(Bloomberg) --The Regents of the University of California sued Lloyd's of London, arguing the company refused to reimburse the university system for the costs of data breaches covered in a cyber insurance policy.
The dispute is over a cyber attack from 2014 through 2015 that potentially exposed personal information of patients at UCLA Health.
The University of California paid millions of dollars to notify targets of the attack and limit it, and to defend and settle lawsuits filed by patients, but underwriters at Lloyd's have "repeatedly denied coverage" for losses from the incident, according to the complaint filed in Los Angeles Superior Court. The Regents are 26 board members who govern the UC system.
Cyber insurance premiums in the US surged 50% last year, as increased ransomware attacks and online commerce drove demand for coverage. Premiums collected from policies written by insurers reached $7.2 billion in 2022 and tripled in the past three years, according to ratings firm AM Best.
The defendants named in the suit are associations of underwriters, known as "syndicates," operating in the Lloyd's of London insurance market in the UK. The underwriters had argued in a 2015 letter that the University of California didn't comply with provisions of the policy, according to the complaint.
Read More: Cyber-Insurance Premiums to Double to $23 Billion in Three Years
The university says the underwriters incorrectly argue that the statute of limitations for any coverage claim expired in June 2021, four years after coverage was denied. Under state law and rules, the statute of limitations was paused until the final ruling in the litigation filed by UCLA Health patients, according to the complaint.
Lloyd's of London didn't immediately respond to an email seeking comment on the suit. The suit was reported earlier by the Wall Street Journal.
The case is Regents of the University of California v. Certain Underwriters at Lloyd's, 238TCV14642, California Superior Court (Los Angeles).
