Not upheld: claim decline and coverage decision; claims handling complaint against Hiscox Insurance Company Limited (trading as Hiscox)

Decision detail

Summary

R, a company directed by Mr S, claimed on its business protection insurance policy following a data breach by a former employee who obtained customer information and used it in their own business. Hiscox initially declined the claim but later accepted it for cyber and data cover, appointing loss adjusters and experts to investigate. Hiscox declined cover for business interruption, losses from crime, and full legal costs, paying only 50% of costs related to court proceedings. R complained about the coverage decisions and claims handling. The ombudsman found that while the policy terms were complex, it was fair to apply the amended definition introduced at the March 2024 renewal which removed cover for 'dishonesty of an employee' and 'loss of assets', as R had been informed of this change and Mr S had confirmed reviewing the documents without objection. The ombudsman found Hiscox's handling of other aspects of the claim to be reasonable and in line with the policy terms, and declined to uphold the complaint.

The Ombudsman's reasoning

The ombudsman applied the policy terms as the starting point for determining coverage. While initially considering that loss of data might constitute a 'loss of assets' and that diverted funds might be covered, the ombudsman ultimately concluded it was fair to apply the amended policy definition introduced at the March 2024 renewal, which removed cover for 'dishonesty of an employee' and 'loss of assets'. The key date for determining applicable policy terms was when the loss was discovered (May 2024, after the March 2024 renewal), not when the loss occurred. The ombudsman found that R was adequately informed of the change through the broker's pre-renewal report and that Mr S's failure to query the change, despite confirming he had reviewed the documents, meant it was fair to apply the new definition. The ombudsman also found that Hiscox's handling of other aspects of the claim (cyber and data cover, legal costs allocation, crisis containment, and repeat event mitigation) was reasonable and in line with the policy terms. The ombudsman declined to comment on the solicitors' actions as they are separately regulated, and declined to award compensation for Mr S's personal distress as the policyholder is a limited company.

How this compares

Source

Read the original decision on the Financial Ombudsman Service website