A ransomware attack in May 2023 shut down most of Crash Champions' operations. The auto body repair company had bought a $10 million Stand-Alone Cyber Policy from Coalition just three months earlier. Coalition paid out more than $5 million on the claim, then stopped, leaving roughly $4.89 million unpaid, according to the policyholder's lawsuit.
The intriguing part isn't the payment dispute. It's who Crash Champions sued: not the six insurers listed in the policy declarations as the parties obligated to pay covered losses, but Coalition Inc. and its subsidiary Coalition Insurance Solutions, the managing general agent (MGA) that sold, signed, and administered the policy.
On Monday, Cook County Circuit Judge James E. Hanlon Jr. ruled that Crash Champions can proceed with breach-of-contract and unreasonable delay claims against Coalition Insurance Solutions. The decision hinges on ambiguities in the policy's language about who actually owes what.
The Challenge
Managing general agents occupy a unique position in the insurance chain. They're authorized by insurers to underwrite, bind, and settle claims on their behalf, but they don't bear the underwriting risk. That risk sits with the quota share insurers listed in the policy declarations.
Coalition's stance was clear: they promised nothing under this policy. The six insurers listed in the declarations are the ones obligated to pay covered losses. They're just the administrator.
However, the policy's language didn't support that clear separation. Coalition Insurance Solutions signed the policy's signature page, which states the document is the entire contract "between us" and the insured. The policy's coverage grants promise that "we" will pay covered losses. The policy defines "we, us or our" as "the Company providing this Policy," a capitalized term that the 113-page document never actually defines.
Coalition's name and logo appear on nearly every page of the policy document. The claims mailbox belongs to Coalition. No insurer ever communicated directly with Crash Champions, according to the amended complaint.
The Environment and Constraints
Judge Hanlon faced a contract interpretation problem with real consequences. If he dismissed the claims against Coalition Insurance Solutions, Crash Champions would need to pursue six separate insurers for the unpaid portion of its claim. Allowing the claims to proceed means treating an MGA as if it had contractual obligations typically reserved for risk-bearing insurers.
The policy language gave him little to work with. "The Company" appears throughout the document but is never defined. The signature page creates the impression that Coalition Insurance Solutions is a party to the contract. The coverage grants use "we" without clarifying whether that means the MGA or the insurers.
These ambiguities aren't unusual in cyber insurance policies, especially those written through MGA programs. The MGA handles everything the policyholder sees: marketing, underwriting, claims administration. The insurers remain invisible until something goes wrong.
The Approach Taken
Judge Hanlon applied a principle familiar to anyone who's litigated insurance coverage: ambiguities in policy language are construed against the drafter. Coalition argued that "the Company" clearly meant the quota share insurers. Crash Champions argued it meant the company whose name is on the cover, signature page, and claims mailbox.
The judge found Crash Champions' reading reasonable. "If Coalition intended the payment obligation to rest only with the quota share insurers, the Policy needed to say so with clarity," he wrote.
He also considered Coalition's post-loss conduct. According to the complaint, Coalition took in the claim, hired and directed forensic accountants, decided what to pay, and demanded a release in its own name before paying it. That conduct, the judge found, "prevent the Court from coming to (the) conclusion" that Coalition Insurance Solutions owes nothing under the policy.
Coalition Inc., the parent company, fared better. It had attached a marketing brochure to the policy that says, "We provide comprehensive insurance coverage" and "we'll cover the costs" of a ransomware event. But those pages carry a footer disclaiming that the brochure is not part of the policy. Judge Hanlon found the attachment insufficient to establish a legal contract between Crash Champions and Coalition Inc., dismissing the claims against the parent.
Results and Metrics
Coalition Insurance Solutions now faces breach-of-contract and unreasonable delay claims in Cook County Circuit Court. The company will need to either settle with Crash Champions or defend itself at trial on the merits of the coverage dispute.
The ruling doesn't resolve the underlying question of whether Crash Champions is owed the remaining $4.89 million. It simply establishes that Coalition Insurance Solutions can be held legally responsible for that determination.
For Coalition, the immediate cost is litigation defense. The long-term cost could be significantly higher if the court ultimately finds that the MGA is contractually obligated to pay the full policy limit.
What They Would Do Differently
The fix is straightforward: define "the Company" in the policy definitions section. State explicitly whether "we, us or our" refers to the MGA, the quota share insurers, or both jointly and severally. Include a provision clarifying that the MGA is acting as administrator only and that all payment obligations rest with the insurers listed in the declarations.
On the signature page, have the insurers sign, not just the MGA. If the MGA must sign for administrative purposes, include language stating that the signature is for binding authority only and does not create a contractual obligation to pay claims.
In post-loss administration, maintain clear separation between the MGA's administrative role and the insurers' payment obligations. Have insurers communicate directly with policyholders on coverage decisions, even if the MGA coordinates logistics.
Takeaways for Your Team
If you're buying cyber insurance through an MGA program, read the signature page and definitions section carefully. Ask your broker: who am I actually contracting with? If the policy says "we" will pay covered losses, who is "we"? Are the insurers listed anywhere in the policy document, or only in the declarations?
Request that the policy explicitly define the MGA's role and the insurers' obligations. If the MGA's name appears on every page but the insurers are invisible, you're setting yourself up for exactly the confusion that led to this lawsuit.
During claims administration, document who makes coverage decisions. If the MGA is directing forensic accountants and deciding what to pay, confirm in writing that it's acting on behalf of the insurers and that the insurers have authorized those decisions.
For MGAs and program administrators, this case is a warning about scope creep. If you act like an insurer, communicate like an insurer, and demand releases in your own name, don't be surprised when a court treats you like an insurer. Clarify your role in the policy language, not just in internal documentation the policyholder never sees.
The principle is simple: ambiguity creates liability. In a $10 million policy dispute, that's an expensive lesson.
