types of policies (such as auto, home, etc.) are regulated by the states not the feds. A policy that isn't one of those likely has very few regulations around it. In which case the policy language (aka the contract) governs the relationship.
If Zurich wanted to limit the total damages, they should have put that in the policy. And then resell some of that risk to a reinsuror.
This is going to have to be settled in the courts. But in the meantime, I would be hesitant to purchase any cyber insurance from Zurich (or any other insuror) because of the uncertainty that a claim would be paid that this action introduces.