A federal judge in Dallas read HSB Specialty's ransomware endorsement word by word, found it capped a coverage it never named, and freed CiCi's loss into a $3 million tower — with a bad-faith trial still waiting.
On February 23, 2026, Judge Sam A. Lindsay of the Northern District of Texas ruled that the ransomware endorsement HSB Specialty wrote into CiCi Enterprises' cyber policy "contains no explicit language subjecting Insuring Agreement D. Cyber Extortion to the sub-limit." If the carrier "intended for the Ransomware Endorsement to modify 'Cyber Extortion' coverage," Lindsay wrote, "[it] should have included language in the endorsement to that effect." That holding gutted the only number HSB had been fighting to enforce.
The number was $250,000.
HSB Specialty Insurance Company had spent the litigation insisting that figure was the ceiling. The endorsement, the carrier argued, capped what it owed on the ransomware claim no matter how large the loss ran. Lindsay read the same endorsement and found a hole in it. The clause limited liability "solely with respect to the coverage afforded under this endorsement." Then it never said what coverage that was. An endorsement that caps an unnamed thing caps nothing. The judge would not supply the words the drafter left out.
So the cap fell. And once it fell, the math changed completely.
Go back to what happened to CiCi. The attack hit on May 21, 2022. Ransomware locked the company's systems. The attackers opened at $2 million. CiCi negotiated them down and paid $400,000 to get its data back. By the time the dust settled the total loss ran past $1.2 million. CiCi turned to the cyber policy it had bought for exactly this kind of day.
The policy carried a $3 million aggregate limit. Four insuring agreements sat inside it. Information Privacy. Network Security. Business Interruption. Cyber Extortion. The extortion coverage is the one that answers a ransomware demand. CiCi had it. CiCi had paid for it. The tower was three million dollars deep.
Then HSB pointed at the ransomware endorsement and said the real number was $250,000.
That is the gap the case turned on. A $250,000 sub-limit against a loss north of $1.2 million inside a $3 million tower. Roughly $950,000 hung on whether one endorsement reached one insuring agreement. The carrier said it did. The policyholder said the endorsement never named the coverage it claimed to shrink. Lindsay sided with the policyholder.
Read the holding again, because the reasoning is the whole story. Lindsay did not rule that ransomware coverage is unlimited. He did not rewrite the contract in CiCi's favor. He ruled on what the page in front of him actually said. The endorsement modified coverage "solely with respect to the coverage afforded under this endorsement," and the endorsement was silent on what that coverage was. A cap needs an object. This one floated free. The judge declined to attach it to Cyber Extortion by inference. The drafter could have written the link in one sentence. The drafter did not. The court would not write it for them.
Join 1,847 litigation leaders who get weekly intelligence on strategy, technology, and the data that matters.
This is why coverage lawyers are calling the ruling first of its kind. Sub-limits inside cyber towers are everywhere. They sit on the page in dense endorsement language that almost no insured reads and almost no carrier expects a court to parse word by word. Lindsay parsed it word by word. He treated the endorsement as a contract that has to say what it means, not a label that means whatever the carrier needs it to mean in litigation. The $250,000 ceiling was real on paper right up until a federal judge asked it what coverage it was capping. It had no answer.
The carrier's whole defense ran through that ceiling. Knock it out and the structure behind it changes shape. CiCi's loss now reaches into a $3 million tower instead of stopping at a quarter million. The ransom payment alone, $400,000, already clears the sub-limit HSB tried to enforce. Everything past it that the company can prove now lives inside the real limit. The carrier spent the case defending a wall. The judge found the wall was painted on.
The coverage ruling is not the end of CiCi Enterprises v. HSB Specialty Insurance Company, No. 3:23-CV-2155-L. It is the opening. The sub-limit fight was the threshold question. CiCi also pleaded breach of contract. CiCi pleaded violations of the Texas Insurance Code. And CiCi pleaded bad faith. Those claims did not go away when Lindsay construed the endorsement. They are still live. They are heading for a jury.
That reordering matters. When the sub-limit stood, HSB had a clean story for trial. We paid what the policy said. The cap was the cap. Our reading was reasonable, and a reasonable reading is not bad faith. The whole defense leaned on the endorsement doing what the carrier claimed it did. Lindsay just held it did not. The carrier capped a $1.2 million loss at $250,000 on the strength of language a federal court found did not even name the coverage it was capping. A jury in Texas gets to decide what that was.
That is the cliffhanger. Trial is targeted for fall 2026. Lindsay pushed both sides toward settlement, setting a March 6 marker on the calendar to talk. The talking did not end it. So the case marches toward a courtroom where the question is no longer what the endorsement meant. The judge answered that. The question becomes whether a carrier that read a sub-limit into coverage the sub-limit never named handled the claim in good faith.
The carrier has to walk into that room having already lost the coverage fight. The endorsement it built the denial on has been read against it on the record by the judge who will preside over the trial. Plaintiff's counsel will quote Lindsay's own words back to the jury. The endorsement "contains no explicit language subjecting Insuring Agreement D. Cyber Extortion to the sub-limit." A carrier that enforced a cap the court says was never there, on a loss five times the size of that cap, is a difficult client to defend on the question of good faith. The bad-faith claim does not need new facts. It feeds on the coverage ruling.
Step back and the timeline tells it plainly. May 2022, the attack. $400,000 out the door to the attackers. Past $1.2 million in total loss. A $3 million tower bought for this exact event. A $250,000 number the carrier swore was the ceiling. February 2026, a federal judge who reads the endorsement and finds it caps nothing. Fall 2026, a Texas jury that decides whether trying to enforce that ceiling was bad faith.
Two hundred fifty thousand on one side. A million two on the other. Three million in the tower behind it. The carrier bet the case on a single endorsement holding the line. The line was a sentence the drafter never finished.
CiCi paid the ransom in 2022. The carrier handed back $250,000 and called it the cap. A judge in Dallas read the page and said the cap was not on it. Now the only fight left is whether saying it was cost the carrier the right to say much of anything. That fight has a date. It is in the fall. And the carrier walks in down a point.
The Executive Briefing takes 2 minutes and shows you exactly where the gaps are.
Take the Executive Briefing →Join 1,847 litigation leaders who get weekly intelligence on strategy, technology, and the data that matters.