June 16, 2025- Alice T. Kane v. Syndicate 2623-623 Lloyds of London, No. A-1-CA-41254

1 printed pages contain little extracted OCR body text; searchable legal-body completeness has not been established for those pages.

OCR transcription for search; preserved printed pages are authoritative

marAAN

10

11
12

13

14
15

16
17
18
19

20
21

22
23

Corrections to this opinion/decision not affecting the outcome, at the Court's discretion, can occur up to the time of publication
with NM Compilation Commission. The Court will ensure that the electronic version of this opinion/decision is updated accordingly
in Odyssey.

IN THE COURT OF APPEALS OF THE STATE OF NEW MEXICO
_ Court of Appeals of New Mexico
Opinion Number: Filed 6/16/2025 8:31 AM
Filing Date: June 16, 2025 [ uprtul Jom Ld| hdd)
No. A-1-CA-41254

Cynthia A. Hernandez Madrid
. Acting Chief Clerk
ALICE T. KANE, Superintendent of Insurance,

in her official capacity as Receiver for NEW
MEXICO HEALTH CONNECTIONS, INC.,
a New Mexico not-for-profit corporation,

Plaintiff-Appellee,
V.

SYNDICATE 2623-623 LLOYD’S OF LONDON
d/b/a BEAZLEY USA SERVICES, INC,

Defendant-Appellant.

APPEAL FROM THE DISTRICT COURT OF SANTA FE COUNTY
Matthew J. Wilson, District Court Judge

Office of the Superintendent of Insurance
Stephen Thies

Lawrence M. Marcus

Santa Fe, NM

for Appellee

Rodey, Dickason, Sloan, Akin & Robb, P.A.
Edward Ricco
Albuquerque, NM

Day Pitney LLP
Jonathan S. Zelig
Candace J. Hensley
Boston, MA

for Appellant

OPINION	1
YOHALEM, Judge.	2
{1} 	This appeal asks this Court to construe the coverage provided by a cyber	3
insurance policy for a claim of damage to a third party “for a security breach.” The	4
policy 	defines 	a 	“security 	breach” 	as 	“a 	failure 	of 	computer 	security 	to	5
prevent . . . unauthorized access or use of [the insured’s] computer systems.” The	6
insurer, Syndicate 2623/623 Lloyd’s of London d/b/a Beazley USA Services, Inc.	7
(Beazley), 	appeals 	the 	district 	court’s 	order 	granting 	New 	Mexico 	Health	8
Connections, Inc.’s (NMHC)1 motion for summary judgment, concluding that the	9
phrase “for a security breach” is ambiguous, and construing the phrase to provide	10
coverage under the policy for injury to a third-party “because of” or “resulting from”	11
a security breach. We agree with the district court that the phrase “for a security	12
breach” is ambiguous, and construe this ambiguity under well-established principles	13
of insurance law in favor of the insured. We also agree with the district court that	14
the exclusions to coverage relied on by Beazley do not clearly apply to the loss at	15
issue in this case. Therefore, we affirm the district court.	16
1 NMHC’s claim is brought by the Superintendent of Insurance, Alice Kane,
as a receiver for NMHC, pursuant to NMSA 1978, Sections 59A-41-18 (1984)
and -40(A)(1) (1984). That statute authorizes the Superintendent of Insurance to
attempt to recover money due to a health-care provider from an insolvent insurer.
NMHC is an insolvent insurer that owes money to OptumRX, a health-care provider.
Although Kane is the named appellant, we refer to NMHC, the insured in this case,
to avoid confusion.

2
BACKGROUND	1
The Policy	2
{2} 	NMHC, a health-care insurer, purchased a comprehensive cyber breach	3
response policy (the Policy) from Beazley to protect it from breaches of computer	4
security. The Policy covered claims first made during the period from May 1, 2020,	5
to May 1, 2021. Coverage was provided for damages to NMHC from cyber	6
extortion, for the costs of recovering lost data, for the cost of crisis management, for	7
losses due to business interruption, and lesser coverage was provided for losses due	8
to fraudulent instructions, funds transfer fraud, and telephone fraud.2 The Policy also	9
covered damages and claims expenses incurred by NMHC in connection with third-	10
party liability claims. The Policy has a $7 million aggregate limit of liability.	11
{3} 	The third-party liability coverage at issue appears in a section of the Policy	12
entitled “Data and Network Liability.” That section of the Policy specifies that	13
coverage is provided for damages (defined as “a monetary judgment, award or	14
settlement”); and claims expenses (defined as legal defense costs) that NMHC “is	15
legally obligated to pay because of a claim against [it] during the policy period	16
2 The parties agree that the Policy’s fraudulent instruction coverage, limited to
$250,000, applied here. Beazley does not argue that this coverage was exclusive.
The issues of contract interpretation before this Court concern only the third-party
liability coverage under the Policy’s data and network agreement.

3
for . . . a [s]ecurity [b]reach.”3 The Policy defines a “security breach,” as “a failure	1
of computer security to prevent . . . unauthorized access or use of computer systems,	2
including unauthorized access or use resulting from the theft of a password from a	3
computer system or from any insured.”	4
{4} 	Also relevant to this appeal is the loss of money exclusion. Beazley relies on	5
the two following exclusions to argue that even if there is coverage, it does not apply	6
to the loss of funds at issue here.	7
The coverage under this Policy will not apply to any loss arising out of:	8
. . . .	9
2. 	any loss, transfer or theft of monies, securities or tangible	10
property of the insured or others in the care, custody or control	11
of the insured organization;	12
3. 	the 	monetary value of 	any transactions 	or 	electronic 	fund	13
transfers by or on behalf of the insured which is lost, diminished,	14
or damaged during transfer from, into or between accounts.	15
NMHC’s Claim for Coverage	16
{5} 	The 	facts 	giving 	rise 	to 	NMHC’s 	claim 	for 	third-party 	coverage 	are	17
undisputed. In April 2020, a third-party posing as a senior accountant manager of	18
one of NMHC’s vendors, OptumRX, emailed a fraudulent invoice to NMHC on the	19
3 The Policy capitalizes many terms to indicate that they are defined in the
definition section of the Policy. Because signaling these definitions is not relevant
to this opinion, we use the lower case where it normally would be used when quoting
from the Policy to make reading easier.

4
form used by OptumRX for its invoices, requesting payment at a fraudulent bank	1
account. In response, NMHC wired $4,415,833.11 to the fraudulent bank account	2
from its Wells Fargo account over the course of five different transfers between April	3
30, 2020, and May 27, 2020.	4
{6} 	The parties agree that the fraud was perpetrated by a third-party who gained	5
unauthorized access to NMHC’s computer system and email. A copy of a legitimate	6
OptumRX invoice had been obtained from the computer system, and fraudulent	7
account numbers were substituted for OptumRX’s account. Beazley does not dispute	8
that this was “a security breach” as defined by the Policy.	9
{7} 	Because of this security breach and the fraudulent use of the information	10
obtained, the amounts due to OptumRX under NMHC’s contract with OptumRX	11
were not paid. OptumRX sent a letter to NMHC demanding payment of the	12
outstanding invoice amounts owed by NMHC to OptumRX under the parties’	13
contractual agreement.	14
{8} 	NMHC reported the claim to Beazley on July 1, 2020, through its legal	15
counsel. The July 1, 2020, email from counsel stated that NMHC “hereby requests	16
that Beazley investigate, defend, and indemnify NMHC for the [third-party] claims	17
asserted by OptumRX.” Beazley denied third-party liability coverage, claiming that	18
the OptumRX claim for the unpaid invoice amounts did not trigger third-party	19

5
liability coverage under the Policy, and even if it did, the loss of money exclusions	1
quoted above barred coverage for the OptumRX third-party claim.	2
Procedure in the District Court	3
{9} 	NMHC filed this suit in district court against Beazley for breach of the	4
Policy’s third-party liability provision. Beazley counterclaimed, arguing the two	5
exclusions identified above applied. The parties filed cross-motions for summary	6
judgment. Beazley argued that the Policy did not provide liability coverage to	7
NMHC under the provision governing third-party claims because OptumRX’s claim	8
is not a claim for damages “for a security breach,” covered by the Policy, but is	9
instead a garden-variety claim for breach of contract based on NMHC’s failure to	10
pay OptumRX’s invoices. Beazley claimed that the Policy’s third-party coverage	11
applies only to claims directly “for” the security breach itself. Beazley’s example of	12
a covered claim is a suit for damages for an insured’s loss or public exposure of	13
third-party private data. Claims for a breach of contract, like OptumRX’s claim for	14
damages, even where the breach of contract was “caused by” a security breach, are	15
not, according to Beazley, claims “for” a security breach.	16
{10} 	Beazley further argued that even if the district court found that coverage	17
extended to OptumRX’s breach of contract claim, the two specific exclusions in the	18
Policy applying to claims for the loss of money quoted above each bar any recovery	19
by NMHC. The parties’ dispute about the first exclusion from coverage focused on	20

6
whether money in NMHC’s Wells Fargo bank account was “in the care, custody or	1
control” 	of 	NMHC when 	it 	was 	transferred 	to 	the fraudulent 	account. 	The	2
controversy over the second exclusion concerned whether the funds transferred to	3
the fraudulent account were “lost, diminished, or damaged during transfer from, into	4
or between accounts.”4
5
The District Court’s Ruling	6
{11} 	At the hearing on the parties’ cross-motions for summary judgment, the	7
district court made an oral ruling that “[a]s a result of a security breach and	8
fraudulent instructions, funds were withdrawn from NMHC’s accounts that were in	9
the care, custody, and control of Wells Fargo Bank.” The district court concluded	10
that the OptumRX claim was “for . . . a security breach” covered by the Policy	11
because the claim “arose from a security breach and flowed from a security breach.”	12
As to the application of the loss of money exclusions, the district court ruled that	13
“[t]he exclusion language does not apply to the facts underlying the OptumRX	14
4 We note that in addition to the arguments it successfully made in the district
court on the meaning of the third-party coverage provision and the exclusions to the
policy, NMHC has argued for the first time on appeal that Beazley’s initial letter
disclaiming coverage failed to adequately alert NMHC to Beazley’s reasons for
denying coverage, a violation of New York law—the law the parties contracted to
apply to the Policy. We do not reach this argument, both because it would be unfair
to Defendant who was not able to defend against this argument in the district court
and because we affirm on the grounds raised in the district court. See Eldin v.
Farmers All. Mut. Ins. Co., 1994-NMCA-172, ¶ 21, 119 N.M. 370, 890 P.2d 823
(declining to apply the right for any reason doctrine on grounds that it would be
unfair to the appellant).

7
claim” because “[t]he funds that were stolen were not in the care, custody, and	1
control of the insured”; the stolen funds “were in the care, custody, and control of	2
Wells Fargo Bank.” Although rejecting Beazley’s argument that the exclusion for	3
funds “lost, diminished, or damaged during transfer” barred coverage, the district	4
court did not state its reasoning. Concluding that the Policy’s third-party liability	5
provision covered OptumRX’s claim against NMHC, and that no exclusion applied,	6
the district court granted summary judgment in favor of NMHC, awarding it	7
$3,533,804.95, the invoiced amount remaining unpaid to OptumRX after law	8
enforcement recovered a portion of the funds diverted by the security breach.	9
Beazley appeals.	10
DISCUSSION	11
{12} 	On appeal, Beazley again argues, as it did in the district court: (1) that the	12
Policy’s third-party liability coverage does not apply because OptumRX’s breach of	13
contract claim was not “a claim for . . . a security breach”; and (2) that two of the	14
listed loss of money exclusions bar coverage because the lost funds were (a) in the	15
“care, custody or control” of NMHC, and (b) were lost during transfer from, into or	16
between accounts. We address each of Beazley’s arguments in turn, after addressing	17
the standard of review and general principles of law governing the construction of	18
insurance contracts.	19

8
I. 	Standard of Review	1
{13} 	We review a district court’s order granting or denying summary judgment de	2
novo. See United Nuclear Corp. v. Allstate Ins. Co., 2012-NMSC-032, ¶ 9, 285 P.3d	3
644. Where, as here, an appellant does not assert the existence of a genuine issue of	4
material fact precluding summary judgment, but rather agrees that the facts are	5
undisputed, “our task is to determine whether the district court correctly applied the	6
law to the facts.” See Gonzales v. Allstate Ins. Co., 1996-NMSC-041, ¶ 7, 122 N.M.	7
137, 921 P.2d 944. “Similarly, the interpretation of terms within an insurance policy	8
is a matter of law about which the court has the final word, and is subject to de novo	9
review.” United Nuclear Corp., 2012-NMSC-032, ¶ 9 (internal quotation marks and	10
citation omitted).	11
II. 	Choice of Law	12
{14} 	The Policy includes a choice of law provision stating that New York law will	13
apply to any dispute. The parties, however, agree that this Court may apply New	14
Mexico law governing the construction of insurance contracts because our law is	15
nearly identical to New York law on this question. We agree that the principles of	16
law governing the interpretation of insurance contracts are nearly the same in both	17
states and therefore accept the parties’ invitation to apply New Mexico law. We	18
apply New York law, however, in accordance with the Policy terms, on any issue	19
other than the general law of contract construction.	20

9
III. 	Governing Principles of Insurance Policy Interpretation	1
{15} 	The 	questions 	before 	this 	Court 	on 	appeal 	are 	questions 	of 	contract	2
construction. Insurance policies are interpreted by our courts (and New York courts)	3
applying the principles generally applicable to the interpretation of contracts. “Our	4
analysis of the insurance policy proceeds with the primary goal of ascertaining the	5
intentions of the contracting parties with respect to the challenged terms at the time	6
they executed the contract.” Ponder v. State Farm Mut. Auto. Ins. Co., 2000-NMSC-	7
033, ¶ 11, 129 N.M. 698, 12 P.3d 960 (alteration, internal quotation marks, and	8
citation omitted). “As with other contracts, where an insurance policy’s terms have	9
a common and ordinary meaning, that meaning controls in determining the intent of	10
the parties.” United Nuclear Corp., 2012-NMSC-032, ¶ 10 (internal quotation marks	11
and citation omitted).	12
{16} 	A term is ambiguous when it “is reasonably and fairly susceptible of different	13
constructions.” Id. (internal quotation marks and citation omitted). So long as the	14
insured’s expectations are reasonable, we will be guided by those expectations and	15
will, as a matter of public policy, construe ambiguities in an insurance policy “in	16
favor of the insured and against the insurer.” Ponder, 2000-NMSC-033, ¶ 26. Public	17
policy recognizes that insurance companies control the language of the policy, and	18
“[an insurance company] does so with far more knowledge than the typical insured	19

10
of the consequences of particular words.” Sanchez v. Herrera, 1989-NMSC-073,	1
¶ 21, 109 N.M. 155, 783 P.2d 465.	2
IV. 	Third-Party Coverage “for a Security Breach”	3
{17} 	We begin by applying these principles of interpretation to the parties’ dispute	4
about the construction of the coverage provisions of the Policy. Only if we determine	5
that there is coverage under the Policy do we then determine whether an exclusion	6
applies to bar coverage. See Pulte Homes of N.M., Inc. v. Ind. Lumbermens Ins. Co.,	7
2016-NMCA-028, ¶ 9, 367 P.3d 869.	8
A. 	The Parties’ Contentions	9
{18} 	As we have already noted, the parties’ coverage dispute focuses on the policy	10
terms under the heading “Data and Network Liability.” That section of the Policy	11
specifies 	that 	coverage 	is 	provided 	for damages 	(defined 	as 	a 	judgment 	or	12
settlement), and claims expenses (defined as legal defense costs),	13
which the [i]nsured is legally obligated to pay because of any claim first	14
made against an insured during the policy period for:	15
. . . .	16
2. 	a security breach.	17
{19} 	There is no dispute on appeal about the meaning of the term “security breach.”	18
The parties agree that the unauthorized invasion of NMHC’s email and the theft from	19
that account of an OptumRX invoice that was then modified to redirect payments to	20
OptumRX to a fraudulent account was a “security breach,” as that term is defined	21

11
by the contract. The dispute about coverage here, therefore, focuses on the meaning	1
of the preposition “for” in the phrase “for a security breach.” Beazley argues that	2
OptumRX does not assert “a claim against NMHC “for a security breach,” because	3
OptumRX “does [not] allege that, as a result of such a breach, information pertaining	4
to OptumRX was stolen or compromised.” Beazley argues that the preposition “for”	5
plainly and solely means “equivalent to” and concludes that coverage is provided	6
only for a loss directly connected to the security breach. Beazley’s construction	7
would narrow the Policy’s coverage for third-party claims to recover damages to the	8
loss or disclosure of private, third-party data from the insured’s computer system.	9
{20} 	NMHC, in contrast, construes the phrase “a claim for a security breach” to	10
include a third-party claim for damages where a security breach was causally	11
connected to the loss. According to NMHC, the preposition “for” in the Policy’s	12
coverage provision requires only a causal connection between the loss or damages	13
claimed and the security breach. NMHC would define “for” as meaning “because	14
of,” “arising out of,” or “as a result of.”	15
B. 	The Sources Relied on by This Court to Construe Words in an Insurance	16
Policy	17
{21} 	Although New Mexico law allows this Court to consider extrinsic evidence to	18
make a preliminary finding on the question of ambiguity, extrinsic evidence often	19
involves testimony as to the parties’ circumstances at the time the policy was	20

12
purchased, their business interests, and other external evidence of intent. See Ponder,	1
2000-NMSC-033, ¶ 13. No such evidence was presented by either party in this case.	2
We turn, therefore, to other forms of extrinsic evidence as tools of contract	3
construction. We generally look first to other relevant terms of the policy to see	4
whether construing the policy as a whole explains the meaning and intent of the word	5
or phrase at issue. See United Nuclear Corp., 2012-NMSC-032, ¶¶ 16-18. We then	6
look to the dictionary definitions of the disputed word or phrase, to any opinions by	7
our courts or the courts of other jurisdictions on the meaning of similar language,	8
and finally to any industry practice or drafting history. See id. ¶¶ 16-37. No one of	9
these factors is dispositive on the question of ambiguity but, taken together, they	10
help resolve the question. See id. ¶ 38 (relying on these factors together).	11
1. 	Other Provisions in the Policy	12
{22} 	We note first that the Policy does not define the word “for” or provide any	13
explanation elsewhere in the Policy of the extent of coverage intended for claims	14
“for a security breach.” There is, for example, no provision limiting third-party	15
liability for a security breach specifically to the loss of data. Indeed, the Policy lists	16
“a data breach” separately from “a security breach” as a type of claim covered by	17
the Policy. Generally, we would not expect two types of coverage to be coextensive.	18
Although not dispositive, the third-party claim provision, read as a whole, suggests	19

13
that a claim for damages for a breach of security may extend beyond damages arising	1
from a data breach—the only damages Beazley’s definition would cover.	2
{23} 	Beazley points to other provisions in the Policy that use the phrases “arising	3
out of” or “resulting from,” and argues that the use of the word “for,” rather than	4
these other terms, makes clear that the word “for” means something different and	5
narrower than “arising out of” or “resulting from.” We do not agree. Despite a	6
lengthy list of definitions in the Policy, including many common words, there is no	7
definition of “arising out of,” “resulting from,” or “for” to distinguish these terms,	8
or to indicate that they mean something special. These terms are commonly used	9
interchangeably in everyday language, and without a definition in the Policy, an	10
insured would likely read them as interchangeable. Moreover, we do not see how	11
the use of the phrase “resulting from” or “arising out of” in a handful of other	12
provisions throughout the Policy clarifies the meaning of the word “for” in the	13
provision at issue. We note that the Policy also uses in the “Data Recovery Costs”	14
provision a phrase clearly restricting coverage to costs incurred “as a direct result	15
of a security breach.” Although Beazley seeks to define “for a security breach” as	16
meaning “as a direct result of a security breach,” it does not use that far clearer phrase	17
in the provision at issue.	18

14
{24} 	Concluding that the other terms used in the Policy do not definitively resolve	1
the question of ambiguity, we continue our review by next examining the dictionary	2
definitions of the preposition “for.”	3
2. 	Dictionary Definitions	4
{25} 	“When a term is undefined in the policy, a reviewing court may look to that	5
term’s usual, ordinary, and popular meaning, such as found in a dictionary.” Id. ¶ 19	6
(internal quotation marks and citation omitted). “Although the mere existence of	7
multiple dictionary definitions of a word, without more, does not create an	8
ambiguity, dictionary definitions can serve as an appropriate starting point for	9
analysis.” Id. ¶ 20 (text only) (citations omitted).	10
{26} 	Beazley directs this Court to one specific definition of the word “for” from	11
Webster’s Third New International Dictionary (Unabridged ed. 2002) (Webster’s	12
Third), defining “for” as “in exchange as the equivalent of” (as in “all that trouble	13
for nothing,” or “my kingdom for a horse”). We note that Webster’s Third also	14
defines “for,” in relevant part, as “because of,” “on account of,” “as regards,” and	15
“for this reason or on this ground,” definitions that suggest a causal connection rather	16
than equivalence between the two nouns it connects—in this case damages and	17
claims expenses “because of,” “on account of,” or “resulting from” a security	18
breach.”	19

15
{27} 	Like the word “sudden,” construed by our Supreme Court in United Nuclear	1
Corp., the word “for” has multiple commonplace definitions. Both Beazley’s	2
preferred meaning of “equivalent to” and NMHC’s preferred meaning of “because	3
of” or “resulting from” are included in the common usage of the word “for.” As our	4
Supreme Court found in United Nuclear Corp., competing definitions—reflecting	5
both parties’ views—tend to demonstrate the ambiguity of a term. 2012-NMSC-032,	6
¶ 22.	7
3. 	Divergence of Opinion Among Courts	8
{28} 	The parties turn to the opinions of courts in other jurisdictions that have	9
construed the word “for.” We emphasize at the outset that neither party has pointed	10
to an opinion construing that word in the context of a cyber insurance policy. Indeed,	11
our research shows that there are few published decisions interpreting such policies	12
anywhere in the country.	13
{29} 	We do not find either party’s analogies to decisions differentiating claims “for	14
bodily injury” from claims “because of” or “resulting from” bodily injury helpful.	15
First, these decisions are divided, similar to the division in dictionary definitions.5
16
5Compare Am. Ins. Co. v. Naylor, 87 P.2d 260, 265 (Colo. 1939) (applying
the broad definition of “for” to mean “because of,” “on account of,” and “in
consequence of”), with Farmers Tex. Cnty. Mut. Ins. Co. v. Zuniga, 548 S.W.3d 646,
652-54 (Tex. Ct. App. 2017) (concluding that the insurance policy agreement to “pay
all damages for bodily injury” is unambiguous because “[t]he plain meaning of the
word ‘for’ is ‘in exchange as the equivalent of’” (quoting Webster’s Third 886); see
also Lumbermens Mut. Cas. Co. v. Yeroyan, 5 A.2d 726, 727 (N.H. 1939) (finding

16
Most importantly, however, this is an area of insurance policy construction	1
developed over decades by insurers and courts addressing phrases widely used in	2
common insurance policies. The parties each cite to several cases supporting their	3
viewpoint. Despite the common use in insurance policies of this phrase, these courts	4
still differ on the meaning of the phrase “for bodily injury.” The Georgia Supreme	5
Court, in Greenwood Cemetery, Inc. v. Travelers Indemnity Co., 232 S.E.2d 910,	6
913 (Ga. 1977), in construing the word “for” in the phrase “for mental anguish,”	7
highlighted the multiple reasonable meanings of the word “for”:	8
[t]he word ‘for’ has numerous meanings. The insurer would read the	9
word ‘for’ as meaning ‘equivalent to’ (and therefore not greater than)	10
or ‘to the amount, value or extent of.’ The insured would read the word	11
‘for’ as meaning ‘by reason of’ or ‘because of, on account of.	12
{30} 	We, therefore, conclude that there is a lack of an interpretive consensus among	13
courts, and take this as an “indicator of ambiguity.” See United Nuclear Corp., 2012-	14
NMSC-032, ¶ 29 (noting that a lack of consensus both among courts and outside the	15
courts may itself indicate ambiguity).	16
4. 	Industry Practice and Drafting History	17
{31} 	As we have already noted, neither party provided any details in the summary	18
judgment record surrounding the formation of the insurance contract here. We note,	19
however, that cybersecurity insurance is a relatively new area of insurance coverage.	20
“for” is “synonymous with the phrase ‘on account of’” (quoting Cormier v. Hudson,
187 N.E. 625, 626 (Mass. 1933)).

17
As technological advances have occurred and the use of internet and computer data	1
systems have become commonplace in business, and more and more businesses run	2
on cyber platforms, there has been an “exponential increase in the number of cyber	3
security breaches in recent years.” See Deborah L. Johnson, Demystifying the	4
Elusive Quest for Cyber Insurance Protection: The Need for New Contract	5
Language, 44 Cardozo L. Rev. 2361, 2367 (2023).	6
{32} 	Purchasers of a cyber insurance policy often have little knowledge about the	7
breadth and sophistication of the cybersecurity risks they face. Id. at 2408. The	8
insurers are far more knowledgeable. This imbalance is exacerbated by the lack of	9
standard policy language among insurers to define or limit coverage. Id. at 2373. A	10
business purchasing cybersecurity coverage is unlikely to imagine all of the	11
consequences of the increasingly sophisticated methods of breaching computer	12
security and may view the insurance policy as protecting against all but the most	13
clearly stated exceptions to coverage. See Sanchez, 1989-NMSC-073, ¶ 21 (noting	14
that “[t]he typical insured does not bargain for individual terms within policy	15
clauses,” making “only broad choices regarding [the] general concepts of coverage,	16
risk, and cost”).	17
{33} 	Again, although this context and history of cyber risks and cyber insurance is	18
not alone dispositive on the question of ambiguity, it is another indication that the	19

18
phrase “for a security breach” would not have a single, obvious meaning to an	1
insured.	2
C. 	The Phrase “for a Security Breach” Is Ambiguous	3
{34} 	Because every one of the aids this Court looks to for assistance in determining	4
whether a phrase or a word in an insurance policy is ambiguous supports multiple	5
reasonable meanings of the phrase at issue here and of the word “for,” we hold that	6
the phrase is ambiguous. We interpret an ambiguous phrase in an insurance policy	7
as purely a question of law, and we construe ambiguity in a policy in the insured’s	8
favor. United Nuclear Corp., 2012-NMSC-032, ¶ 39. We, therefore, agree with the	9
district court that the Policy’s coverage includes claims of loss “because of,”	10
resulting from,” or “on account of” a security breach.	11
IV. 	The Exclusions Do Not Apply	12
{35} 	We now turn to the two loss of money exclusions that Beazley argues bars	13
coverage. Exclusionary clauses are construed under the same rules of construction	14
that apply to coverage provisions. “It is the obligation of the insurer to draft an	15
exclusion that clearly and unambiguously excludes coverage.” Computer Corner,	16
Inc. v. Fireman’s Fund Ins. Co., 2002-NMCA-054, ¶ 7, 132 N.M. 264, 46 P.3d 1264.	17
Generally, if ambiguous, we construe exclusionary clauses in insurance contracts	18
narrowly against the insurer. See Knowles v. United Servs. Auto. Ass’n, 1992-	19
NMSC-030, ¶ 9, 113 N.M. 703, 832 P.2d 394.	20

19
A. 	The Money Was Not “Lost, Diminished, or Damaged During Transfer”	1
{36} 	Section three of the loss of money exclusion states that coverage under the	2
Policy will not apply to any loss of monetary value “during transfer from, into or	3
between accounts.” Beazley summarily states that this exclusion applies to deny	4
coverage for OptumRX’s third-party claim, without explaining the basis for its belief	5
that this language clearly covers the loss of the NMHC payments transferred to a	6
fraudulent address, apparently without a loss in value of the funds during the	7
transfer. There are no facts in the summary judgment record showing that the transfer	8
was flawed or the security of the transfer breached “during transfer.”	9
{37} 	We employ a presumption of correctness in the rulings of the district court,	10
and the burden is on the appellant to clearly demonstrate error. See Farmers, Inc. v.	11
Dal Mach. & Fabricating, Inc., 1990-NMSC-100, ¶ 8, 111 N.M. 6, 800 P.2d 1063.	12
In the absence of a developed argument by Beazley, we decline to address this issue	13
further. See State v. Dickert, 2012-NMCA-004, ¶ 46, 268 P.3d 515.	14
B. 	The Funds Were Not in the “Care, Custody or Control” of NMHC	15
{38} 	Beazley next argues that the funds transferred pursuant to the fraudulent	16
instructions were in the “care, custody or control” of NMHC and that, therefore, the	17
Policy’s loss of money exclusion applies. This section excludes coverage under the	18
Policy for any loss, transfer or theft of money “in the care, custody or control of the	19
insured organization.” The district court concluded that the stolen money was not in	20

20
the “care, custody or control” of NMHC; it was in the “care, custody, and control of	1
Wells Fargo Bank.” Therefore, this exclusion from coverage did not apply.	2
{39} 	Beazley argues that the phrase “care, custody or control” should be read	3
disjunctively, requiring this Court to find only that NMHC had “control” of the funds	4
in its Wells Fargo account for the exclusion to apply. The dispute between the parties	5
as to the meaning of this exclusion turns on whether the words “care, custody or	6
control,” are to be understood in the disjunctive, as independent words separately	7
defined in the law, or whether the phrase “care, custody or control,” is a phrase with	8
its own meaning in the law.	9
{40} 	We first note that neither the individual words nor the phrase “care, custody	10
or control” are defined in the Policy. Given the absence of a definition in the Policy,	11
we turn to New York law to resolve this issue. Although the parties have agreed that	12
New Mexico law is the same as New York law as to the principles governing the	13
construction of an insurance policy, on the question of the meaning of a phrase used	14
in the Policy, the Policy directs that we apply New York law. We honor the plain	15
language of the parties’ choice of law contract term.	16
{41} 	New York courts have repeatedly construed “care, custody or control,” as a	17
phrase with a particular meaning in the law.6 Moreover, commentators have agreed	18
6See, e.g., Greater N.Y. Mut. Ins. Co. v. Pro. Sec. Bureau, Ltd., 402 N.Y.S.2d
448 (N.Y. App. Div. 1978); Broome Cnty. v. Travelers Indem. Co., 451 N.Y.S.2d
272 (N.Y. App. Div. 1982).

21
that “care, custody or control” is an established legal phrase or term of art widely	1
used in the insurance context to denote exclusive physical dominion over property.	2
See generally 9 Couch on Insurance § 126:22, Westlaw (database updated June	3
2025).	4
{42} 	The question under New York law, then, is whether the depositor, NMHC, or	5
the bank, Wells Fargo, had exclusive dominion over the property—the money in	6
NMHC’s account—at the time the payment at issue was made. Our research shows	7
that “[i]t is well-settled under New York law that the relationship between a bank	8
and its depositor is the contractual relationship of debtor and creditor and the amount	9
on deposit represents an indebtedness by the bank to the depositor.” Reichling v.	10
Cont’l Bank, 813 F. Supp. 197, 198 (E.D.N.Y. 1993); see 9 NY Jur. 2d, Banks,	11
§ 226, Westlaw (database updated May 2025). Under New York law, “the money	12
deposited with the bank belongs to the bank and is not the property of the depositor.”	13
Reichling, 813 F. Supp. at 198 (emphasis added) (alteration, internal quotation	14
marks, and citation omitted). New York law, therefore, arguably places the “care,	15
custody or control” of a depositor’s funds with the bank holding the account. NMHC	16
deposited the funds with Wells Fargo; Wells Fargo, under contract, had the funds in	17
its “care, custody and control” at the time the money was transferred. The body of	18
New York law we reference is sufficient to allow a reasonable insured to conclude	19
that this exclusion did not apply to funds placed in the protection of a bank account,	20

22
and only applied to property, securities and funds directly held in the “care, custody	1
and control” of NMHC.	2
CONCLUSION	3
{43} 	Because a reasonable insured would construe the ambiguous coverage term at	4
issue to afford coverage and would not read the exclusions to apply here, we affirm.	5
{44} 	IT IS SO ORDERED.	6
_________________________	7
JANE B. YOHALEM, Judge	8
WE CONCUR:	9
___________________________	10
J. MILES HANISEE, Judge	11
___________________________	12
MEGAN P. DUFFY, Judge	13