Antitrust Law Daily Wrap Up, FRANCHISING & DISTRIBUTION—E.D.N.Y.: Affirmative defense that cyberattack was force majeure is still open to debate, (Apr 10, 2026)

By Rebecca Mayo, J.D.

A force majeure clause did not contain an exhaustive list of excusable events leaving open the possibility that a cyberattack may fall under the clause, but there was not enough evidence that it was beyond the control of the breaching party.

The federal district court in Brooklyn, New York decided not to rule in favor of either iRobot Corporation or Expeditors International of Washington on the issue of whether Expeditors could use the force majeure clause in their contract to avoid responsibility for breaching the agreement after a cyberattack. The court did hold that there was no evidence that the cyberattack was an act of war or terrorism under the force majeure clause even though the malware was attributable to Russia and the attack came on the eve of the Russia-Ukraine war, and dismissed this claim. However, the court held that without more information iRobot could not definitively show that a cyberattack could not plausibly fall under the force majeure provision of the contract, and Expeditors could not definitively show that the cyberattack was beyond its control. Therefore, the court denied the cross-motions on this defense (iRobot Corp. v. Expeditors International of Washington, Inc., No. 2:23-cv-00580-SJB-AYS (E.D.N.Y. Mar. 24, 2026)).

IRobot contracted with Expeditors to ship its products to the United Sates, unload and transport the products to Expeditors’s warehouses, provide inventory of stored products, and then ship products to identified retail customers. Under the Distribution Services agreement, Expeditors was to have iRobot’s goods available to ship within 24 hours of iRobot’s order, and was required to input information about “receiving, storage, inventory transactions, and completed shipment information within four hours of completing a transaction. Expeditors was required to provide iRobot with access to a customer portal where iRobot could view real-time data and retrieve standard reports. Expeditors was also required to “maintain a business continuity plan designed to mitigate interruption upon the occurrence of a disaster or any other operational occurrence that could reasonably be expected to materially disrupt” the services provided.

In February of 2022, Expeditors was the subject of a cyberattack as a result of a “phishing” scheme where an Expeditors employee downloaded a fake browser update on his laptop outside of Expeditors’s VPN. The cyberattack was a ransomware attack, meaning that a hostile actor held its system hostage and demanded payment for service restoration. Rather than pay the ransom, Expeditors attempted to restore its systems on its own. Expeditors publicly disclosed that it had “shut down most of [its] operating system globally” and that there would be “limited ability to conduct operations.” Following the three week shutdown, iRobot alleged that Expeditors ceased providing services, including order processing and access to Expeditors’s electronic data interchange (EDI), used to track inventory and process orders.

IRobot filed suit in 2023 asserting a single cause of action against Expeditors for alleged breach of contract. Expeditors asserted twelve affirmative defenses. The parties then filed cross-motions for summary judgment.

Force Majeure. Both parties moved for summary judgment on the affirmative defense of force majeure. iRobot argued that the force majeure clause could not be interpreted to include cyberattacks because it was not listed as a specific excusable event in the contract. However, the court noted that the provision contained an open-ended list: “including, by way of illustration but not limitation.” iRobot further argued that cyberattacks were unlike the other listed examples such as disasters, physical destruction of property, or large-scale societal disruptions. However, the court found that iRobot’s list was too narrow since the list included events such as “power failures,” “labor disputes,” and “terrorist activities,” and found that the provision could include cyberattack.

Expeditors’s cited JN Contemporary, which held that a force majeure clause applied to pandemic-generated delay, to assert that the Agreement necessarily relieved it of its obligations because the court there held that something beyond the parties’ control was something beyond their fault. However, the court here did not agree that a cyberattack was such an event that was necessarily beyond Expeditors’s control. iRobot relied on Expeditors’s expert reports that discuss the risk of cyberattacks as well as other evidence that Expeditors’s was concerned about this risk of such an attack, including an attack that could potentially shut down its entire system. However, the court noted that most of the evidence was not cited in the Rule 56.1 Statement and therefore could not be the basis to grant iRobot’s judgment as a matter of law. The court also noted that the evidence was slightly off point as recognizing the risk of something was not the same as having the ability to prevent or control its occurrence. Expeditors’s contended that the “zero-day” attack was beyond its control because it was like any prior intrusion and relied on statements from its experts that cyber attacks using “a new type of malware” can be unpreventable. However, the court noted that almost all of the statements relied upon were not in the Rule 56.1 Statement and none of the facts in the 56.1 Statement demonstrated that the specific attack on Expeditors was unpreventable.

Impossibility. A party claiming impossibility as an affirmative defense must show that their nonperformance was not caused by their fault. The court found that the same issues of fact in the force majeure defense, namely whether the cyberattack was foreseeable and beyond Expeditors’s ability to prevent, precluded summary judgment on the defense of impossibility for either side.

Additional affirmative defenses. Expeditors asserted that the attack occurred on the eve of the Russia-Ukraine ware and the malware was attributable to Russia and therefore could be considered an act of terrorism or war. The court, however, found no plausible connection to Ukraine drawn by Expeditors, or any explanation proffered as to why a cyberattack on a U.S. distribution company would advance Russia’s war objectives. Additionally, Expeditors’s own experts testified that they could not attach the cause to any nation-state or terrorist organization. Therefore, the court granted iRobot’s motion for summary judgment on this portion of the force majeure clause.

Expeditors also asserted several other defenses, including failure to state a claim, that the claims were barred by the doctrine of frustration, and that iRobot was estopped from seeking relief based on its own breach and its failure to timely exercise contractual remedies. The court deemed these defenses as abandoned since Expeditors failed to raise any arguments in support of these defenses and dismissed them.

Damages. The court could not resolve the damages issues because there were insufficient facts as to the damages sought, how they were categorized, and on what bases they were calculated. Without these facts, the court could not determine whether the damages constituted general or impermissible consequential/incidental damages. Therefore, the motion for summary judgment to restrict damages was denied.

Expeditors argued that iRobot failed to mitigate damages by failing to seek a claim through its cyber-insurance policy and keeping the policy’s existence from Expeditors. However, the court found that the breaching part must demonstrate that the non-breaching party “unreasonably failed to minimize damages” and Expeditors failed to establish that iRobot’s actions were unreasonable as a matter of law. The court noted that other courts have held that the duty to mitigate did not impose an obligation on the plaintiff to seek recovery from insurance. Therefore, because a flawed legal argument—that mitigation must be pursued by insurance—was the only basis on which summary judgment was sought, it was denied.

Motion to seal. Expeditors argued that the information within the exhibits would “give a bad actor a roadmap for evasion of defenses in a new attack” and “neutralize its mitigation and recovery processes.” The court found that the fact that Expeditors suffered a cyberattack in the past did not by itself warrant sealing documents that discuss the causes of the attack, particularly when the litigation itself was about the cyberattack, and much of the information was already public in other documents that had not been sealed or redacted. Further, by requesting that the entire reports be filed under seal, Expeditors failed to narrowly tailor to redact only the limited information that must be sealed to preserve higher values. Where Expeditors did seek limited redactions, it failed to provide any detail or discussion about why that specific information warranted redaction.

The Case is No. 2:23-cv-00580-SJB-AYS.

Judge: Bulsara, S.

Attorneys: Matthew Didora (Law Office of Matthew F. Didora, PC) for iRobot Corp. David H. Pikus (Bressler, Amery & Ross, PC) for Expeditors International of Washington, Inc.

Companies: iRobot Corp.; Expeditors International of Washington, Inc.

Cases: FranchisingDistribution NewYorkNews