Star Entertainment Group Limited & Ors v Chubb Insurance Australia Ltd & Ors

The Full Federal Court of Australia heard an appeal concerning a dispute between The Star Entertainment Group Limited and its related entities (the appellants) and Chubb Insurance Australia Ltd and other insurers (the respondents). The dispute arose from the insurers' refusal to indemnify the Star entities under a cyber insurance policy for losses incurred following a ransomware attack in 2022. The Star entities sought declarations that the insurers were liable to indemnify them for these losses.

The central legal issue before the Full Federal Court was the interpretation of the cyber insurance policy, specifically whether the insurers were entitled to avoid liability based on certain exclusions. The primary question was whether the policy's "System Failure" exclusion applied to the losses suffered by the Star entities as a result of the ransomware attack, and whether the "Cyber Attack" exclusion, which was introduced by endorsement, was intended to operate as a carve-back to the System Failure exclusion or as a separate exclusion.

The Full Federal Court reasoned that the System Failure exclusion was not engaged because the loss was not caused by a failure of the Star entities' systems, but rather by the malicious actions of third parties. The Court further held that the Cyber Attack exclusion, introduced by endorsement, was intended to operate as a carve-back to the System Failure exclusion, meaning that if a loss was caused by a cyber attack, it would not be excluded by the System Failure exclusion. Consequently, the Court found that the ransomware attack fell within the scope of coverage under the policy, as it was a cyber attack and not a system failure.

The Full Federal Court allowed the appeal, set aside the orders of the primary judge, and remitted the matter to the Federal Court for further determination of the quantum of the appellants' loss and any other outstanding issues.