The Sixth Circuit Court of Appeals ruled that a loss resulting from a cyberattack is not covered by the insured’s CGL policy. The case is Home Depot, Inc. v. Steadfast Ins. Co., 2025 U.S. App. LEXIS 687 (6th Cir. 2025).

Home Depot was the victim of a cyber attack, where unauthorized individuals hacked the company’s computer system and took the payment card information of more than 10 million consumers from self-checkout stations. When Home Depot publicly announced the breach, numerous financial institutions filed suit, seeking to recover funds they had expended in notifying their clients of the breach and responding to its effects. Those claims ultimately settled for almost $170 million.

In addition to an aggregated $1 million in cyber coverage, Home Depot had purchased an aggregated $50 million in CGL coverage from Steadfast Insurance Company and Great American Assurance Company (collectively, Steadfast). These policies covered both the loss of use of undamaged physical property and “physical damage to tangible property.”