CiCi Enterprises LP v. HSB Specialty Insurance Company

Memorandum Opinion and Order - Page 1
IN THE UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF TEXAS
DALLAS DIVISION
CICI ENTERPRISES, LP, 	§
§
Plaintiff, 	§
§
v. 	§ 	Civil Action No. 3:23-CV-2155-L
§
HSB SPECIALTY INSURANCE
COMPANY,
§
§
§
§
Defendant. 	§
MEMORANDUM OPINION AND ORDER
Before the court are Defendant HSB Specialty Insurance Company (“HSB”)’s Motion for
Summary Judgment (Doc. 38), filed May 16, 2025; and Plaintiff CiCi Enterprises, LP (“CiCi”)’s
Motion for Partial Summary Judgment (Doc. 52), filed July 21, 2025.1 After careful consideration
of the motions, responses, replies, appendixes, record, and applicable law, the court denies HSB’s
Motion for Summary Judgment and grants CiCi’s Motion for Partial Summary Judgment.
I. 	P rocedural and Factual Background
This is an insurance dispute regarding whether CiCi’s covered loss under a cyber insurance
policy issued by HSB is subject to a sub-limit endorsement, which caps HSB’s maximum liability
at $250,000.2 An understanding of the malware attack giving rise to CiCi’s claim for coverage,
1 Although Plaintiff CiCi Enterprises, LP titles its motion as a “Motion for Summary Judgment,” it is a
motion for partial summary judgment, as Plaintiff is only moving for summary judgment on its request for
declaratory relief, but not on its remaining claims. Accordingly, the court will refer to the motion as CiCi’s
“Motion for Partial Summary Judgment.” HSB, on the other hand, is moving for summary judgment as to
all of CiCi’s claims.
2 The court draws its factual account from the summary judgment evidence and briefing, and it sets forth
the facts in accordance with the standard in Section II of this opinion. The facts are undisputed except as
otherwise noted.
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 1 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 2
HSB’s coverage decision, and the relevant provisions of the cyber insurance policy are required to
resolve the pending Motions.
A. The Malware Attack, the Losses, and the Claim
On May 21, 2022, CiCi suffered a malware attack during which a threat actor encrypted
CiCi’s computer systems and threatened to publish exfiltrated data if its ransom demand was not
paid. Doc. 40-4, Def.’s App. 96.3 At the time, CiCi was insured under Cyber Insurance Policy No.
6613789-01 (the “Policy”), issued by HSB with effective dates of October 16, 2021, through
October 16, 2022. Doc. 40-2, Def.’s App. 3-87.
Following the malware attack, Cici sent an e-mail to At-Bay Insurance Services, LLC (“At-
Bay”)—HSB’s agent for receiving notice of claims—that advised, “We just had a major
cyberattack and all our IT systems are offline. Appears to be a Ransomware attack.” Doc. 40-5,
Def.’s App. 98. With At-Bay’s approval, CiCi engaged a law firm and Arete Advisors to provide
incident response services (including a breach investigation), and to initiate negotiations with the
threat actor, whom Arete Advisors later identified as LV. Doc. 40-8, Def.’s App. 103. Although
the initial demand to release the encrypted files was $2,000,000, Arete Advisors reached an
agreement with LV for a $400,000 payment. Doc. 40-8, Def.’s App. 103.
On June 10, 2022, HSB issued a coverage letter in which it acknowledged that “this matter
triggers the initial scope of coverage under the Policy as outlined below.” Doc. 40-8, Def.’s App.
102. HSB states that the Policy “provides an initial $3,000,000.00 annual aggregate for
Information privacy, Network Security, Business Interruption, Cyber Extortion, Financial Fraud,
Media Content, and Reputational Harm subject to a $50,000.00 retention.” Doc. 40-8, Def.’s App.
3 Citations to the record and briefs refer to the page numbers at the bottom of the appendices and briefs,
rather than the CM/ECF page number at the top of each page. “Def.’s App.” refers to the “Appendix in
Support of Defendant HSB Specialty Insurance Company’s Motion for Summary Judgment.”
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 2 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 3
103. The coverage letter goes on to state that CiCi’s claim triggered coverage under four separate
“Insuring Agreements: A. Information Privacy, B. Network Security, C. Business Interruption,
and D. Cyber Extortion.” Doc. 40-8, Def.’s App. 103. With respect to Insuring Agreement D.
Cyber Extortion, the coverage letter states: “This event also constitutes an Extortion Threat under
Insuring Agreement D. Cyber Extortion. Accordingly, coverage is available for the Extortion
Loss incurred by CiCi as a direct result of the Extortion Threat first discovered during the Policy
Period.” Doc. 40-8, Def.’s App. 104.
HSB’s cover letter, however, also stated:
Here, based on the facts currently known, the Cyber Event suffered by CiCi
specifically 	constitutes 	a 	Ransomware 	Event, 	as 	defined 	by 	the 	Policy’s
Ransomware 	Event 	Sub-Limit 	Endorsement, 	which 	includes 	any 	related
Information Privacy Event, a related Network Security Event, and a related
System Disruption. Pursuant to the Ransomware Event Sub-Limit Endorsement,
our maximum liability, and the most we [s]hall pay for any Loss, Damages, and
Claims Expenses incurred by the Insured Organization resulting from a single
Ransomware Event shall be $250,000.00.
Doc. 40-8, Def.’s App. 105-06.
B. The Relevant Policy Language
Because the resolution of the instant dispute turns almost exclusively on the Policy’s
language, the court summarizes the Policy provisions in play. Like the parties, the court uses bold
type for terms defined in the Policy.
The Declarations Page of the Policy includes an “Aggregate Limit of Insurance” in the
amount of $3,000,000 (subject to a $50,000 retention) and, in Item 6, lists seven Insuring
Agreements and the Sub-Limits of Insurance. Doc. 40-2, Def.’s App. 6-8. The seven Insuring
Agreements are Information Privacy Liability; Network Security; Business Interruption; Cyber
Extortion; Financial Fraud; Media Content; and Reputational Harm. Doc. 40-2, Def.’s App. 7-8.
Per the Declarations Page, each Insuring Agreement has a sub-limit of insurance in the amount of
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 3 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 4
$3,000,000, with the exception of certain categories of Financial Fraud with a sub-limit of
$250,000. Doc. 40-2, Def.’s App. 6-7.
Section I of the Policy, titled “Insuring Agreements,” lists seven Insuring Agreements
based on the type of loss experienced and the type of damages claimed, and provides, in pertinent
part, that:
Coverage is afforded pursuant to those Insuring Agreements included under this Policy,
displayed as “Included” in ITEM 6 of the Declarations, and for Claims and Cyber Events
reported to us pursuant to the terms of this Policy:
A. INFORMATION PRIVACY
1. 	Information Privacy Liability
We shall pay on behalf of the Insured, all Claim Expenses and Damages resulting
from a Claim first made against any Insured during the Policy Period or, if
exercised, during the Extended Reporting Period, for an Information Privacy
Wrongful Act.
. . . .
3. Event Response and Management
We shall pay the Insured Organization for Technical Response Loss, Legal
Services Loss, Public Relations Loss, Notification Loss, Reward Expense Loss,
and Credit Monitoring Loss incurred by the Insured Organization as a result of
an Information Privacy Event first discovered during the Policy Period.
. . . .
B. NETWORK SECURITY
1. Network Security Liability
We shall pay on behalf of the Insured, all Claim Expenses and Damages resulting
from a Claim first made against any Insured during the Policy Period or, if
exercised, the Extended Reporting Period, for a Network Security Wrongful Act.
2. 	Event Response and Recovery
We shall pay the Insured Organization for Technical Response Loss, Legal
Services Loss, Public Relations Loss, Notification Loss, Reward Expense Loss,
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 4 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 5
and Credit Monitoring Loss incurred by the Insured Organization as a result of
a Network Security Event first discovered during the Policy Period.
. . . .
D. CYBER EXTORTION
1. 	Cyber Extortion
We shall pay the Insured Organization for Extortion Loss, Reward Expense
Loss, and Public Relations Loss incurred by the Insured Organization as a direct
result of an Extortion Threat first discovered during the Policy Period.
Doc. 40-2, Def.’s App. 13-14.
Section II.A of the Policy, titled “Limits of Insurance” provides that the “Aggregate Limit
of Insurance is our maximum liability under this Policy for the duration of the Policy Period or,
if exercised, the Extended Reporting Period.” Doc. 40-2, Def.’s App. 15. Section II.B of the Policy
sets out the sub-limits of insurance, as follows:
B. SUB-LIMITS OF INSURANCE
1. The amounts stated as Sub-Limits of Insurance in ITEM 6 of the Declarations,
which are part of and not in addition to the Aggregate Limit of Insurance, are the
most we shall pay for all Loss, Damages, and Claims Expenses with respect to the
Insuring Agreement to which each Sub-Limit of Insurance applies, and we shall not
be responsible to pay any Loss, Damages, or Claims Expenses under such Insuring
Agreement upon exhaustion of such Sub-Limit of Insurance.
Doc. 40-2, Def.’s App. 15.
Section V of the Policy, titled “Definitions,” includes the following definitions, among
others:
. . . .
15. Cyber Event means an Information Privacy Event, Network Security Event,
Extortion Threat, Fraudulent Inducement Instructions, Computer Crimes, System
Disruption, and, with respect to Insuring Agreement I.F.2. only, a Media Wrongful Act.
. . . .
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 5 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 6
21. Extortion Loss means reasonable and necessary costs and expenses incurred or paid
by an Insured Organization to:
a. make payment of any funds, digital currencies (“crypto-currencies”), marketable
goods, services, or other assets to the person or group which is believed to be
responsible for, and to have made, such Extortion Threat;
b. reduce or mitigate the severity of Extortion Loss described in paragraph V.21.a.
above; and
c. retain the services of a Cyber Response Firm to provide consultative and
professional services related to Extortion Loss described in paragraphs V.21.a. and
V.21.b. above.
22. Extortion Threat means any credible threat or series of related threats made to an
Insured by a third party person or group, or by a rogue Employee who is not a member of
the Control Group and who is acting in a manner not authorized by the Insured
Organization, which threatens to take any of the following actions unless an Insured pays
such group or person the funds demanded, or meet some other non-monetary demand, in
exchange for the mitigation or removal of such threat:
a. cause an Information Privacy Event or Network Security Event;
b. alter, corrupt, damage, manipulate, misappropriate, encrypt, delete, or destroy
any Computer System, Corporate Data, or Protected Personal Information;
c. restrict or inhibit access to a Computer System; or
d. any action connected to the continuation or furthering of any already commenced
action referenced in paragraphs V.22.a.-V.22.c. above.
Doc. 40-2, Def.’s App. 20-23.
The Policy also contains certain applicable endorsements, which change or modify the
terms and conditions of the policy. For example, the Policy contains the Am Wins Amendatory
Endorsement, which provides in relevant part:
. . . .
4) Section I. Insuring Agreements, D. Cyber Extortion, item 1. Cyber Extortion, is deleted
and replaced with the following:
1. 	Cyber Extortion
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 6 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 7
We shall pay the Insured Organization for, or pay on behalf of the Insured
Organization, all Extortion Loss, Reward Expense Loss, and Public Relations
Loss incurred by the Insured Organization as a direct result of an Extortion
Threat first discovered during the Policy Period.
. . . .
Doc. 40-2, Def.’s App. 55-56.
Finally, the Policy contains a Ransomware Event Sub-Limit Endorsement (“Ransomware
Sub-Limit Endorsement” or “Endorsement”), which provides as follows:
Ransomware Event Sub-Limit Endorsement
In consideration of the premium charged, it is agreed that the Policy is amended as follows:
1) The following is added to section II. Limits of Insurance:
Solely with respect to the coverage afforded under this endorsement, our maximum
liability, and the most we shall pay for all Loss, Damages, and Claims Expenses
incurred by the Insured Organization resulting from any single Ransomware
Event shall be:
a) 250000.
Furthermore, the amount set forth directly above, in item 1)a) of this endorsement,
will in no way serve to increase our liability under this Policy and shall be part of,
and not in addition to, the Aggregate Limit of Insurance.
2) The following is added to section V. Definitions:
Ransomware Event means the Insured Organization’s receipt of a credible threat
or series of related threats first discovered during the Policy Period, and such
threats are made by a third party through the use of any malicious software or
computer code, which threatens to take any of the following actions unless an
Insured pays such third party the funds demanded, or meet some other non-
monetary demand, in exchange for the mitigation or removal of such threat:
a) 	cause an Information Privacy Event or Network Security Event;
b) alter, corrupt, damage, manipulate, misappropriate, encrypt, delete, or destroy
any Computer System, Corporate Data, or Protected Personal Information;
c) restrict or inhibit access to a Computer System; or
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 7 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 8
d) any action connected to the continuation or furthering of any already commenced
action referenced in paragraphs 2)a)-c) above.
Ransomware 	Event 	includes 	any 	related 	Information 	Privacy 	Event,
Information 	Privacy 	Wrongful 	Act, 	Network 	Security 	Event, 	Network
Security Wrongful Act, or System Disruption resulting from such threat or series
of threats described above. However, Ransomware Event shall not include and
this endorsement shall not apply to any Ransomware Event that originates solely
from a malicious attack against a third party owner or operator of External
Computer Systems.
3) Section V. Definitions. 15. Cyber Event, is deleted and replaced with the following:
Cyber Event means an Information Privacy Event, Network Security Event,
Extortion Threat, Fraudulent Inducement Instructions, Computer Crimes,
System Disruption, Ransomware Event, and, with respect to Insuring Agreement
I.F.2. only, a Media Wrongful Act.
All other terms, conditions, and exclusions to the Policy shall remain unchanged.
Doc. 40-2, Def.’s App. 86-87.
C. The Instant Litigation
Following HSB’s coverage determination, CiCi filed this action. See generally Doc. 1,
Orig. Compl. In the Second Amended Complaint, the live pleading, CiCi alleges that it incurred
over $1,200,000 in losses as a result of the cyber event. Doc. 29, Sec. Am. Compl. ¶ 5.1. CiCi
asserts the following claims against HSB: (1) a declaratory judgment claim, asking the court (a) to
declare that the Ransomware Sub-Limit Endorsement does not modify coverage for “Cyber
Extortion” or “Extortion Threat” and does not apply to CiCi’s claims by the plain terms of the
endorsement or, alternatively, (b) to declare that the Ransomware Sub-Limit Endorsement is
ambiguous and should be construed in favor of coverage and in the light most favorable to CiCi;
and (c) to declare that the $3,000,000 policy limits are available to cover its losses under either
alternative;4 (2) a breach-of-contract claim; (3) a claim for violations of various provisions of the
4 The federal Declaratory Judgment Act provides that, “[i]n a case of actual controversy within its
jurisdiction, . . . any court of the United States, upon the filing of an appropriate pleading, may declare the
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 8 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 9
Texas Prompt Payment of Claims Act (TPPCA), Tex. Ins. Code § 542.001, et seq.; and (4) a claim
for violations of various provisions of the Texas Unfair Competition and Unfair Practices Act,
Tex. Ins. Code § 541.001, et seq. Doc. 29, Sec. Am. Compl. ¶¶ 8.1–8.8; 9.1–9.2; 10.1–10.6; 11.1–
11.5.
In its Answer, HSB asserts that CiCi’s claims are barred because it promptly, thoroughly,
and fairly investigated, evaluated, and adjusted CiCi’s claim in strict accordance with the Policy
and applicable law. See generally Doc. 32, Def.’s Am. Ans. and Affirmative Defenses.
On May 16, 2026, HSB filed its Motion for Summary Judgment, seeking summary
judgment as to all of CiCi’s claims against it. See Doc. 38, Def.’s Mot. 1-2. On July 21, 2025, CiCi
filed a Motion for Partial Summary Judgment, seeking summary judgment as to its declaratory
judgment claim only. See Doc. 52, Pl.’s Mot. 1-2. CiCi’s Motion, although not denominated as
such, is, in effect, a cross-motion for partial summary judgment as to its declaratory judgment
claim. The Motions have been fully briefed and are ripe for review.
II. 	Legal Standards
A. Summary Judgment
Summary judgment shall be granted when the record shows that there is no genuine dispute
as to any material fact and that the moving party is entitled to judgment as a matter of law. Fed. R.
Civ. P. 56(a); Celotex Corp. v. Catrett, 477 U.S. 317, 323-25 (1986); Ragas v. Tennessee Gas
Pipeline Co., 136 F.3d 455, 458 (5th Cir. 1998). A dispute regarding a material fact is “genuine”
if the evidence is such that a reasonable jury could return a verdict in favor of the nonmoving party.
rights and other legal relations of any interested party seeking such declaration, whether or not further relief
is or could be sought.” 28 U.S.C. § 2201(a). The Fifth Circuit has held that, under Erie principles, the Texas
Declaratory Judgment Act is procedural and thus not applicable in federal court. See Utica Lloyd’s of Tex.
v. Mitchell, 138 F.3d 208, 210 (5th Cir. 1998); Camacho v. Texas Workforce Comm’n, 445 F.3d 407, 413
(5th Cir. 2006). Cici’s claims are necessarily brought under the federal Declaratory Judgment Act.
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 9 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 10
Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). When ruling on a motion for summary
judgment, the court is required to view all facts and inferences in the light most favorable to the
nonmoving party and resolve all disputed facts in favor of the nonmoving party. Boudreaux v.
Swift Transp. Co., Inc., 402 F.3d 536, 540 (5th Cir. 2005). Further, a court “may not make
credibility determinations or weigh the evidence” in ruling on a motion for summary judgment.
Reeves v. Sanderson Plumbing Prods., Inc., 530 U.S. 133, 150 (2000); Anderson, 477 U.S. at 254-
55.
Once the moving party has made an initial showing that there is no evidence to support the
nonmoving party’s case, the party opposing the motion must come forward with competent
summary judgment evidence of the existence of a genuine dispute of material fact. Matsushita
Elec. Indus. Co. v. Zenith Radio, 475 U.S. 574, 586 (1986). On the other hand, “if the movant
bears the burden of proof on an issue, either because he is the plaintiff or as a defendant he is
asserting an affirmative defense, he must establish beyond peradventure all of the essential
elements of the claim or defense to warrant judgment in his favor.” Fontenot v. Upjohn Co., 780
F.2d 1190, 1194 (5th Cir. 1986) (emphasis in original). “[When] the record taken as a whole could
not lead a rational trier of fact to find for the nonmoving party, there is no ‘genuine [dispute] for
trial.’” Matsushita, 475 U.S. at 587 (citation omitted). Mere conclusory allegations are not
competent summary judgment evidence and thus are insufficient to defeat a motion for summary
judgment. Eason v. Thaler, 73 F.3d 1322, 1325 (5th Cir. 1996). Unsubstantiated assertions,
improbable inferences, and unsupported speculation are not competent summary judgment
evidence. See Forsyth v. Barr, 19 F.3d 1527, 1533 (5th Cir. 1994).
The party opposing summary judgment is required to identify specific evidence in the
record and to articulate the precise manner in which that evidence supports his or her claim. Ragas,
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 10 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 11
136 F.3d at 458. Rule 56 does not impose a duty on the court to “sift through the record in search
of evidence” to support the nonmovant’s opposition to the motion for summary judgment. Id.; see
also Skotak v. Tenneco Resins, Inc., 953 F.2d 909, 915-16 & n.7 (5th Cir. 1992). “Only disputes
over facts that might affect the outcome of the suit under the governing laws will properly preclude
the entry of summary judgment.” Anderson, 477 U.S. at 248. Disputed fact issues that are
“irrelevant and unnecessary” will not be considered by a court in ruling on a summary judgment
motion. Id. If the nonmoving party fails to make a showing sufficient to establish the existence of
an element essential to its case and on which it will bear the burden of proof at trial, summary
judgment must be granted. Celotex, 477 U.S. at 322-23.
B. Interpretation of Insurance Policies under Texas Law
As CiCi has invoked the court’s diversity jurisdiction, Texas law governs. See Kinsale Ins.
Co. v. Flyin’ Diesel Performance & Offroad, L.L.C., 99 F.4th 821, 826 (5th Cir. 2024) (“Kinsale’s
declaratory action arises under our diversity jurisdiction, see 28 U.S.C. § 1332(a)(1), and Texas
law provides the applicable rule of decision, see 28 U.S.C. § 1652.”); Empire Fire and Marine Ins.
Co. v. Brantley Trucking, Inc., 220 F.3d 679, 680-81 (5th Cir. 2000) (“Before us is an appeal from
a declaratory judgment action in which federal jurisdiction was based on the parties’ diversity of
citizenship, thus per Erie, Texas law applies.”).
“Under Texas law, ‘[i]nsurance policies are controlled by rules of interpretation and
construction which are applicable to contracts generally.’” Kinsale Ins., 99 F.4th at 826 (quoting
National Union Fire Ins. Co. of Pittsburgh v. CBI Indus., Inc., 907 S.W.2d 517, 520 (Tex. 1995)
(per curiam) (original brackets)). “The goal of contract construction is to ascertain the parties’
intent as expressed in the language of the agreement.” Rosetta Res. Operating, LP v. Martin, 645
S.W.3d 212, 218 (Tex. 2022) (citation omitted). To that end, the court must “first determine
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 11 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 12
whether it is possible to enforce the contract as written, without resort to parole evidence.” Mosaic
Baybrook One, L.P. v. Simien, 674 S.W.3d 234, 257 (Tex. 2023) (internal quotation marks and
citation omitted). “Thus, the ‘analysis begins with the contract’s express language.’” Kinsale Ins.,
99 F.4th at 826 (quoting Burlington Res. Oil & Gas Co. v. Texas Crude Energy, LLC, 573 S.W.3d
198, 203 (Tex. 2019) (citation omitted)).
“Two interpretative principles, routinely applied by Texas state courts, guide [the court’s]
analysis of a contract’s express language[.]” Id. First, a contract’s terms must be given “their plain,
ordinary, and generally accepted meaning unless the instrument shows that the parties used them
in a technical or different sense.” Burlington Res. Oil & Gas, 573 S.W.3d at 203 (internal quotation
marks and citation omitted). Second, the court must “examine and consider the entire writing in
an effort to harmonize and give effect to all the provisions of the contract so that none will be
rendered meaningless.” Id. (internal quotation marks and citation omitted).
If its express language “lends itself to a clear and definite legal meaning, the contract is not
ambiguous and will be construed as a matter of law.” Mosaic, 674 S.W.3d at 257 (internal
quotation marks and citation omitted). “If, however, the language of a policy or contract is subject
to two or more reasonable interpretations after applying the pertinent rules of construction, it is
ambiguous.” Id. (internal quotation marks and citation omitted).5
“Texas courts construe the meaning of an ambiguous insurance contract in favor of the
insured.” Kinsale Ins., 99 F.4th at 827 (citing National Union Fire Ins. Co. of Pittsburgh v. Hudson
Energy Co., 811 S.W.2d 552, 555 (Tex. 1991)). “In particular, exceptions or limitations on liability
5 As recently noted by the Fifth Circuit, “‘Concluding that a legal instrument is insolubly ambiguous must
always come after a court has exhausted all the traditional tools of interpretation and still cannot reach a
definitive conclusion about the meaning conveyed by the text.’” Kinsale Ins. Co. v. Flyin’ Diesel
Performance & Offroad, L.L.C., 99 F.4th 821, 827 n.7 (5th Cir. 2024) (quoting U.S. Polyco, Inc. v. Texas
Cent. Bus. Lines Corp., 681 S.W.3d 383, 389 n.1 (Tex. 2023) (original emphasis in U.S. Polyco)).
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 12 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 13
are strictly construed against the insurer and in favor of the insured.” Id. (quoting Hudson Energy,
811 S.W.2d at 555 (citations omitted)). Thus, the court “must adopt the construction . . . urged by
the insured as long as that construction is not unreasonable, even if the construction urged by the
insurer appears to be more reasonable or a more accurate reflection of the parties’ intent.” Evanston
Ins. Co. v. ATOFINA Petrochems., Inc., 256 S.W.3d 660, 668 (Tex. 2008) (citation omitted).
Under Texas law, in a suit to recover under a contract of insurance, the insured bears the
initial burden of showing that there is coverage, while the insurer has the burden of proof as to any
avoidance or affirmative defense. See Guaranty Nat. Ins. Co. v. Vic Mfg. Co., 143 F.3d 192, 193
(5th Cir. 1998). The insured “bears the burden of proving that an exclusion or limitation applies.”
Mid-Continent Cas. Co. v. Bay Rock Operating Co., 614 F.3d 105, 114 (5th Cir. 2010) (citation
omitted). “Where, as here, parties have filed cross-motions for summary judgment, each motion
must be considered separately because each movant bears the burden of showing that no genuine
issue of material fact exists and that it is entitled to a judgment as a matter of law.” Playa Vista
Conroe v. Insurance Co. of the W., 989 F.3d 411, 414 (5th Cir. 2021) (quotation marks and citation
omitted).
III. 	Defendant’s Motion for Summary Judgment
HSB moves for summary judgment on all CiCi’s claims. With respect to Cici’s declaratory
judgment and breach of contract claims, HSB contends it is entitled to summary judgment because
(1) the Policy “unambiguously applies a $250,000 sub-limit to ‘Loss, Damages, and Claims
Expenses’ arising out of a Ransomware Event,” and (2) HSB “already paid CiCi $250,000
pursuant to the applicable sub[-]limit,” and “has fulfill[ed] its contractual obligations to CiCi.”
Doc. 38, Def.’s Mot. 2. As to CiCi’s claims alleging violations of the Texas Insurance Code, HSB
argues it is entitled to summary judgment because the parties’ disagreement over the application
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 13 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 14
of the Ransomware Sub-Limit Endorsement “represents a bona fide dispute, which does not rise
to the level of actionable bad faith under Texas common law or the Texas Insurance Code. Doc.
38, Def.’s Mot. 2.
A. Effect of Insurance Code Provisions Governing Surplus Lines Insurance
As a threshold matter, prior to considering HSB’s summary judgment motion, the court
must address an argument raised by CiCi in its response to HSB’s Motion. Specifically, CiCi
contends that HSB failed to comply with certain Texas insurance regulations governing surplus
lines insurance and, therefore, as an “unauthorized insurer,” is required to post a bond before the
court considers HSB’s Motion or any other pleading it files. See Doc. 41, Pl.’s Resp. Br. 11-14.
Analysis of CiCi’s argument requires a brief discussion of the nature of surplus lines
insurance. “Chapter 981 of the Texas Insurance Code governs surplus lines insurance.” Atlantic
Cas. Ins. Co. v. Primelending, A Plainscaptial Co., 2016 WL 1322235, at *4 (N.D. Tex. Apr. 5,
2016) (citing Tex. Ins. Code § 981.001). “Surplus lines insurance allows a person who seeks to
insure a Texas risk but is unable to obtain that insurance from a Texas-licensed insurer to seek the
insurance from an insurer who is not licensed in Texas but is an eligible surplus lines insurer.” 444
Utopia Lane, LLC v. Peleus Ins. Co., 2021 WL 8442023, at *4 n.2 (W.D. Tex. Sept. 9, 2021)
(citation omitted). “Because surplus lines insurance is a matter of public interest and a subject of
concern, Chapter 981 sets forth standards and safeguards to regulate this area of the market.” Id.
at *4 (cleaned up) (citation omitted). The Texas Supreme Court has noted that “the State’s effort
to protect the public interest in this area is almost entirely dependent on monitoring licensed
surplus lines agents.” Lexington Ins. Co. v. Strayhorn, 209 S.W.3d 83, 88 (Tex. 2006). Relevant
to the current dispute is section 981.004(a) of the Texas Insurance Code, which provides, in
pertinent part, that an “eligible surplus lines insurer may provide surplus lines insurance only if:
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 14 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 15
(1) the full amount of required insurance cannot be obtained, after diligent effort, from an insurer
authorized to write and actually writing that kind and class of insurance in” Texas. Tex. Ins. Code
§ 981.004(a).
CiCi asserts that HSB failed to comply with section 981.004(a) of the Texas Insurance
Code and, therefore, was an unauthorized insurer, required to post a bond before filing any
pleading pursuant to Texas Insurance Code § 101.353(a). See Doc. 42, Pl.’s Resp. Br. 11-13.
Section 101.353(a) provides that before an unauthorized insurer may file a pleading in a court
proceeding, the “insurer must deposit cash or securities or file a bond with good and sufficient
sureties approved by the court in an amount determined by the court as sufficient to pay any final
judgment that may be rendered in the proceeding.” Tex. Ins. Code § 101.353(a). CiCi requests the
court “deny HSB’s Motion for Summary Judgment and require it to file a bond in accordance with
§ 101.353(a) before considering any further pleading by HSB.” Doc. 41, Pl.’s Resp. Br. 14.
In reply, HSB contends that it is an “eligible surplus lines insurer” under the Texas
Insurance Code and, therefore, section 101.353(a) is not applicable. See Doc. 44, Def.’s Reply 2-
4. The court agrees. See https://www.sltx.org/insurers/eligible-insurer-list/eligible-insurers/ (last
visited on Feb. 20, 2026) (listing HSB as an eligible surplus lines insurer).
In any event, “[t]he insurance code provides that violations of chapter 981 do not affect
the enforceability of insurance policies by the parties unless the violations are ‘material and
intentional.’” Chandler Mgmt. Corp. v. First Specialty Ins. Corp., Vericlaim, Inc., 452 S.W.3d
887, 895 (Tex. App.—Dallas 2014, no pet.) (quoting Tex. Ins. Code § 981.005). CiCi fails to argue
or show that HSB engaged in any “material or intentional” violation of section 981.004(a) of the
Texas Insurance Code. Further, Chapter 981 provides that violations of the chapter may be
punished with sanctions described under Chapter 82. See Tex. Ins. Code § 981.006. Chapter 82, in
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 15 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 16
turn, authorizes the commissioner of insurance “to impose an administrative penalty, direct the
insurer to make restitution to a harmed Texas resident, or cancel or suspend an insurer’s
authorization to issue insurance in Texas. And nothing in the language of Chapter 981 reflects any
intent to create a private right of action.” Atlantic Cas. Ins., 2016 WL 1322235, at *4 (internal
citations and quotation marks omitted). Thus, any alleged non-compliance with Chapter 981 does
not affect HSB’s status as an eligible surplus lines insurer, nor does it prohibit HSB from enforcing
the policy. See Chandler Mgmt., 452 S.W.3d at 895.
For these reasons, the court rejects CiCi’s argument that “HSB is not entitled to file its
Motion for Summary Judgment without first posting a bond under Texas Insurance Code §
101.353(a).” Doc. 42, Pl.’s Resp. Br. 2. Alternatively, even if HSB was an unauthorized insurer
(which CiCi has not shown) and section 101.353(a) applied (which it does not), the court agrees
with HSB that, at this advanced stage in the litigation, CiCi is “precluded, estopped, or has
otherwise waived its right to argue that HSB is required to post a bond at the outset of the pleadings,
given the stage of litigation [in which] the parties now find themselves.” Doc. 44, Def.’s Reply 6.
Here, CiCi has litigated this matter for nearly two years, including filing joint motions with HSB
(see Doc. 36), without raising this argument, and will not be heard to raise it now.
B. CiCi’s Declaratory Judgment and Breach of Contract Claims
HSB moves for summary judgment with respect to CiCi’s claims for declaratory relief and
for breach of contract based on the same arguments. CiCi opposes the Motion. The court first
addresses the parties’ respective arguments.
1. 	The Parties’ Contentions
HSB’s argument is straightforward. Specifically, HSB contends that “[t]he Ransomware
Event Sub-Limit Endorsement limits coverage for claims arising from a Ransomware Event to
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 16 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 17
$250,000. Because the endorsement unambiguously applies to Cici’s claim, HSB is entitled to
summary judgement on Cici’s declaratory judgment and breach-of-contract claims.” Doc. 39,
Def.’s Summ. J. Br. 8. In further support, HSB states:
While Cici’s claim is covered by the Cyber Insurance Policy, the claim is subject
to a $250,000 sublimit for losses arising from a “Ransomware Event” as defined by
the Cyber Insurance Policy. The Cyber Insurance Policy clearly defines a
“Ransomware Event” as a type or subset of “Extortion Threat.” Specifically, if a
threat actor is a third-party and utilizes a “malicious software or computer code” to
threaten an insured, the threat qualifies as a “Ransomware Event” rather than an
“Extortion Threat” or “Cyber Extortion.” In this case, because it is undisputed that
a third-party threat actor used malicious code to encrypt Cici’s software and held it
for ransom, HSB properly determined that Cici suffered a “Ransomware Event”
and paid the $250,000 sublimit.
Doc. 38, Def.’s Mot. 1.
HSB also maintains that when the definition of Extortion Threat is compared with the
definition of Ransomware Event, “it is clear that ‘Ransomware Event’ is a type (or a subset) of
‘Extortion Threat’.” Doc. 39, Def.’s Summ. J. Br. 10. HSB posits there are “two key differences
between the two definitions.” Doc. 39, Def.’s Summ. J. Br. 10. First, whereas, “a Ransomware
Event requires that a third party use ‘malicious software or computer code’ to make a threat against
the insured[,] . . . an Extortion Threat can be any threat (it need not involve malicious software or
computer code).” Doc. 39, Def.’s Summ. J. Br. 10-11. Second, “an ‘Extortion threat’ can be made
by a third-party or rogue employee; whereas, a ‘Ransomware Event’ can only be caused by a third-
party.” Doc. 39, Def.’s Summ. J. Br. 11. HSB further argues that allowing Cici to avoid the
Ransomware Event Sub-Limit by characterizing its claim as a “Cyber Extortion” claim or as being
the result of an “Extortion Threat” would “write the Ransomware Event Sub-Limit Endorsement
completely out of the Policy.” Doc. 39, Def.’s Summ. J. Br. 11.
In response, CiCi argues that the Ransomware Sub-Limit Endorsement “does not apply on
its face under the endorsement’s plain language.” Doc. 42, Pl.’s Resp. Br. 16. In addition, CiCi
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 17 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 18
contends that “[a]s the drafter of the policy,” if HSB intended for a “Ransomware Event” to be a
considered a subset of “Extortion Threat,” HSB, as the drafter of the Cyber Insurance Policy,
“could have explicitly added such language in its definition of ‘Ransomware Event’ or ‘Extortion
Threat.’ However, that is not the case in the Ransomware Endorsement.” Doc. 42, Pl.’s Resp. Br.
29 (citations omitted). Alternatively, CiCi contends that, in the event the court finds the
Ransomware Sub-Limit Endorsement to be ambiguous, the language “should be read in Plaintiff’s
favor.” Doc. 42, Pl.’s Resp. Br. 23.
In reply, HSB contends, among other things, that:
[I]t is clear that under the Policy there was express intent for all covered
Ransomware Events to be subject to the limit of liability referred to above of
$250,000. Indeed, the Policy’s intent is glaringly obvious and Plaintiff’s main
contention arguing to the contrary, seems to stem from the fact that the Policy so
clearly states that the Endorsement applies to all insuring agreements. With
Plaintiff’s argument that the Policy should state specifically to which insuring
agreement 	it 	applies 	being 	completely 	redundant 	when 	the 	terms 	of 	the
endorsement make it clear where it applies -- that is across the Policy.
Doc. 44, Def.’s Reply 8-9.
2. 	Discussion
Like HSB, the court addresses HSB’s Motion as to CiCi’s declaratory judgment and breach
of contract claims together, as the crux of this dispute is whether the Ransomware Sub-Limit
Endorsement modifies coverage for CiCi’s claim, thereby reducing HSB’s potential liability from
$3,000,000 to $250,000. The answer to this question dictates whether HSB’s Motion should be
granted on these two claims, which are inextricably intertwined. See Doc. 29, Sec. Am. Compl. ¶¶
8.1–8.8 (seeking a declaratory judgment that the Ransomware Sub-Limit Endorsement does not
modify coverage for CiCi’s claim under the Policy); ¶¶ 9.1–9.2 (alleging that HSB breached the
Policy by failing to adjust and pay Cici’s full claim in an amount greater than $1,200,000 instead
asserting that the claim is subject to the Ransomware Sub-Limit Endorsement).
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 18 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 19
For the reasons that follow, the court concludes that CiCi’s interpretation of the
Ransomware Sub-Limit Endorsement is supported by the Policy language and structure, that is,
that the Endorsement is not applicable on its face to Insuring Agreement D. Cyber Extortion.
Further, case law analysis, although minimal, supports this conclusion. The court, therefore, will
deny HSB’s Motion for Summary Judgment with respect to CiCi’s declaratory judgment and
breach of contract claim.
The court begins with the plain language of the Ransomware Sub-Limit Endorsement,
which provides:
In consideration of the premium charged, it is agreed that the Policy is amended as follows:
1) The following is added to section II. Limits of Insurance:
Solely with respect to the coverage afforded under this endorsement, our maximum
liability, and the most we shall pay for all Loss, Damages, and Claims Expenses
incurred by the Insured Organization resulting from any single Ransomware
Event shall be:
a) 250000.
Furthermore, the amount set forth directly above, in item 1)a) of this endorsement,
will in no way serve to increase our liability under this Policy and shall be part of,
and not in addition to, the Aggregate Limit of Insurance.
2) The following is added to section V. Definitions:
Ransomware Event means the Insured Organization’s receipt of a credible threat
or series of related threats first discovered during the Policy Period, and such
threats are made by a third party through the use of any malicious software or
computer code, which threatens to take any of the following actions unless an
Insured pays such third party the funds demanded, or meet some other non-
monetary demand, in exchange for the mitigation or removal of such threat:
a) cause an Information Privacy Event or Network Security Event;
b) alter, corrupt, damage, manipulate, misappropriate, encrypt, delete, or destroy
any Computer System, Corporate Data, or Protected Personal Information;
c) restrict or inhibit access to a Computer System; or
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 19 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 20
d) any action connected to the continuation or furthering of any already commenced
action referenced in paragraphs 2)a)-c) above.
Ransomware 	Event 	includes 	any 	related 	Information 	Privacy 	Event,
Information 	Privacy 	Wrongful 	Act, 	Network 	Security 	Event, 	Network
Security Wrongful Act, or System Disruption resulting from such threat or series
of threats described above. However, Ransomware Event shall not include and
this endorsement shall not apply to any Ransomware Event that originates solely
from a malicious attack against a third party owner or operator of External
Computer Systems.
3) Section V. Definitions. 15. Cyber Event, is deleted and replaced with the following:
Cyber Event means an Information Privacy Event, Network Security Event,
Extortion Threat, Fraudulent Inducement Instructions, Computer Crimes,
System Disruption, Ransomware Event, and, with respect to Insuring Agreement
I.F.2. only, a Media Wrongful Act.
All other terms, conditions, and exclusions to the Policy shall remain unchanged.
Doc. 40-2, Def.’s App. 86-87.
Applying Texas rules for contractual interpretation and reading the Policy as a whole in an
effort to harmonize its provisions, the court rejects HSB’s argument that the Ransomware Sub-
Limit Endorsement unambiguously applies to CiCi’s claim and limits coverage to $250,000.
First, the perfunctory composition of the Ransomware Sub-Limit Endorsement leaves no
clear instruction as to how the sub-limit is to be applied. While HSB argues that the Endorsement
unambiguously applies on its face based on the Policy’s structure and definition, see generally
Doc. 29, Def.’s Summ. J. Br. and Doc. 44, Def.’s Reply Br., the court is not persuaded. As CiCi
correctly notes, see Doc. 41, Pl.’s Resp. Br. 16-17, the language of the Endorsement limits it to the
provisions of the Endorsement itself. The Endorsement provides, “Solely with respect to the
coverage afforded under this endorsement, our maximum liability, and the most we shall pay for
all Loss, Damages, and Claims Expenses incurred by the Insured Organization resulting from
any single Ransomware Event” shall be $250,000. Doc. 40-2, Def.’s App. 86 (emphasis added).
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 20 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 21
“Solely” means “to the exclusion of all else” or “without another.” See https://www.merriam-
webster.com/dictionary/solely (last visited Feb. 	20, 2026). Synonyms include “only” and
“exclusively.” Id. Thus, on its face, the Endorsement only applies to limit the “coverage afforded”
under the endorsement. Nowhere in the Ransomware Sub-Limit Endorsement, however, does it
state what the “coverage afforded” is.
Second, notwithstanding HSB’s contentions that the “Policy’s intent is glaringly obvious”
and “clearly states that the Endorsement applies to all insuring agreements[,]” Doc. 44, Def.’s
Reply Br. 8, the Endorsement lacks any explicit language specifying that it applies to all the
Section I Insuring Agreements. Instead, the Ransomware Sub-Limit Endorsement states that it is
“added to section II. Limits of Insurance” without making any reference to modifying Section I.
Insuring Agreements. Section II. Limits of Insurance, however, does not afford any coverage to
CiCi, but merely establishes HSB’s maximum liability “with respect to the Insuring Agreement to
which each such Sub-Limit of Insurance applies….” Doc. 40-2, Def.’s App. 13.
Third, HSB knew the Policy had multiple Insuring Agreements and, in its coverage letter,
stated that CiCi’s claim triggered coverage under four separate “Insuring Agreements: A.
Information Privacy, B. Network Security, C. Business Interruption, and D. Cyber Extortion.”
Doc. 40-8, Def.’s App. 103. The Ransomware Sub-Limit Endorsement does not state that it
modifies or alters coverage under Insuring Agreement D. Cyber Extortion. It does not even include
the words “Cyber Extortion,” or “Extortion Loss” related to “Cyber Extortion.” Instead, the
Ransomware Sub-Limit Endorsement states that “[a]ll other terms, conditions, and exclusions of
the Policy shall remain unchanged.” Doc. 40-2, Def.’s App. 87.
Fourth, a comparison of other Policy endorsements demonstrates the use of express terms
to modify a type of afforded coverage under the various Insuring Agreements in the Policy. For
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 21 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 22
example, HSB drafted two endorsements which explicitly state that they amend the coverage
afforded under Section I. Insuring Agreements. First, HSB drafted the “CryptoJacking & Utility
Coverage [Full Limits]” endorsement which explicitly states “[t]he following is added to Section
I. Insuring Agreements, B. Network Security, item 2. Event Response and Recovery…” in
modifying the coverage afforded for a “Network Security” claim. Doc. 40-2, Def.’s App. 78
(emphasis added). Second, Defendant drafted the “Funds Transfer Fraud Coverage” endorsement
which states, “Section I. Insuring Agreements, E. Financial Fraud, 1. Social Engineering, is deleted
and replaced with the following…” in modifying the coverage afforded for a “Financial Fraud.”
Doc. 40-2, Def.’s App. 69. Such explicit terms, however, are not present in the Ransomware Sub-
Limit Endorsement. If HSB wanted the $250,000 sub-limit to apply across the board, regardless
of the Insuring Agreement, then it was incumbent upon HSB to expressly and clearly state that.
Having not done so, it cannot now complain.
Neither party has cited any court rulings interpreting the Ransomware Sub-Limit
Endorsement. Further, after extensive research, the court has not located any case law interpreting
the Endorsement or any similar provision. Although not “on all fours” with the instant case, the
court finds guidance in the analysis employed by the Texas appellate court in Hanover Casualty
Company v. Seven Acres Jewish Care Services, Inc., a case upon which CiCi relies in opposing
HSB’s Motion. 654 S.W.3d 495 (Tex. App.—Houston [14th Dist.] 2022, pet. denied). Hanover
Casualty involved a flood claim for building damage and income loss. The subject insurance policy
included an endorsement providing a limit of $4.5 million in coverage for losses caused by flood.
Id. at 497-98. Hanover issued the $4.5 million policy limit for flood damages pursuant to the
endorsement but denied coverage for any payments beyond the flood endorsement limit and argued
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 22 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 23
that all payments—whether for building damage or income loss—were subject to the $4.5 million
limit.
Following Hurricane Harvey, the insured made a claim for losses due to building damage
and business-income losses. Id. at 498. The insurer subsequently paid the flood endorsement limits
of liability but refused to make payments on the insured’s business-income losses, asserting that
those damages were subject to the flood endorsement limit. Id. at 497. The insured then filed suit
seeking payment for its business-income claim. Id. at 498.
The Hanover Casualty court analyzed the policy’s business income and extra expense
coverage form which insured business-income losses “caused by direct physical loss of or damage
to property at premises which are described in the Declarations and for which a Business Income
Limit of Insurance is shown in the Declarations.” Id. at 500 (quoting policy). The court found that
the flood endorsement limit “only address[ed] business-income coverage to clarify that the
definition of ‘period of restoration’ for purposes of a business-income or extra-expense claim
‘applies to each event.”’ Id. (quoting the policy’s flood endorsement limit). Because the flood
endorsement did not otherwise address business-income coverage subject to the flood endorsement
limit, however, the court held that the flood endorsement did not apply to business-income loss
resulting from flood. Id. Important to the court’s analysis was the fact that the flood endorsement
did not “specifically explain how the Business Income Coverage Form [was] modified.” Id. at 501.
Ultimately, the court held that “[b]ecause we have no explicit language subjecting business-income
claims to the flood limit in this policy, we must give effect to the policy language as written and
not effectively read into the flood endorsement a broader exclusion that intended.” Id. at 502. “If
Hanover had intended to restrict business-income claims resulting from a flood event Hanover
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 23 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 24
should have included language in the flood endorsement to that effect as it has in other
endorsements in the policy.” Id.
Similarly, HSB drafted the Ransomware Sub-Limit Endorsement that contains no explicit
language subjecting Insuring Agreement D. Cyber Extortion to the sub-limit of the Endorsement.
The court agrees with CiCi that “if Defendant intended for the Ransomware Endorsement to
modify ‘Cyber Extortion’ coverage, Defendant should have included language in the endorsement
to that effect as it had to other endorsements in the policy.” Doc. 42, Pl.’s Resp. Br. 21.
Finally, contrary to HSB’s argument that “Ransomware Event” is a “type or subset” of
“Extortion Threat,” Doc. 38, Def.’s Mot. 1, the court agrees with CiCi that the definition of
“Ransomware Event” does not state that it is a subset or subtype of “Extortion Threat.” Rather, the
definition provides its own distinct characterizations of what constitutes a “Ransomware Event.”
See Doc. 40-2, Def.’s App. 86. The Endorsement does not state that it is revising the term
“Extortion Threat” to include “Ransomware Event” as a type of “Extortion Threat.” In addition,
the structure of the definition of “Cyber Event” reinforces that, under the Policy, these two terms
are distinct and separate types of events. “Ransomware Event” was added as a type of “Cyber
Event” and joined the other types of “Cyber Event,” including Information Privacy Event, Network
Security Event, and Extortion Threat. See Doc. 40-2, Def.’s App. 87 (amended definition of
“Cyber Event”). Based on the amended definition of “Cyber Event,” by its plain language, the
court determines that the inclusion of “Ransomware Event” was meant to be treated as a separate
event from the other types of “Cyber Event,” including being separate and distinct from an
“Extortion Threat.” As the drafter of the Endorsement, if HSB intended for “Ransomware Event”
as merely a subset of an “Extortion Threat,” then it could have made that intent clear by stating so.
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 24 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 25
Instead, HSB added “Ransomware Event” as another type of “Cyber Event” where “Extortion
Threat” is also included as a type of “Cyber Event.” See Doc. 40-2, Def.’s App. 87.
For these reasons and having considered the Policy language and structure, as well as
applicable rules of contractual interpretation, the court determines that the Ransomware Sub-Limit
Endorsement is not applicable on its face to Insuring Agreement D. Cyber Extortion and, therefore,
does not limit HSB’s liability to $250,000. Accordingly, the court denies HSB’s Motion for
Summary Judgment with respect to CiCi’s declaratory judgment and breach of contract claim.
C. CiCi’s Claims for Violations of Texas Insurance Code §§ 541 and 542
CiCi alleges violations of Chapters 541 and 542 of the Texas Insurance Code. Doc. 29,
Sec. Am. Compl. ¶¶ 10.1–11.5. HSB moves for summary judgment with respect to these
extracontractual claims. Without discussing any of CiCi’s specific claims or arguments, HSB
contends that while the parties dispute the application of the Ransomware Event Sub-Limit
Endorsement, “that disagreement quintessentially represents a bona fide dispute, which does not
rise to the level of actionable bad faith under Texas common law or the Texas Insurance Code.
Accordingly, HSB is entitled to summary judgment on Cici’s Texas Insurance Code claims.” Doc.
39, Def.’s Summ. J. Br. 12.
In response, CiCi argues that, “[w]hile this lawsuit does involve a coverage dispute,” it has
provided sufficient evidence to raise a genuine dispute of material fact that HSB’s actions, and that
of its managing general agent, At-Bay, rose “to the level of bad faith” in violation of various
provisions of the Texas Insurance Code. Doc. 42, Pl.’s Summ. J. Resp. Br. 31.
1. 	Texas Insurance Code § 541
Texas Insurance Code § 541.003 provides that “[a] person may not engage in this state in
a trade practice that is defined in this chapter as or determined under this chapter to be an unfair
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 25 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 26
method of competition or an unfair or deceptive act or practice in the business of insurance.” Tex.
Ins. Code § 541.003. The Insurance Code lists several “unfair method[s] of competition” and
“unfair or deceptive act[s] or practice[s],” such as: “failing to attempt in good faith to effectuate a
prompt, fair, and equitable settlement”; “failing within a reasonable time to . . . affirm or deny
coverage of a claim to a policyholder”; and “refusing to pay a claim without conducting a
reasonable investigation with respect to the claim.” Tex. Ins. Code § 541.060(a). The “reasonable-
basis test” applies to a cause of action against the insurer for bad faith under the Insurance Code.
See Henry v. Mutual of Omaha Ins. Co., 503 F.3d 425, 428-29 (5th Cir. 2007). The insurer “will
not be faced with a tort suit for challenging a claim of coverage if there was any reasonable basis
for denial of that coverage.” Id. at 429 (citation and internal quotation marks omitted); see also
Higginbotham v. State Farm Mut. Auto. Ins. Co., 103 F.3d 456, 459 (5th Cir. 1997) (“A cause of
action for breach of the duty of good faith and fair dealing exists when the insurer has no
reasonable basis for denying or delaying payment of a claim or when the insurer fails to determine
or delays in determining whether there is any reasonable basis for denial.”) (original emphasis)
(citation omitted). “Evidence establishing only a bona fide coverage dispute does not demonstrate
bad faith.” State Farm Fire & Cas. Co. v. Simmons, 963 S.W.2d 42, 44 (Tex. 1998) (citations
omitted).
Here, as previously stated, HSB only challenges CiCi’s Chapter 541 claims on the basis
that a bona fide dispute exists. As such, its argument misapprehends applicable law. For the bona
fide dispute rule to apply, the extracontractual claim must share “the same predicate for recovery
as bad faith causes of action in Texas.” Higginbotham, 103 F.3d at 460. In other words, “the
statutory claims must be based on the same theory [that] underlies the bad faith claim—namely,
denial of policy benefits without a reasonable basis.” Kim v. Nationwide Mut. Ins. Co., 614 F.
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 26 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 27
Supp. 3d 475, 497 (N.D. Tex. 2022) (Fitzwater, J.) (internal punctuation and citation omitted).
From HSB’s cursory briefing concerning CiCi’s extracontractual claim, the court is unable to
decipher whether the bona fide dispute rule even applies. This alone provides sufficient basis to
deny HSB’s Motion, as HSB offers no evidence or argument that CiCi’s claims under § 541 of the
Texas Insurance Code share the same predicate for recovery as bad faith causes of action in Texas.
See Jajou v. Safeco Ins. Co. of Ind., 2022 WL 220391, at *12 (W.D. Tex. Jan. 24, 2022)
(concluding that where insurer “failed to present any argument” on insured’s §§ 541.060 and
542.058 claims, summary judgment was inappropriate); Hall Arts Ctr. Off., LLC v. Hanover Ins.
Co., 327 F. Supp. 3d 979, 1000 (N.D. Tex. 2018) (“Because [insurer] offers no evidence or
argument that [the insured’s] claim under § 541.060(a)(4)(A) shares the same predicate for
recovery as [the insured’s] bad faith action, the court declines to grant [the insurer’s] motion for
summary judgment on [that] claim.”).
Second, CiCi has provided sufficient evidence to raise a genuine dispute of material fact
from which a reasonable jury could find that HSB violated Chapter 541 of the Texas Insurance
Code, notwithstanding that the parties dispute the application of the Endorsement. See Doc. 42,
Pl.’s Resp. Br. 31-36. Specifically, CiCi has provided evidence that “HSB’s actions and that of its
managing general agent, At-Bay, rise to the level of bad faith due to misrepresentations and failures
to disclose information to CiCi that was critical to the coverage CiCi sought and was afforded
under the Cyber Insurance Policy.” Doc. 42, Pl.’s Resp. Br. 31; see Doc. 43-1, Pl.’s App. 1-18;
Doc. 43-2, Pl.’s App. 19-34; Doc. 43-3, Pl.’s App. 35-36.6
6 “Pl.’s App.” refers to the Appendix in Support of Plaintiff’s Brief in Opposition to HSB Specialty
Insurance Company’s Motion for Summary Judgment.
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 27 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 28
As CiCi has provided evidence to raise a genuine dispute of material fact regarding these
claims, the court denies HSB’s Motion for Summary Judgment on CiCi’s claims for violations of
Texas Insurance Code § 541.
2. 	Texas Insurance Code § 542
CiCi also alleges that HSB violated Texas Insurance Code § 542 by, among other things,
“delaying in the payment of CiCi’s full claim after HSB received all items, statements, and forms
reasonably requested and required[,]” in violation of Section 542.058. Doc. 29, Sec. Am. Comp. ¶
10.3.
HSB contends that the court should grant summary judgment on CiCi’s Chapter 542 claim
because the parties’ disagreement “represents a bona fide coverage dispute.” Doc. 39, Def.’s
Summ. J. Br. 11. The court disagrees.
Even if HSB is correct that there is a bona fide dispute with respect to whether the
Ransomware Sub-Limit Endorsement applies to limit HSB’s liability to $250,000, it is undisputed
that HSB has only paid $250,000 toward CiCi’s claim. If HSB is found liable for additional
damages above the $250,000 sub-limit, it has violated the timely payment requirements of section
542 of the Texas Insurance Code. Moreover, HSB has provided no authority demonstrating that
the bona fide dispute defense absolves an insurer from liability where fact issues exist concerning
breach of contract and bad faith.
There is, accordingly, a genuine dispute of material fact with respect to HSB’s compliance
with section 542 of the Texas Insurance Code. Accordingly, the court denies HSB’s Motion for
Summary Judgment as to CiCi’s claims for violations of Texas Insurance Code § 542.
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 28 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 29
IV. 	CiCi’s Motion for Partial Summary Judgment
CiCi has filed a Motion for Partial Summary Judgment which is, effectively, a cross-motion
for partial summary judgment with respect to its declaratory judgment claim only. Specifically,
CiCi requests that:
[t]his court grant its Motion for [Partial] Summary Judgment on its declaratory
judgment claim because the Ransomware Sub-Limit Endorsement does not apply
on its face under the endorsement’s plain language and the Ransomware Sub-Limit
Endorsement must be construed against its drafter, HSB. Alternatively, the
Ransomware Sub-Limit Endorsement is ambiguous because its language is
susceptible to more than one reasonable interpretation.
Doc. 52, Pl.’s Mot. 2.
The court previously addressed the Ransomware Sub-Limit Endorsement at length in
addressing Defendant’s Motion for Summary Judgment, supra, agreed with CiCi’s arguments that
the Ransomware Sub-Limit Endorsement does not apply on its face under the Endorsement’s plain
language, and rejected HSB’s argument that the Endorsement applies to limit its liability to
$250,000. For this reason, the court denied HSB’s Motion for Summary Judgment with respect to
CiCi’s declaratory judgment and breach of contract claims. CiCi’s arguments in its Motion for
Partial Summary Judgment overlap with those in its response to Defendant’s Motion for Summary
Judgment. Having determined that the Ransomware Sub-Limit Endorsement does not apply on its
face under the Endorsement’s plain language, the court grants CiCi’s Motion for Partial Summary
Judgment as to its declaratory judgment claim, as any other result would be repugnant to the
determinations and rulings already made.
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 29 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 30
V. 	Conclusion
For the reasons stated herein, the court denies Defendant HSB Specialty Insurance
Company’s Motion for Summary Judgment (Doc. 38) and grants Plaintiff CiCi Enterprises, LP’s
Motion for Partial Summary Judgment (Doc. 52).
Specifically, the court denies HSB’s Motion as to CiCi’s declaratory judgment claim and
breach of contract claim based on its determination that the Ransomware Sub-Limit Endorsement
does not modify coverage for “Cyber Extortion” or “Extortion Threat” and does not apply to CiCi’s
claims by the plain terms of the Endorsement. Further, the court denies HSB’s Motion as to CiCi’s
claims under the Texas Insurance Code because CiCi has raised genuine disputes of material fact
as to these claims.
Having granted CiCi’s Motion for Partial Summary Judgment, which the court has
construed as a cross-motion for partial summary judgment as to CiCi’s declaratory judgment claim
only, the court hereby declares that (1) the Ransomware Sub-Limit Endorsement does not modify
coverage for “Cyber Extortion” or “Extortion Threat” and does not apply to CiCi’s claims by the
plain terms of the Endorsement; and (2) the Policy’s $3,000,000 policy limits are available for the
payment of CiCi’s claim. Remaining for trial are CiCi’s claims for breach of contract and for
violations of Texas Insurance Code §§ 541 and 542.
As a final note, given the court’s rulings herein—which have consumed an inordinate
amount of scarce judicial resources—as well as the complexity of this case, the time it has been
pending, and the time it will take to try if not resolved short of trial, the court strongly encourages
the parties to consider resolution of the remaining claims. With respect to the remaining issues,
this is not an open-and-shut case for either party. The court has no idea how a jury would rule on
the remaining issues. In the meantime, however, through trial and possible appeal, the parties will
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 30 of 31 PageID <pageID>

Memorandum Opinion and Order - Page 31
continue to incur handsome legal fees. It behooves the parties, as the outcome of the remaining
claims is uncertain, to vigorously seek resolution of this action without further court involvement.
In that vein, to eliminate the expenses of mediation, the court will make available a magistrate
judge to conduct a settlement conference or mediation. If, after serious discussion (and potentially
after mediation), the parties cannot resolve their differences, the court will set this matter for trial.
The court directs the parties to inform it in writing no later than March 6, 2026, whether they are
able to resolve the remaining claims in this action without further court involvement or desire to
participate in a settlement conference or mediation with a magistrate judge at no cost. Moreover,
as criminal trials take precedence over civil actions, it is likely this case cannot be tried until early
or late Fall of 2026.
It is so ordered this 23rd day of February, 2026.
_________________________________
Sam A. Lindsay
United States District Judge
Case 3:23-cv-02155-L Document 74 Filed 02/23/26 Page 31 of 31 PageID <pageID>