Payroll Overpayments Were Not “Necessarily Incurred” and Thus Not Extra Expense Under Cyber Policy
An Illinois Appellate Court, applying Illinois law, has held that an insured’s payroll overpayment following a ransomware attack on the insured’s payroll service provider was not “necessarily incurred,” such that coverage was unavailable under the insured’s cyber policy because the insured’s overpayments did not fall within the policy’s definition of “extra expense.” Villa Fin. Servs., LLC v. Underwriters at Lloyd’s of London and Other Ins. subscribing to Policy No. ESK0339447455, 2025 WL 3278947 (Ill. App. Ct. Nov. 24, 2025).
The insured, a management care company for nursing care facilities, contracted with an outside vendor for payroll compliance services to pay the employees of those care facilities. The outside vendor sustained a ransomware attack. To meet its payroll obligations, the insured used data from prior payroll periods because it did not have access to its payroll records, which resulted in a payroll overpayment of approximately $1.2 million to the employees. The insured sought coverage for this amount under its cyber policy as “extra expense,” defined in the policy to mean “reasonable sums necessarily incurred . . . to mitigate an interruption to and continue your business operations.” The insurer denied coverage on the ground that the payroll overpayment was not “necessarily incurred” as required by the policy. The insured later filed suit against the insurer. The trial court granted the insurer’s motion for judgment on the pleadings, and the insured appealed.
The appellate court affirmed the trial court’s judgment, holding that it was not necessary for the insured to pay the employees more than they were owed in order to continue its business operations, and thus the payroll overpayment did not constitute “extra expense” under the policy. The appellate court determined that the only funds that were “necessary” for the insured to pay were those actually earned by the employees. By contrast, the extra funds paid out by the insured were not “necessary” because the employees had not earned those amounts and the insured had no obligation to pay those amounts. The appellate court explained that there was no reasonable interpretation of the policy that could include coverage for payments made by the insured that the insured was not obligated to make. In so holding, the appellate court expressly declined to expand coverage beyond the policy language, noting that, while the insured may have felt that it had no choice but to pay the extra funds to meet its payroll obligations, the policy’s “extra expense” coverage was not intended to indemnify the insured for such expenditures.
