P is a federally chartered savings and loan association. On Saturday, March 20, 2004, burglars forced their way into the branch through a back entrance door and a second interior door. According to security camera images taken during the course of the incident, the burglars located the vault inside and, during a several hour period, used large acetylene gas tanks as blow torches to break down one of the vault's concrete and metal walls. The burglars gained access to a safe storing the branch's overnight cash and over 20 safe deposit boxes belonging to P's customers. The burglars stole $589,749.55 in cash from the safe and property valued at $926,512 from the safe-deposit boxes. The police were not notified during the course of the burglary. A P employee discovered what had occurred when the branch opened for business on Monday morning, March 22, 2004. Ds had separately contracted with P to supply security services for the branch. D's contract obligated D to install and maintain a 24-hour industry-certified central station security system to protect the branch premises and the vault. Diebold's (D1) contract required D1 to provide a backup alarm system that included additional central station monitoring, another form of telephone line security, and 'signal monitoring,' which would activate an alarm if D's alarm system failed to operate properly. P sued Ds claiming that Ds violated their contractual obligations by installing woefully inadequate security systems, which they failed to inspect. P alleges that Ds knew for weeks, if not months, that the security systems in place were not working in that they were generating a series of flaws, malfunctions, and false alarms. P claimed that in the three months prior to the burglary there were 17 phone line failures and a number of other occurrences that were 'consistent with an intruder cutting the phone line' and 'should have created an alarm event.' Ds failed to investigate these malfunctions and failed to notify anyone at the branch of the problem. D1’s contract contained clauses that exculpated D1 from liability for their negligence and limited their liability, under all circumstances, to $250. Under D1's contract P agreed to obtain insurance coverage to cover its losses in the event of a theft. The D1 agreement provided that P 'shall look solely to its insurer for recovery of its loss and hereby waives any and all claims for such loss against D1' and that D's insurance policy would contain a clause providing that such waiver would not invalidate the coverage. There was no similar waiver-of-subrogation clause in the contract between P and D. Instead, their contract merely provided 'that insurance, if any, covering personal injury and property loss or damage' was Abacus' responsibility to obtain. P claims $5 million in damages for loss of business and $1 million in punitive damages. P seeks $85,436 in costs to repair the vault and $30,000 in added security costs it absorbed. Ds’ motion to dismiss was denied except for the breach of contract cause of action and the gross negligence cause of action. The Appellate Division reversed and granted Ds' motions to dismiss the amended complaint in its entirety. P appealed.