* IN THE HIGH COURT OF DELHI AT NEW DELHI + ARB.P. 1209/2023 PAYU PAYMENTS PRIVATE LIMITED .....Petitioner Through: Mr. Rajeeve Mehra, Sr. Adv. with Mr. V. Anush Raajan and Ms. Tanisha Dhoot, Advs.

versus THE NEW INDIA ASSURANCE CO LTD .....Respondent Through: Dr. Amit George, Ms. Gurkaranbir Singh and Mr. Dushyant Kishan Kaul, Advs.

CORAM:

HON'BLE MR. JUSTICE C. HARI SHANKAR JUDGMENT (ORAL)

% 18.09.2024

1. This is a petition under Section 11(6) of the Arbitration and Conciliation Act, 1996, $~2, for reference of the disputes between the parties to arbitration.

2. The disputes arise in the context of two insurance policies, Policy 33 and Policy 34, dated 31 March 2018 executed between the petitioner and the respondent.

3. The petitioner through an insurance broker, Howden Insurance Brokers (India) Pvt Ltd, Signature Not Veri2fi“eHdowden”,hereinafter Signature Not Verified, availed two insurance policies, i.e. Package Liability Policy No. 930000361717000033 (Policy 33) for a sum

1“the1996Act”,hereinafter

assured of ₹ 20 crores and Package Liability Policy No. 93000036170000034 (Policy 34) for a sum assured of ₹ 6.5 Crores from the respondent Company. The policies were availed to cover various risks associated with cyber and computer related security breaches.

4. On 7 April 2018, the petitioner was informed about some fraudulent transactions on the Core PG Payment Platform, affecting two of its banking partners, the South Indian Bank and the UCO Bank, by one of its merchant partners, Thomas Cook (I) Ltd. On account of the said attack, the petitioner is stated to have suffered losses in excess of ₹ 8,58,12,965.

5. As the cyber attack by the miscreants amounted to “e-theft”, within the definition of the expression under Policy 33 and “External Crime Theft” under Policy 34, the petitioner, through Howden, lodged an insurance claim for a total loss of ₹ 8,58,12,965 with the respondent, under both the policies. The claims were lodged by Howden in the form of composite claims in view of the overlapping cause and composite facts.

6. As a result, BDO India LLP, Signature Not Veri3fi“eBdDO”,hereinafter Signature Not Verified, was appointed as a forensic investigator to assess the loss that the petitioner had incurred. According to the draft forensic report of BDO under both the policies, the damages incurred by the petitioner were ₹ 2,91,30,467, which was said to be covered under both the policies.

7. Despite of the BDO’s report and multiple attempts from the petitioner’s end towards the settlement of the claims, the respondent did not proceed with any arrangement to settle the claim amount.

8. On 29 June 2021, the petitioner issued a Legal Notice to the respondent requesting for release of the complete insurance claim amount within four weeks.

9. After a delay of over four years, the respondent, vide its Repudiation Letters dated 25 October 2022, rejected all the claims under both the policies by relying on the Proclaim Surveyors & Loss Assessors Pvt Ltd’s, Signature Not Veri 4 fi“ePdroclaim”,hereinafter Signature Not Verified report. In the letters, it was mentioned by the respondent that the cyber-attack occurred in the vulnerable networks of the Banks and not that of the petitioner. Hence, it was stated by the respondent that it did not fall under either of the policies.

10. On 11 January 2023, the petitioner issued a Letter of Protest through which it denied the repudiation and also requested the respondent to withdraw the Repudiation Letters. The petitioner also directed the respondent to furnish the reports mentioned in the Repudiation Letters.

11. The insurance policies were taken in a composite manner and it was for the first time in the repudiation letters that both the policies were separately considered.

12. As the disputes arose out of the common cause of action under Policy 33 and 34 between the parties, the petitioner addressed a notice to the respondent under Section 21 of the 1996 Act on 22 July 2023 seeking reference of the disputes to a