2025 IL App (1st) 250754-U FIRST DIVISION November 24, 2025

No. 1-25-0754 NOTICE: This order was filed under Supreme Court Rule 23 and is not precedent except in the limited circumstances allowed under Rule 23(e)(1). ______________________________________________________________________________ IN THE APPELLATE COURT OF ILLINOIS FIRST JUDICIAL DISTRICT ______________________________________________________________________________ VILLA FINANCIAL SERVICES, LLC, ) Appeal from the Circuit ) Court of Cook County.

Plaintiff-Appellant, ) ) v. ) No. 24 CH 4936 ) UNDERWRITERS AT LLOYD’S OF LONDON AND ) OTHER INSURERS SUBSCRIBING TO POLICY NO. ) ESK0339447455, ) Honorable ) Eve M. Reilly, Defendant-Appellee. ) Judge Presiding. ______________________________________________________________________________ JUSTICE HOWSE delivered the judgment of the court.

Presiding Justice Fitzgerald Smith and Justice Cobbs concurred in the judgment.

ORDER ¶1 Held: We affirm the trial court’s entry of judgment on the pleadings for defendant.

Defendant was entitled to judgment as a matter of law because there is no set of facts that could entitle plaintiff to relief on its claim for coverage.

¶2 Plaintiff filed this case seeking a declaration that it was entitled to recover expenses it incurred after a cyberattack under an insurance policy issued by defendant. A vendor who provided employee payroll services for plaintiff became unable to provide the service after it came under a ransomware attack. Plaintiff opted to use out-of-date payroll records to pay employees during the disruption of service resulting in an overpayment of over $1 million.

Plaintiff filed a complaint for a declaratory judgment claiming that, under the insurance contract, 1-25-0754 defendant was required to reimburse plaintiff for the excess sums it paid to its employees.

Defendant filed a motion for judgment on the pleadings. The trial court granted defendant’s motion and entered a judgment of no liability in defendant’s favor. Plaintiff appeals and, for the following reasons, we affirm.

¶3 BACKGROUND ¶4 Plaintiff Villa Financial Services, LLC is an Illinois company that serves as the management company of multiple nursing care facilities. Plaintiff contracted with Ultimate Kronos Group (Kronos) for payroll compliance services in order to pay the employees of those care facilities. On December 14, 2021, Kronos notified plaintiff that it was experiencing a ransomware cyberattack. As a result of the ransomware attack, plaintiff was unable to initiate its normal payroll processes, but plaintiff needed to meet its payroll obligations, so it paid the employees based on data from prior payroll periods. As a result, some employees at the care facilities were overpaid and some were underpaid. The disruption to the payroll services resulted in a net overpayment of more than $1.2 million to the employees.

¶5 Plaintiff attempted to negotiate with Kronos to reach an agreement to address the loss caused by plaintiff’s inability to access its payroll services. No agreement was reached. Plaintiff then submitted a claim to defendant Lloyd’s of London for reimbursement for the loss it incurred due to the ransomware attack on Kronos.

¶6 Plaintiff had previously purchased insurance coverage from defendant to protect it from losses stemming from cybercrime. Under the Cyber Private Enterprise Policy that plaintiff purchased from defendant, plaintiff was insured against system damage and business interruption. By the terms of the policy, plaintiff is entitled to reimbursement for income loss and

-2- 1-25-0754 “extra expense” as a result of computer system downtime arising from a cyber event or system failure.

“Section B: Income Loss and Extra Expense We agree to reimburse you for your income loss and extra expense during the indemnity period as a direct result of an interruption to your business operations caused by computer systems downtime arising directly out of a cyber event or system failure which is first discovered by you during the period of the policy, provided that the computer systems downtime lasts longer than the waiting period.”

The policy defines “extra expense” as “reasonable sums necessarily incurred *** to mitigate an interruption to and continue your business operations ***.”

¶7 Additionally, under the Cyber Private Enterprise Policy that plaintiff purchased from defendant, plaintiff was insured against “dependent business interruption.” By the terms of the policy, plaintiff is entitled to reimbursement for income loss and extra expense sustained as a result of any computer system outage by one of plaintiff’s supply chain partners.

“SECTION D: DEPENDENT BUSINESS INTERRUPTION We agree to reimburse you for your income loss and extra expense sustained during the indemnity period as a direct result of an interruption to your business operations arising directly out of any sudden, unexpected and continuous outage of computer systems used directly by a supply chain partner which is first discovered by you during the period of the policy, provided that the computer systems downtime lasts longer than the waiting period and arises directly out of any cyber event or system failure.”

-3- 1-25-0754 ¶8 Plaintiff contended that it was entitled to coverage and reimbursement under the policy for the losses it sustained as a result of the ransomware attack on Kronos. Defendant rejected plaintiff’s claim on the basis that the payroll overpayments made by plaintiff did not constitute “extra expense” under the policy. Plaintiff filed this lawsuit.

¶9 In its complaint for a declaratory judgment, plaintiff alleged that defendant wrongfully refused to provide coverage for the overpayments caused by the ransomware attack. Plaintiff alleged that the overpayments constitute an “extra expense” under the terms of the policy and, thus, it was entitled to coverage. Plaintiff sought a declaration of coverage. Defendant filed an answer denying liability and subsequently filed a motion for judgment on the pleadings.

¶ 10 In its motion for judgment on the pleadings, defendant argued that plaintiff will never be able to establish “extra expense” coverage under the policy. Defendant contended that plaintiff could not show that the payroll overpayments were “necessarily incurred” as would be required for coverage. Defendant also argued that plaintiff could not show that it mitigated its damages.

Defendant contended that plaintiff breached its duty to mitigate by failing to attempt to recover the overpayments it made to its employees as a result of the cyberattack. The motion was fully briefed by the parties.

¶ 11 On December 30, 2024, the trial court granted defendant’s motion for judgment on the pleadings. The trial court held that plaintiff “fail[ed] to allege sufficient facts” to show how the overpayment was “essential, indispensable, or requisite for it to continue its business operations.” Therefore, according to the trial court, plaintiff “has failed to show the net overpayments were an ‘extra expense’ under the policy.” The trial court granted defendant’s motion for judgment on the pleadings, entered judgment in defendant’s favor on all counts, and explained that the judgment disposed of the case in its entirety.

-4- 1-25-0754 ¶ 12 On January 28, 2025, plaintiff filed a motion to reconsider. Plaintiff argued in its motion to reconsider that the trial court misapplied Illinois law when it disposed of the matter based on a supposed pleading deficiency without giving plaintiff the opportunity to replead. Plaintiff suggested that the trial court applied the standard usually utilized for analyzing a motion to dismiss for failure to state a claim when it ruled on the motion for judgment on the pleadings, which is more like a motion for summary judgment.

¶ 13 Plaintiff pointed out in its motion to reconsider that the basis for the dismissal was the failure to allege sufficient facts and that, if given the opportunity to amend its complaint, it could plead facts to show that the overpayments it made were necessary to the continuation of its business operations to invoke coverage under the policy. In particular, plaintiff stated that it could plead facts to show that it could not have made its payroll payments in any other manner than it did and that making the payments was necessary for it to continue its business operations.

¶ 14 In ruling on the motion to reconsider, the trial court conceded that there was an error in its original order where it purported to base its decision to enter judgment for defendant on plaintiff’s failure to allege sufficient facts to support its claim. The trial court, therefore, explained that it would “amend the December 30, 2024 order for clarity and enter the amended order separately nunc pro tunc.” The trial court explained that it had entered judgment for defendant “because it found, as a matter of law, that Plaintiff’s overpayments were not an ‘extra expense’ under the policy.” The trial court then stated that the motion to reconsider was denied.

That order was entered on March 25, 2025.

¶ 15 The trial court filed its “order amending the December 30, 2024 order nunc pro tunc” simultaneously with its order denying plaintiff’s motion to reconsider. In its amended order, the trial court explained that it was not essential, indispensable, or requisite for plaintiff to pay its

-5- 1-25-0754 employees more than they were owed in order to continue its business operations. Therefore, the trial court held, the overpayments made by plaintiff are not an “extra expense” under the policy.

Plaintiff filed its notice of appeal on April 23, 2025.

¶ 16 ANALYSIS ¶ 17 I. Appellate Jurisdiction ¶ 18 As an initial matter, defendant argues that we lack jurisdiction to review the judgment in this case. Defendant argues that plaintiff’s motion to reconsider was “substantively directed only at securing leave to amend.” Defendant argues that a postjudgment motion seeking leave to amend is not “directed against the judgment” and, thus, does not extend the time for filing an appeal (citing Berg v. Allied Security, Inc., 193 Ill. 2d 186, 189 (2000); Fultz v. Haugan, 49 Ill. 2d 131, 135-36 (1971)).

¶ 19 Jurisdiction is conferred upon the appellate court only through the timely filing of a notice of appeal. Archer Daniels Midland Co. v. Barth, 103 Ill. 2d 536, 538 (1984). Under Supreme Court Rule 303(a), a notice of appeal must be filed: “within 30 days after the entry of the final judgment appealed from, or, if a timely post-trial motion directed against the judgment is filed, * * * within 30 days after the entry of the order disposing of the last pending post-judgment motion.” Ill. S.

Ct. R. 303(a) (West 2022) (eff. July 1, 2017).

Our supreme court has explained that “directed against the judgment,” for purposes of Rule 303(a) means that the motion seeks rehearing, retrial, modification or vacation of the judgment, or for other relief similar in nature to the foregoing types of relief. Fultz, 49 Ill. 2d at 136. Thus, for example, our courts have held that motions seeking leave to amend a complaint, motions for stays pending appeal, and postjudgment requests for attorney fees are not “directed against the

-6- 1-25-0754 judgment” and do not toll the time requirement for filing an appeal. See Marsh v. Evangelical Covenant Church of Hinsdale, 138 Ill. 2d 458, 463-64 (1990).

¶ 20 In its motion to reconsider, plaintiff sought both to have the judgment set aside and be given leave to replead. Plaintiff argued in the motion to reconsider that the final judgment should be undone because it was erroneous and should not have been entered. We have found motions with similar types of relief requested to be sufficient postjudgment motions to toll the period for filing an appeal. See Muirfield Village-Vernon Hills, LLC v. K. Reinke, Jr. & Co., 349 Ill. App. 3d 178, 186 (2004). Here, plaintiff’s postjudgment motion attacks the trial court’s original judgment and caused the trial court to amend its order with an entirely new rationale for the judgment. Plaintiff’s arguments were directed at the judgment for purposes of Rule 303(a) as the motion sufficiently sought rehearing, retrial, modification or vacation of the judgment, or other relief as is necessary to extend the period for filing a notice of appeal. See Fultz, 49 Ill. 2d at 136.

Accordingly, plaintiff’s notice of appeal was timely filed, and we have jurisdiction over this appeal.

¶ 21 II. Whether Overpayments Were a Necessary Extra Expense ¶ 22 In determining that defendant was entitled to a judgment of no liability, the trial court held, as a matter of law, that the overpayments plaintiff made to its employees were not expenses “necessarily incurred” for the continuation of its business so as to be considered “extra expense” under the policy. We must determine if it was proper for the trial court to enter judgment on the pleadings in defendant’s favor, which we review de novo. M.A.K. v. Rush-Presbyterian-St.- Luke’s Medical Center, 198 Ill. 2d 249, 255 (2001).

¶ 23 According to section 2–615(e) of the Code of Civil Procedure, “[a]ny party may seasonably move for judgment on the pleadings.” 735 ILCS 5/2–615(e) (West 2022). Judgment

-7- 1-25-0754 on the pleadings is properly granted if the pleadings disclose no genuine issue of material fact and that the movant is entitled to judgment as a matter of law. M.A.K., 198 Ill. 2d at 255. “For purposes of resolving the motion, the court must consider as admitted all well-pleaded facts set forth in the pleadings of the nonmoving party, and the fair inferences drawn therefrom.” Pekin Insurance Company v. Wilson, 237 Ill. 2d 446, 455 (2010) (quoting Employees Insurance of Wausau v. Ehlco Liquidating Trust, 186 Ill. 2d 127, 138 (1999)).

¶ 24 An insurance policy is construed like any contract, so the determination of the parties’ rights and obligations thereunder is a question of law. Zurich American Insurance Co. v. Infrastructure Engineering, Inc., 2023 IL App (1st) 230147, ¶ 40. In construing an insurance policy, we must ascertain and give effect to the intentions of the parties, as expressed in the policy language. West American Insurance Co. v. Yorkville National Bank, 238 Ill. 2d 177, 184 (2010). A contract must be interpreted as a whole and the plain and ordinary meaning must be ascribed to unambiguous terms. Palm v. 2800 Lake Shore Drive Condominium Ass'n, 2014 IL App (1st) 111290, ¶ 75. The terms of an unambiguous insurance policy should be enforced as written. Zurich, 2023 IL App (1st) 230147, ¶ 40.

¶ 25 Under the Cyber Private Enterprise Policy at issue here, plaintiff is entitled to reimbursement for “extra expense” incurred as a result of computer system downtime arising from a cyber event.

“Section B: Income Loss and Extra Expense We agree to reimburse you for your income loss and extra expense during the indemnity period as a direct result of an interruption to your business operations caused by computer systems downtime arising directly out of a cyber event or system failure ***.”

-8- 1-25-0754 The policy defines “extra expense” as “reasonable sums necessarily incurred *** to mitigate an interruption to and continue your business operations *** (emphasis added).”

¶ 26 The complaint in this case sets out that plaintiff suffered a loss when its payroll compliance service suffered a ransomware attack. Because of the cyberattack, plaintiff was unable to initiate its normal payroll processes and it ended up overpaying its employees more than $1 million. Plaintiff asked the trial court to “find and declare that the net payroll overpayments constitute an ‘extra expense’ under the policy.”

¶ 27 In ruling on the motion for judgment on the pleadings, the trial court held that the overpayments plaintiff made to its employees were not expenses that were “necessarily incurred” because it was not necessary for plaintiff to pay its employees more than they were owed in order to continue its business operations. The trial court relied on Chatham Corporation v. Dann Insurance, 351 Ill. App. 3d 353 (2004) to determine that defendant was entitled to judgment. We agree that the case is instructive here.

¶ 28 In Chatham, the plaintiff-company was in the business of sterilizing medical products. Id. at 355. The plaintiff secured insurance coverage for “Extra Expense,” which was defined as “necessary expenses you incur during the ‘period of restoration’ that you would not have incurred if there had been no direct physical loss or damage to [covered] property.” Id. ¶ 29 An equipment explosion shut down the plaintiff’s facility for seven months. Id. The defendant-insurer paid roughly $1 million of the extra expense claimed by the plaintiff, but it denied roughly $1 million of other extra expense claimed. Id. The Chatham court explained the situation of the extra expense claimed by plaintiff in more detail.

“[D]uring the restoration period, [the plaintiff] could not sterilize the products of its main customer, a corporation now known as Maxxim Medical, Inc. (Maxxim).

-9- 1-25-0754 [The plaintiff’s] contract with Maxxim required [the plaintiff] to find alternate sterilization facilities and to pay the cost of shipping Maxxim's unsterilized goods from [the plaintiff’s facility] to the alternate facilities (Maxxim’s “inbound freight”). [The plaintiff] performed these contractual obligations, and [the defendant] reimbursed [the plaintiff] for the resulting extra expenses. However, [the plaintiff] was not contractually obligated to pay and never paid the costs of shipping Maxxim's sterilized products from the alternate facilities (Maxxim’s “outbound freight”) to Maxxim’s customers. [The defendant] concluded that because [the plaintiff] was not contractually required to pay Maxxim’s outbound freight costs, those costs were not ‘necessary,’ and, therefore, not covered extra expenses.” Id. The plaintiff in Chatham filed a complaint against the defendant based on the defendant’s refusal to pay for the outbound freight costs. Id. at 356. The trial court granted summary judgment in favor of the defendant-insurer. Id. On appeal, we held that the policy language was not ambiguous and the coverage was limited to “necessary expenses” the plaintiff incurred while its facility was nonoperational. Id. at 358. We explained that, “[a]lthough the policy does not specifically define the word ‘necessary,’ that word is not ambiguous and has a plain, ordinary, and popular meaning of ‘being essential, indispensable, or requisite.’ ” Id. (citing Random House Webster’s Unabridged Dictionary 1883–84 (1998)).

¶ 30 Expenses were not necessary if they were expenses “that the insureds may have wanted to incur on a gratuitous or voluntary basis, which would have been the opposite of ‘necessary.’ ” Id. at 359. We explained that “[e]ven though Maxxim’s outbound freight expenses were a consequence of the explosion at [plaintiff’s] sterilization facilities, they were not covered by the

- 10 - 1-25-0754 insurance contract at issue.” Id. at 359.

¶ 31 In this appeal defendant argues that “only amounts paid to satisfy a preexisting obligation are ‘necessarily incurred’ for purposes of extra expense coverage.” Defendant suggests that the only amounts necessary for the continued operations of the care facilities were the amounts the employees were actually owed, so the overpayments are not “extra expense” under the policy.

¶ 32 We agree with the trial court’s determination that plaintiff is not entitled to coverage for the specific loss it asserts in this case. Plaintiff alleges that it could not access the timekeeping records due to the ransomware attack, so it had to use the records from a previous payroll cycle and pay its employees based on those records which turned out to be nonconforming. However, plaintiff paid out funds to its employees that the employees did not earn and that plaintiff had no obligation to pay. The only funds that were “necessary” for plaintiff to pay out were those earned by its employees. Those extra funds paid out by plaintiff were not “necessary” for plaintiff to continue its operations. While it may be true that plaintiff felt that it had no choice in that moment but to pay out extra funds in order to meet its payroll obligations, plaintiff’s apparent misfortune does not create coverage where none exists under the policy.

¶ 33 A court cannot alter, change or modify existing terms of a contract, or add new terms or conditions to which the parties have not expressly assented. Thompson v. Gordon, 241 Ill. 2d 428, 449 (2011). We will not interpret an insurance policy in a way that would expand coverage beyond the actual policy language and undermine the contractual intention of the parties.

Freeburg Community Consolidated School District No. 70 v. Country Mutual Insurance Co., 2021 IL App (5th) 190098, ¶ 103; see also Body v. United States Insurance Co. of America, 72 Ill. App. 3d 594, 597 (1979) (we will not interpret an insurance policy in a way that “would enlarge the insurer's liability beyond that warranted by the terms of the policy.”).

- 11 - 1-25-0754 ¶ 34 Here, defendant agreed to pay those sums “necessarily incurred” by plaintiff during a cyberattack to continue its business operations. There is no reasonable interpretation of the policy that could include coverage for payments made by plaintiff that plaintiff was not obligated to make. While exigent circumstances might have made plaintiff believe that it was prudent to make the excess payments or perhaps the circumstances required plaintiff to temporarily overpay its employees to meet its true wage payment obligations, there is no reasonable basis to conclude that the parties intended that defendant would indemnify plaintiff for such expenditures based on the language of the policy. Only the amounts necessary for the continued operation of the business, i.e., the wages actually earned by employees, were owed by plaintiff. The overpayments are, therefore, not “extra expense” under the terms of the policy.

¶ 35 As in Chatham, while the overpayments made by plaintiff were a consequence of the ransomware attack, they were not covered by the insurance contract. It was not “necessary” for plaintiff to pay its employees anything more than the wages they earned. Coverage under the relevant policy was limited to necessary expenses. Incurring those additional expenses might have made good business sense to plaintiff, but they were not necessarily incurred for purposes of the extra expense provision.

¶ 36 As the foregoing analysis shows, plaintiff cannot prove an essential element of the policy’s extra expense coverage. When the allegations in the complaint are taken as true and when all reasonable inferences from the pleadings are drawn in plaintiff’s favor (Parkway Bank & Trust Co. v. Meseljevic, 406 Ill. App. 3d 435, 442 (2010)), it is apparent that plaintiff is not entitled to relief on its claim. Judgment on the pleadings is proper where the pleadings disclose no genuine issue of material fact and that the movant is entitled to judgment as a matter of law.

Gillen, 215 Ill. 2d at 385. The pleadings here reveal that only a question of law exists—whether

- 12 - 1-25-0754 plaintiff is entitled to coverage for its claim under the insurance policy issued by defendant. See McHenry Savings Bank v. Pioneer National Title Insurance Co., 186 Ill. App. 3d 238, 242 (1989) (“whether plaintiff has suffered a loss covered by the policy is a question of law.”).

Because that question of law must be resolved in defendant’s favor, the trial court correctly entered a judgment of no liability for defendant.

¶ 37 In its motion for judgment on the pleadings, defendant also argued that it was entitled to judgment on its affirmative defense that plaintiff failed to mitigate its damages by attempting to recover the excess payments from its employees. The trial court did not address this argument in its order granting defendant’s motion. Because we have found under the contract that defendant had no obligation to pay plaintiff for the excess payments, we conclude resolution of this issue is not required for the disposition of this appeal.

¶ 38 III. Request for Leave to Replead ¶ 39 Plaintiff argues that the trial court abused its discretion when it dismissed the complaint with prejudice without allowing it to file an amended complaint (citing Ogle v. Fuiten, 102 Ill. 2d 356, 360-61 (1984) (a cause of action should not be dismissed on the pleadings unless it clearly appears that no set of facts can be proved which will entitle the plaintiff to recover)).

¶ 40 Plaintiff’s primary argument on appeal is that it should have been given an opportunity to amend its complaint and that it could have pled facts to support its claim that the overpayments were “extra expense.”

¶ 41 We note that plaintiff requested leave to amend the complaint in the trial court, however plaintiff never submitted a proposed amended complaint. In Biggerstaff v. Moran, 284 Ill. App. 3d 196, 200 (1996), this court found that even though plaintiff did not file a proposed amendment it sufficiently articulated to the trial court the substance of the proposed amendment

- 13 - 1-25-0754 to allow the reviewing court to determine whether the trial court abused its discretion in denying leave to amend.” Id. at 200. This court found: “A proposed written amendment is not always necessary for this court to consider whether the trial court abused its discretion in denying the plaintiff leave to file an amended complaint. While a proposed amendment is desirable, it is not crucial if the record shows that the plaintiff articulated the amendment’s substance and reasons to the trial court in such a manner that the materiality of the proposed alteration was made plain to the court. [Citation.]” Id. ¶ 42 In the motion to reconsider, plaintiff alleged: “On amendment, [plaintiff] can plead facts that show that it could not have made payroll payments in any other manner than it did, and that such a method necessarily led to overpayments.” Considering the allegations of the proposed amendment plaintiff represented to the trial court in the motion for reconsideration, we would still conclude defendant was entitled to judgment on the pleadings because we have found, as a matter of law, that defendant is not liable for the excess payments. We review the denial of leave to amend a complaint under an abuse of discretion standard. Schultz v. Sinav Limited, 2024 IL App (4th) 230366, ¶ 103. A court abuses its discretion where its decision is arbitrary, fanciful or unreasonable, or when no reasonable person would take the same view. Lisowski v. MacNeal Memorial Hospital Association, 381 Ill. App. 3d 275, 288 (2008). Here, we cannot say no reasonable judge would have denied leave to amend or that the court’s decision was arbitrary, fanciful or unreasonable. Therefore, we find no abuse of discretion.

¶ 43 CONCLUSION ¶ 44 For the foregoing reasons, the judgment of the circuit court of Cook County is affirmed.

¶ 45 Affirmed.

- 14 -