this is a duty to defend a case but the claim in this case against the insured is not a fully developed legal pleading it instead consists of two skeletal demand letters alleging that suspects was negligent in complying with security standards and demanding payment for the assessments and finds that followed the district court erroneous lea construed that claim too narrowly in violation of texas law the court ignored the allegations in the claim that would support a non contractual theory of liability and found that the policy is contractual exclusion exclusion in barred coverage that ask to be sure i understand how this is set up is then if that claim is that they are negligent or whatever on how they handle their credit card transaction or act right correct ok then first data is in the middle right bank who has a contract with the card brands who then have a contract with a data processing company like first data or they're sometimes another institution in between and so when there's a fraud on the customer's account the credit card companies and sometimes the bank have promises to the customer to reimburse that person for the fraud on their card and then they go and find other entities to help pay that pay those reimbursements back here what happened is there was a fraud there was a data breach a criminal attack on specs account and so there was fraud on a lot of customers cards ultimately the credit card companies reimbursed those card holders and then they went to first data to get reimbursed and pursuant to a contract between first data and the card brands first data paid that back and then it went to specs to get reimbursement the problem for is the contract between specs and first data does not require specs to pay those those assessments and fines are consequential damages waiver in the contract about a contribution right i'm not i'm not so why is that why is that permitted here whether there could be the problem is for first data that this area of the law at this time was really evolving and financial institutions and data processors were looking for theories of liability to hold the merchants liable when an attack occurred on their watch sometimes they could use a contractual theory but other times they couldn't and we cited numerous cases in our brief defend here because remember exclusion then which is which is the contractual liability exclusion has an exception it says it does not apply if the live by liability would have attached in the absence of the contract and so if they're alleging anything other than a contractual theory of liability then the exclusion doesn't apply the duty to defend is triggered and hanover is obligated to defend the client of the way the way who's going to wind up with a hit here for  honor so i think you can definitely read these claim letters to be saying that well to to be careful first he was careful not to limit itself to a contractual theory of liability for state as a big company there are very sophisticated a billion dollar data processing company they know how to draft a demand letter that's based on a contractual theory of liability and these letters are not yet and the reason is they knew there was not contractual liability here so they were preserving all options at that stage in the in the proceeding to bring whatever claim they decided would work down the road for our purposes in this case all that matters just not just going to west i'm sorry  in the record your honor i believe that hanover attached it to their request for a judicial notice of extraneous materials and the answer to the second question is no that the court should not consider it because as this court is well aware texas law has held repeatedly that in analyzing the duty to defend it follows the eight corners rule which only looks at the four corners of the claim which is these two letters here and the four corners of the that's exactly right and so our argument here is that the facts alleged in these complaints though vaguely alleged to be sure are sufficient to support non contractual theories of liability the negligence or contribution rights or whatever whatever claim for state i wanted to come up with later so that's are for that's the first independent reason why the duty to defend is triggered here i'd like to turn to have a second and a third reason why those claims triggered the duty to defend even putting that aside and that is because these claim letters demanded non monetary relief that had nothing to do with or didn't arise out of contractual liability so in the first claim letter first date i demanded full compliance with it in addition to demanding the payment for the assessments and finds it demanded full compliance with what is called p c i d s s security standards so those are kind of industry standards that the credit card companies have devised and adopted in their rules and procedures that require merchants who are going to take their cards to make sure their system is secure and first data said you've got to immediately make sure that you are p c i d s s compliant and go out and hire a qualified security assessor which is part of that whole network requirements to audit your system and ensure that it is compliant that was a very significant expensive process that took months spec's had to hire first they had hired lawyers to defend these allegations against the against them and then secondly had to hire an outside security firm to help audit their their system under the plain language of the policy which defines claim to include in a demand for non monetary relief that demand alone constitutes a claim and in making that demand first date i've made no reference at all to the parties contract in fact the in explaining why or how specs needed to comply with that demand it was referencing the car brand standards master card rules and security procedures so there's no there's certainly nothing that links that demand to any kind of contractual liability so that's a second independent reason why the duty to defend is triggered here under texas law once one part of the claim is covered then the insurance company has the obligation to defend the entire claim now there's a third independent basis and that is that the claim arose out of criminal liability not contractual liability now the way this argument works is to the extent you read these claim letters as far a somehow breached its contract with first data and caused first data is damages the problem for hanover is that it also alleges that a third party criminal attacker attacked the system and it's not clear from the face of the plame letters what actually gave rise to first aid as damages and so we cited cases that have held that in these data breach cases when a third party criminal attack or  system that becomes in some cases it can be the superseding or independent cause of the losses in other words the specs could have been in non compliant with the security standards all day long not that we're conceding that of course and that third party could still somehow get in and attack the system and so on the basis of just the claim letters alone it's not clear whether first date is saying they were there harm was caused by that that fraud or whether it was caused by something specs said and as a result you have to interpret that claim in the insureds favor under texas law and that would trigger yet another reason why the duty to defend is triggered here unless the court has any further questions on the on the duty to defend i'd like to shift gears and talk about our separate defense funding agreement so the defense funding agreement was a contract that specs and hanover entered into once hand over hand over initially agreed to defend it reserved its rights of course but it agreed to defend in a month or so into that relationship handover inspects decided that they wanted something more concrete and over wanted to lower the rates of specs lawyers and wanted more control over the litigation and so they entered into a separate contract which we call the defense funding agreement now the district court we w we had a separate breach of contract claim based on the d f a the district court erroneous lee dismissed that claim and that was wrong for two independent reasons first in hand when hanover moved for judgment on the  spontaneous dismissed the entire case so that's the first reason why that is reversible error we've we've cited numerous cases to the chord that have held district courts can't do that unless they give the litigants notice and there was no notice here the second reason why that claim fails or that why that claim should not have been dismissed is that handover can't show that it complied with the d f a so once they entered into the f a things went well for a month or so and then hand over started getting specs bills for the litigation in tennessee evinced first data and hand over said wait a second these aren't defense expenses and just stopped paying we believe that's wrong because specs had no other option but to go file a lawsuit against first data first data made the claim and then it engaged in self help and took the money and held it and so suspects with nothing else to do follow the lawsuit in tennessee we cite the simon versus maryland case a decision by this court that held under very nearly identical circumstances that when the insured is forced to go follow a lawsuit that doesn't mean it's affirmative it can still be considered defense expenses the second reason hanover has now given on appeal is that well exclusion in applies and so we just quit paying we were entitled to do that under the under the d f a of course we don't believe exclusion applies but even if it did apply the agreement required hanover to provide written notice of any reason why it wanted to terminate the d f a and give the reason and then allow and then still had to pay for ten days to give specs plenty of time to figure out how that would affect its litigation strategy and here that never occurred there were months there was a months long period where hanover was required to be performing under the d before it was finally terminated and when it was terminated and so even if exclusion applied here again we don't believe it does we believe we're entitled to the damages under the d f a for that several months long period when hanover was failing to perform theories of contribution or negligence or clearly that it issue and whatever claims there are against against specs by first stated the nature of this claim essentially is that mastercard and visa suffered losses because of a data compromise event that required them to reimburse card holders for fraud and compromised cards master card and visa consequence consequently assessed fines and fees and first data pursuant to contract and pursuant to rules and procedures that were in accordance with that contract so the liability the primary liability for the fees and fines was assessed on first data first data then turns to specs says the merchant and the right that they have against specs is not because  fees and fines to master card and visa and other card issuers it is because they have a contract that contains an indemnification provision and whether or not there may be legal arguments as to whether or not  indemnification provision applies theory clear from the demand letters that were sent by first aid to specs that the basis for the claim for reimbursement of those fees and fines through the reserve account that they were creating was based on the indemnification provisions in the merchant agreement so the relationships and as frankly as counsel said at the beginning of his  argument that this is a complicated contractual arrangement this is a contractual arrangement among the parties and that is why exclusion and applies now the theory of contribution to specs as a cold tortfeasor and asked for contribution and the end of this problem and now you can pay your share right right right so it's this isn't a question of contribution here because again the contribution would be under some sort of tort theory that first data initially has been sued or has had a claim against it on some tort theory which as i just pointed out it has and it was it was asked or it was demanded to pay fees and fines to mastercard and visa pursuant to contractual rights and rules and procedures assertion of any other basis for a right to go after suspects and frankly but when you talk about in a little over gauges about compliance with third party security dan that didn't sound rules and procedures that's directly in the contract and it's under that theory that specs then becomes liable for contractual indemnification under the intent of patient provision in the merchant agreement so  yes there are you can characterize the conduct whatever way negligent or not but the light the basis for viability in the theory of liability is the contract the combination of provision saying they need to comply with the rules and procedures and the intent to cation parisian that says that if we stuff the first day the suffers losses because of your negligent or wrongful conduct then you have to indemnify us under this where a document is referenced in the pleadings it is part of those pleadings and part of the record and part of the basis for the complaint or the claim and so under either theory under  under the theory of what the demand letter is and the fact that to them band letter refers to the merchant agreement and then that the complaint by specs in this case refers to the merchant agreement places that in the record as part of the materials that can be considered for the duty to defend so  and applies as long as there is and we've cited multiple cases out of the fifth circuit that stand for this proposition as long as there is at least an incidental relationship and the excluded risk here the contractor agreement here i think we've gone way beyond just an incidental relationship there is no relationship between these parties but for the merchant agreement there's no that there's been no basis that's been cited by specs for any kind of a special relationship or other relationship that would create a common law duty by specs to first stated in the absence of the  contract so here again we have at least an incidental relationship and frankly even if it were about four standard it would be satisfied that this arises out of the contract so let me skip over to the defense funding raymond for a moment and just remind the court that that defense funding agreement was an agreement to govern under what terms defense payments would be made but it had a very important provision that is consistently been ignored by specs that that defense funny agreement is subject to all of the terms in the policy so when counsel for spec says even if exclusion and applied they'd have a duty to defend that's not what the defense funding agreement says if exclusionary applies the pollen or the policy there's no duty to defend and because that defense funding agreement the subject to  the terms of the policy defense funding agreement would not would not impose any independent duty to defend there was no terminations and of a defense funding agreement the reason that payments were made was the position by hand over that the defense payment the defense bills that were submitted were not defense bills that were covered pursuant to the policy and therefore were covered pursuant to the defense funding agreement so it's not a question of whether or not there was a terminations of the defense funding agreement nonpayment of certain defense costs doesn't amount to terminations it was merely a determination that under the defense funding agreement those amounts weren't allowed with respect to the nature of the claim in that there was allegations of third party criminal activity  and counsel said it may have been a superseding cause the problem with that is if criminal conduct of third parties was a superseding cause or first aid was lost then suspects could not possibly be parties is irrelevant to this issue because it does not define what the claim is and can't define what the claim is because if that were the basis for the claim the only claim that first data would have would be against the third and frankly all of this is all everything in the tennessee with the geisha and war was claims by specs against first state affirming of claims by specs against first data and in the all this decision by this court it's very clear that even if there is an argument that the prosecution of affirmative claim somehow is helpful in the defense of another claim that it still would not be covered as affirmative costs of prosecuting the claim that the policy only covers the defense costs critical quote in there that i think really governs well to the extent i would say governs but i think it's very apropos appropriate here by the southern district of texas and the state the following quote by participating in the visa and master card networks the financial institution plaintiffs entered into a web of contractual relationships that included not only issuer an acquirer banks but also third party businesses such as hartland their process transit sections for network members in light of the relationship between heartland and the visa and master card networks the network regulations not tort law or the appropriate means for the financial financial institution points of to seek relief additionally the damages the financial institution points of seek the cost of covering fraudulent charges or reassuring cards are the kinds of damages expected to flow from a data breach damages that can be addressed in the parties contractual arrangements and here that's what we have we have a contractual arrangement to handle those payments and where there is a contractual arrangement that provides for how the fees and fines are to be handled  assessed against first then that contract is what defines the nature of any claim that first stated comparing against specs because it's dealt with in the contract how many was not going to impose a alternative theory that negates what the parties agreed to absent some sort of public policy reason and there is been identified in this case so because the contract here specifically governs is specifically referenced and specs complaints in this matter so it is a part of the complaint whether it's attached or not that is first fifth district procedural  it was well we filed no we fully filed we we filed a request for a judicial notice and in that request in connection with every quest we specifically made the argument to judge miller that the merchant agreement is admissible for purposes of determining the duty to defend because it was specifically referenced in the  so whether or not we also asked for judicial notice just as sort of a belt and suspenders procedure the merchant agreement was before judge miller and again the merchant agreement is also referenced specifically as the basis for the claim in the demand letter and therefore under those same pleading rules or at least the principles that behind those pleading rules  i don't think that you can interpret the demand letter without that merchant agreement so either one it's a part of the demand letter because it's referenced specifically there in as the basis for liability or to our request for judicial notice of that merchant agreement should be granted because to the extent that it's so intertwined with that demand letter because it says based on the merchant agreement we're at we're establishing this reserve account then to the extent that the court i believe would not be able to determine a duty to defend without looking at that merchant agreement it should be admitted through judicial notice because it's absolutely necessary to determine the nature of the complaint and doesn't overlap with any issues in the underlying case because it's not being used to establish the truth or falsity of any of the facts in the underlying claim but just to establish the nature of the claim that is being made by first data against  and it's essentially incorporated into the demand letter by specific reference by saying that this is where we're seeking this relief pursuant to the merchant agreement is actually part of a demand letter and therefore within the four corners of the demand letter yes it's an extra it's an additional document to look at but i don't believe that we're asking for a new twelve corners roll it's still within the eight corners because it's part of the four corners of the demand letter the c honor i'll start with the merchant agreement it would be inappropriate to consider it at any stage of this case because of the eight corners rule in determining the duty to defend and you look only at the four corners of the claim letter and the four corners corners of the policy now i'd like to just kind of try to organize my rebuttal in terms of the three independent arguments we made as to why the duty to defend is triggered so i'll start with the first argument that the letters potentially give rise to a non contractual theory my colleague represent a reference to the heartland case but that case actually it went up on appeal to this court and this court reversed the dismissal of the non contractual claims and heartland is a little bit different factually but the point of the opinion is that the economic loss doctrine did not preclude tort claims and contract claims and now that was not an insurance case not a duty to defend the case but my art my point is that shows that at this at the early stage when these claim letters were drafted based on the factual allegations in those letters we didn't know what theory of liability first data would ultimately pursue and under hard partners shows us that it can be tort claims non contractual theories as to the question about contribution contribution judg g again we don't know from the four corners of the claim why first data is liable for these assessments and finds hanover's council referenced a contract but we don't know that from the four corners of the claim and in any event if hanif first data had refused to pay the entity that was demanding the payment under their contract then there presumably could have been nine contractual claims filed against first data at this stage in the in the in the game when this these claim letters were issued none of that had been developed or determined and i would finally as judge jones reference what matters in determining the duty to defend when you're looking at the claim is the factual allegations alleged not the legal theories and i would cite judge graves opinion from december in the l s b case in which you very very thoroughly work through different proceedings or different petitions and concluded that you you look at the factual allegations in the petitions not the legal theories that were alleged and so here even though there is a reference to the contract that certainly does not preclude there being on contractual theories as well now our second independent argument was that the demand letters included a claim for non monetary relief hanover's counsel said th duty to be for specs to be compliant with the security standards is in the contract well that's not in the claim letters again if you look at just the claim letters the reference to pete being p c i d s that's compliant with the data security standards it has nothing to do there's no reference to the contract the only reference to the contract in the claim letters is that the back in and each of the second page of each letter when first dat we're going to establish a reserve account it was the vehicle by which first data intended to reimburse itself for these assessments and finds it's they certainly didn't say this is our only theory of liability against you and as to the non monetary relief they did not leak that demand to anything into the parties contract and then third argument about there being superseding criminal liability the point is that there are multiple ways you can read these vague letters and one potential way would be that what caused the first data is harm was superseding criminal criminal conduct and if that's how the plane letters are interpreted then exclusion and wouldn't apply the duty to defend is triggered now handovers council also mentioned the defense cost issue and he suggested that one reason why  they aren't that the that the either they're not in breach of the d f a or not a breach of the policy is because these aren't defense costs i want to point out that when hanover moved for judgment on the pleadings below they did not argue that the bill submitted by specs weren't defense costs or only argument was exclusion and so that has not been preserved but that is not there cannot be a ground on which the policy doesn't apply here