Source: https://www.americanbar.org/groups/litigation/committees/insurance-coverage/articles/2016/fall2016-cyber-coverage/
Timestamp: 2019-04-21 20:39:49+00:00

Document:
Until a few years ago, the coverage world was barely cognizant of cyber attacks or mega data breaches, let alone cyber insurance. While cyber-specific forms or policies were initially underwritten in anticipation of the Y2K bug, it was hardly on the radar for most policyholders thereafter and for good reason: The risks seemed too remote to affect a risk manager’s decision to purchase such insurance. It also did not help that cyber-specific insurance in the 2000s lacked consistency, had high deductibles or premiums, or had insufficient limits. Thus, there was little appetite on the policyholder or insurer side to purchase or develop a robust new coverage program for cyber-specific risks.
That dynamic abruptly changed by the turn of this decade when a cluster of highly publicized cyber attacks occurred, such as those against Sony, Target, Home Depot, and, more recently, Anthem. The risks were no longer too remote for risk managers to ignore. Companies suffering a data breach faced significant first- and third-party losses, which, in turn, exposed company executives and their board members. Companies also scrambled to secure coverage under so-called traditional policies, such as comprehensive general liability (CGL) policies. Insurers, in turn, argued that such risks fell outside the underwriting intent of these policies.
With the battle lines drawn, a perfect storm developed in the courts and in the insurance market, both of which we will explore. We first examine the critical and key decisions for cyber coverage under CGL policies. We then examine the market’s response to these decisions and how the battle over cyber coverage has shifted to cyber-specific policies.
Must the insured affirmatively cause the publication? One of the first and critical areas to emerge involving coverage for cyber losses under CGL policies was the issue of whether the insured had to affirmatively cause the “publication” of the PII in order to obtain coverage. The leading case on that issue is Zurich American Insurance Co. v. Sony Corp. of America,[] a New York trial court decision that rocked the coverage world when it came down. In that case, the trial court held that Sony did not have coverage under its primary CGL policies for the cyber attacks perpetrated against its online networks in April 2011.[] The critical issue was whether the numerous class action complaints against Sony alleged a potentially covered offense within Coverage B, Personal and Advertising Injury.
Sony argued that even though the disclosure of the customers’ PII was caused by criminal hackers, the allegations in the complaints triggered the Coverage B offense for an “oral or written publication, in any manner, of material that violates a person’s right of privacy” (the “publication offense”). Sony argued that the complaints included allegations of negligence in failing to protect the PII or in preventing the cyber attacks, and also alleged that the PII had been disclosed in violation of the customers’ privacy rights. In other words, Sony argued that the publication offense should be construed broadly to include its negligent acts.
Those on the policyholders’ side have been critical of the Sony Corp. decision, contending, among other things, that the publication offense does not specify who must perform the act of the publication, and the term “in any manner” arguably means that the publication can be made by anyone. At the very least, policyholders argue that the language is ambiguous and should be construed in favor of coverage.
What is the meaning of a “publication”? Another critical issue involving the publication offense is the meaning of the term “publication,” which is typically not defined in CGL policies. For example, does the publication have to be widely disseminated to the public or is it sufficient for one individual to merely have access to the information? Another related question is whether the information disseminated needs to be actually accessed or only potentially accessible by a third party. Cases addressing these issues are Recall Total Information Management, Inc. v. Federal Insurance Co. [] and Travelers Indemnity Co. of America v. Portal Healthcare Solutions [].
The Fourth Circuit’s rationale in Portal Healthcare is similar to the rationale in Sony Corp., in which the New York trial court held that a publication occurs when information “comes out of the vault,” whether or not it is actually used by anyone.[] Nonetheless, it is notable that there was no issue in Portal Healthcare that the publication was caused by the insured, whereas in Sony Corp., the trial court found the publication was made by criminal hackers. For that reason, these cases must be viewed under this critical factual distinction.
Both decisions illustrate how claims based on statutory violations may be barred from coverage should they fall within a Coverage B exclusion. However, the enforcement of these exclusions is not uniform and depends largely on the nature of the alleged statutory violations (Coinstar) or whether there is an exception that would preclude its application (Corcino).
What about coverage for property damage? While much of the focus for cyber coverage under CGL policies has been on the publication offense, another contentious, but not insignificant, coverage battle has been whether the loss of PII or electronic data qualifies as “property damage.” CGL policies typically define “property damage” to include physical injury to tangible property, including loss of use of that property or loss of use of tangible property that is not physically injured. Most CGL policies contain definitions or exclusions that exclude “electronic data” as being tangible property. Despite the clear intent of the policy language, courts appear split on the issue of whether electronic data are excluded.
The U.S. Court of Appeals for the Eleventh Circuit vacated this decision and remanded the matter to the district court because the district court failed to properly analyze whether Florida or Maryland law applied.[] The Eleventh Circuit explained that if the exclusion for “electronic data” is ambiguous, “then the difference between Florida and Maryland law may determine whether the insurer’s claim succeeds or fails.”[] No further decision will be forthcoming, however, as the parties settled the case.
With a significant rise in reported cyber-related events the past few years, the evolving nature of the risks, and uncertainty whether there is coverage under traditional policies, the insurance market has seen a resounding transformation on two fronts. First, many insurers issuing CGL policies now include or incorporate ISO’s new exclusion endorsement, “Access or Disclosure of Confidential or Personal Information.” This endorsement, which is offered in three forms, bars coverage for injury or damage arising out of access to or disclosure of any person’s or organization’s confidential information.[] Although insurers have all along argued that cyber risks were never intended to be covered within the CGL coverage form, this endorsement essentially shuts the door for insureds to argue otherwise.
At the same time, insurers have seized the opportunity to significantly develop and grow the market for stand-alone cyber insurance policies. According to the Marsh & McClennan Companies, the number of U.S.-based clients purchasing stand-alone cyber insurance policies has grown by an average of about 27 percent each year between 2012 and 2015.[][P3] The global market for stand-alone cyber insurance in 2015 has been estimated around $1.5 billion in gross written premiums, with the U.S. accounting for the overwhelming majority of the market—about $1 billion in premiums.[] Some analysts predict that the gross written premiums from stand-alone cyber policies may triple to $7.5 billion by 2020 in the U.S. market.
Approximately 60 insurers worldwide now underwrite cyber specific policies, and many others include endorsements in existing policies.[] Stand-alone cyber insurance policies offer first-party coverage (covering the insured’s own losses), third-party coverage (covering defense and indemnity costs from third-party liabilities), or both.[] They are written in manuscript forms, and for that reason, the terms and conditions can vary significantly in each policy. For example, coverage in some policies may be limited to damages arising from unauthorized access to PII. As a result, this type of insurance would not afford coverage for accidental disclosures by those authorized to access the information (e.g., the inadvertent posting of private health information on the Internet in Portal Healthcare). Other cyber insurance policies may offer broader protection to include damages resulting from any type of access or disclosure.
Like other types of insurance programs, stand-alone cyber insurance policies contain exclusions. For example, most exclude losses due to bodily injury, property damage, acts of war or terrorism, or intentional acts. As we discuss in the next section, some may also include exclusions for failing to maintain appropriate cybersecurity practices. Stand-alone insurance policies may also have sub-limits on certain coverages, such as crisis management, notification costs, and regulatory investigations or actions. Because the types of insurance can significantly vary in each policy, policyholders are well advised to closely work with their brokers as well as other experts, such as cybersecurity consultants, to determine the most appropriate cyber insurance program for their business.
The growth of the cyber insurance market has given rise to new battlegrounds between policyholders and insurers. This is due to the untested and varying cyber insurance forms. In many ways, we are beginning to see a new emerging area of law that will help shape the boundaries of this relatively new market for years to come.
A more recent decision also turned in large part on the scope of the coverage grant in a stand-alone cyber policy, but the coverage language was very different than in Federal Recovery. The two cases exemplify the varied types of coverage that are available in the market and the types of disputes that can arise. In this recent case, P.F. Chang’s China Bistro Inc. v. Federal Insurance Co.,[] the district court held that Federal did not have to cover more than $1.9 million in assessments that P.F. Chang’s had reimbursed its payment processor, Bank of America Merchant Services (BAMS) after the restaurant chain suffered a cyber attack that exposed more than 60,000 credit card numbers from several restaurants. P.F. Chang’s agreed to reimburse BAMS pursuant to a Master Services Agreement (MSA) that required payment for any fees, fines, penalties, or assessments imposed on BAMS.[] Although Federal had paid more than $1.7 million in expenses associated with P.F. Chang’s forensic investigation of the breach and for defending P.F. Chang’s in third-party lawsuits, it denied coverage for the assessments based on various provisions within the insuring agreements and exclusions.
The district court also held that two exclusions (similar to the “contractual liability” exclusion found in CGL policies) and the definition of “loss” wholly barred coverage for any liability assumed by P.F. Chang’s.[] The district court pointed to three places within the MSA where P.F. Chang’s agreed to reimburse or compensate BAMS for the assessments. The district court also rejected P.F. Chang’s argument that it would have been liable for the assessments in the absence of such an assumption, as there was no evidence in the record indicating that that was the case. Although the district court acknowledged that under Arizona law exclusions are to be narrowly construed, it ultimately concluded that “[s]imply put, these exclusions unequivocally bar coverage for the Assessments.”[] P.F. Chang’s has indicated that it will appeal that decision to the U.S. Court of Appeals for the Ninth Circuit.
While Federal Recovery and P.F. Chang’s turned on the type of policy interpretation disputes over coverage grants and exclusions that will seem familiar to the insurance bar, stand-alone cyber policies can involve disputes that may feel somewhat less familiar. For example, in Columbia Casualty Co. v. Cottage Health Systems,[] Columbia sought a declaratory judgment to enforce, among other things, a condition and exclusion in its “NetProtect360” cyber policy for Cottage Health’s failure to maintain minimum cybersecurity practices.[] Columbia alleged that these provisions were enforceable because Cottage Health’s servers permitted unauthorized user access via the Internet, which resulted in the disclosure of approximately 32,500 patient records. Columbia also alleged that Cottage Health failed to continuously implement adequate procedures and risk controls identified it its application and had also failed to regularly check, maintain, and reassess its security systems in order to prevent the data breach.
The district court dismissed the lawsuit because Columbia failed to abide by the alternative dispute resolution provision.[] Nonetheless, the case sparked an interesting debate on both sides of the insurance bar as to the viability of including the minimum cybersecurity practices exclusion or condition. Insureds argue that if there is no coverage for a data breach incident due to an error, such as the one in Cottage Health, the policy should be deemed illusory. Insurers, on the other hand, argue that such exclusions or conditions are not uncommon and point to industry-specific policies, such as environmental impairment liability policies, which have similar exclusions or conditions for noncompliance with the law or industry standards. This debate underscores one of the issues emerging in cyber insurance law.
The survey of cases and the market’s response discussed above are just a few examples of how far the cyber insurance market has transformed within the last few years. As the nature of cyber risks continue to evolve, so too will the market, with daunting challenges facing policyholders and insurers. For policyholders, they must anticipate and implement adequate cybersecurity practices, which is not easy given that cyber-risks change almost daily. Policyholders must also understand the cyber insurance market in order to best mitigate their losses. Insurers, too, must adapt their forms and policies to the market. With a claims history that is relatively new and for the most part unpredictable, insurers may be reluctant to aggressively underwrite these risks. These and other challenges likely mean that the battles over cyber coverage will continue to intensify for the foreseeable future, with more litigation and the emergence of a new area of insurance law.
Lorraine A. Armenti is a partner and Steven D. Cantarutti is of counsel with Coughlin Duffy LLP in Morristown, New Jersey.
[] Lorraine A. Armenti is a partner and Steven D. Cantarutti is of counsel with Coughlin Duffy LLP. The views expressed in this article are their own and should not be construed as those expressed by their clients.
[] See, e.g., Metro Brokers, Inc. v. Transp. Ins. Co., No. 14-12969, 2015 U.S. App. LEXIS 3473 (11th Cir. Mar. 5, 2015) (affirming district court’s decision that the fraudulent electronic transfer of funds fell outside the scope of coverage provided in a business policy that included first-party property coverage); Retail Ventures, Inc. v. Nat’l Union Fire Ins. Co. of Pittsburgh, Pa., 691 F.3d 821 (6th Cir. 2012) (finding “Computer & Funds Transfer Fraud Coverage” endorsement was broad enough to cover all losses arising from a cyber attack involving the theft of customers’ credit card and checking account information).
[]No. 651982/2011, 2014 N.Y. Misc. LEXIS 5141 (N.Y. Sup. Ct. Feb. 24, 2014). Coughlin Duffy LLP represented the plaintiffs, Zurich American Insurance Company and Zurich Insurance Company.
[] The cyber attacks occurred against Sony’s PlayStation and SOE Networks, which exposed personal information belonging to over 100 million of Sony’s customers (one of the largest breaches reported to date).
[] Sony Corp., 2014 N.Y. Misc. LEXIS 5141, at *70.
[] Sony Corp., 2014 N.Y. Misc. LEXIS 5141, at *71–72.
[] Sony Corp., 2014 N.Y. Misc. LEXIS 5141, at *68.
[] Sony Corp., 2014 N.Y. Misc. LEXIS 5141, at *69–72. Although Sony appealed that decision, which was briefed and argued before the New York Appellate Division, First Department, the case was settled in April 2014.
[] Sony Corp., 2014 N.Y. Misc. LEXIS 5141, at *68–70.
[]83 N.Y.2d 618 (N.Y. 1994), aff’g, 189 A.D.2d 391 (N.Y. App. Div.).
[] County of Columbia, 83 N.Y.2d at 627.
[] See, e.g., Harrow Prods. v. Liberty Mut. Ins. Co., 64 F.3d 1015, 1025 (6th Cir. 1995) (applying Michigan law) (“[a]s noted by the New York Court of Appeals [in County of Columbia], each enumerated tort in the personal injury clause requires an intentional act”); Gregory v. Tenn. Gas Pipeline Co., 948 F.2d 203, 209 (5th Cir. 1991) (“Each of the enumerated risks assumed [within the definition of ‘personal injury’ under Coverage B] requires active, intentional conduct by the insured”); Grain Dealers Mut. Ins. Co. v. Farmers Alliance Mut. Ins. Co., No. CIV-00-370-T, 2001 U.S. Dist. LEXIS 24299, at *21 (W.D. Okla. May 14, 2001) (adopting County of Columbia for proposition that torts enumerated in Coverage B “support the conclusion that ‘only purposeful acts were to fall within the purview of the personal injury endorsement.’”) (quoting County of Columbia, 83 N.Y.2d at 627); Buell Indus. v. Greater N.Y. Mut. Ins. Co., 791 A.2d 489, 510-11 (Conn. 2002) (agreeing with County of Columbia that “the personal injury provisions [in a CGL policy] were intended to reach only intentional acts by the insured”); Butts v. Royal Vendors, Inc., 504 S.E.2d 911, 917 (W. Va. 1998) (holding that publication offense requires act of publication to be committed by insured, not by third party). Notably, too, the Supreme Court of Delaware has ruled that personal injury coverage under Coverage B “clearly do[es] not extend coverage to negligence claims.” Liggett Grp. v. Ace Prop. & Cas. Ins. Co., 798 A.2d 1024, 1032 (Del. 2002).
[]115 A.3d 458 (Conn. 2015), aff’g, 83 A.3d 664 (Conn. App. Ct.).
[]No. 14-1944, 2016 U.S. App. LEXIS 6554 (4th Cir. Apr. 11, 2016), aff’g, 35 F. Supp. 3d 765 (E.D. Va.).
[] In Recall Total, the tapes fell out of the back of a truck onto the road and were never recovered by IBM.
[] Recall Total, 83 A.3d at 672.
[] Recall Total, 115 A.3d at 460.
[] Portal Healthcare, 35 F. Supp. 3d at 770–71.
[] Portal Healthcare, 2016 U.S. App. LEXIS 6554, at *5–6.
[] Zurich Am. Ins. Co. v. Sony Corp. of Am., No. 651982/2011, 2014 N.Y. Misc. LEXIS 5141, at *37, *68 (N.Y. Sup. Ct. Feb. 24, 2014). Insurers point to other cases that have interpreted the meaning of a “publication” more narrowly to require a communication intended for the public or the act of distributing it to the public. See, e.g., Creative Hosp. Ventures, Inc. v. U.S. Liab. Ins. Co., 444 F. App’x 370, 376 (11th Cir. 2011) (holding that there was no publication if the insured “neither broadcasted nor disseminated the . . . information to the general public”); Ticknor v. Rouse’s Enters., LLC, 2 F. Supp. 3d 882, 896 (E.D. La. 2014) (“for there to be ‘publication’ under the ‘personal and advertising’ provision . . . the material must be made generally known, announced publicly, disseminated to the public, or released for distribution”); TIG Ins. Co. v. Dallas Basketball, Ltd., 129 S.W.3d 232, 238 (Tex. App. 2004) (“the word ‘publish’ is generally understood to mean disclose, circulate, or prepare and issue printed material for public distribution”).
[] At least 47 states in the United States, plus Puerto Rico, the U.S. Virgin Islands, Guam, and Washington, D.C., have some form of data breach laws. Of those, 17 states or territories permit a private right of action against the violator. Other statutory laws, typically consumer protection or businesses practices statutes, are broad enough to also include a potential violation for data breach disclosures.
[]39 F. Supp. 3d 1149 (W.D. Wash. 2014).
[] Mich. Comp. Laws § 445.1712.
[] Coinstar, 39 F. Supp. 3d at 1156.
[] Cal. Civ. Proc. Code § 1747.08(a).
[] Coinstar, 39 F. Supp. 3d at 1158.
[]No. CV 13-3728, 2013 U.S. Dist. LEXIS 152836 (C.D. Cal. Oct. 7, 2013).
[] The statutes at issue were California Civil Code § 56.36 et seq. (the Confidentiality of Medical Information Act, or CMIA) and California Welfare & Institutions Code § 5330 et seq. (the Lanterman Petris Short Act, or LPS).
[] Corcino, 2013 U.S. Dist. LEXIS 152836, at *11.
[] Corcino, 2013 U.S. Dist. LEXIS 152836, at *12.
[] Corcino, 2013 U.S. Dist. LEXIS 152836, at *13.
[]No. 1:12-cv-00232, slip op. (N.D. Fla. Apr. 22, 2014).
[] One of the security guards employed by Admiral had stolen several laptops from the client’s office, a Florida health insurer. The laptops contained PII belonging to thousands of the client’s members, exposing the client to violations under the Health Insurance Portability and Accountability Act (HIPAA) and other laws. As a result, the client sued Admiral, which, in turn, sought coverage from its CGL insurer.
[] Red Coats, No. 1:12-cv-00232, slip op. at 10 (citations omitted).
[] Carolina Cas. Ins. Co. v. Red Coats, 624 F. App’x 992, 995 (11th Cir. 2015).
[] Red Coats, 624 F. App’x at 995. The Eleventh Circuit solely focused on the “electronic-data” exclusion instead of the definition of “property damage,” which was the focus of the district court’s decision.
[]No. 11-cv-618, 2012 U.S. Dist. LEXIS 29181 (S.D. Ill. Mar. 6, 2012), aff’d on other grounds, 704 F.3d 522 (7th Cir. 2013).
[] The lost CD-ROM contained PII belonging to members and beneficiaries of a pension fund. As in Red Coats, the insured sought coverage for the consequential damages incurred by the pension fund to protect those affected by the breach, such as notification costs, credit monitoring services, and insurance.
[] Hentz, 2012 U.S. Dist. LEXIS 29181, at *10.
[] Hentz, 2012 U.S. Dist. LEXIS 29181, at *11. Despite this ruling, the district court went on to hold that the “in the care of the insured” exclusion had applied to bar coverage for the claim. Nationwide Ins. Co. v. Hentz, 704 F.3d 522, 525–28 (7th Cir. 2013). The U.S. Court of Appeals for the Seventh Circuit has affirmed that portion of the district court’s decision, holding that the “in care of the insured” exclusion and a “business” exclusion applied, but the appellate court did not address the issue of whether the electronic data within the CD-ROM are deemed intangible property. Hentz, 704 F.3d at 525–28.
[] In contrast, the trial court in Recall Total agreed with the insurers that the definition of “property damage” and the “electronic data” exclusion barred the claim because “there were no claims for actual damage to the tapes, the cost of the lost tapes or the cart.” Recall Total, 2012 Conn. Super. LEXIS 227, at *17. Instead, the trial court found the loss arose from preventative measures taken by IBM (i.e., setting up call center, notifying employees). Recall Total, 2012 Conn. Super. LEXIS 227, at *18. In citing other cases, the trial court concluded that “[t]his was not damage to tangible property” and also found the exclusion to be unambiguous. Recall Total, 2012 Conn. Super. LEXIS 227, at *18.
[] The three exclusionary endorsement forms are as follows: (1) CG 21 06 05 14 Exclusion—Access Or Disclosure Of Confidential Or Personal Information and Data-Related Liability—With Limited Bodily Injury Exception; (2) CG 21 07 05 14 Exclusion—Access Or Disclosure Of Confidential Or Personal Information And Data-Related Liability—With Limited Bodily Injury Exception Not Included; and (3) CG 21 08 05 14 Exclusion—Access Or Disclosure of Confidential Or Personal Information (Coverage B only).
[] See Marsh & McLennan Cos., Benchmarking Trends: Operational Risks Driver Cyber Insurance Purchases (last visited Oct. 10, 2016).
[] Keith Kirkpatrick, “Cyber Policies on the Rise,” 58 Communications of the ACM, No. 10, Oct. 2015, at 21. Other analysts have estimated gross written premiums in 2014 to be over $2 billion for the U.S. market alone. See “U.S. Cyber Insurance Market Demonstrates Growth, Innovation in Wake of High Profile Data Breaches,” Ins. Info. Inst., Oct. 21, 2015.
[] See “U.S. Cyber Insurance Market Demonstrates Growth, Innovation in Wake of High Profile Data Breaches,” Ins. Info. Inst., Oct. 21, 2015.
[] First-party losses covered typically include the costs of forensic investigations, hiring outside counsel to handle breach responses, hiring a public relations firm to handle media communications, notifying affected individuals and regulators, offering credit monitoring services, setting up call centers, making extortion payments, paying card industry–related fines or penalties, business interruptions (e.g., paying for alternative network services, employee overtime, lost profits), and repairing or restoring compromised systems. Third-party losses covered typically include defense and indemnity costs associated with civil individual lawsuits and class actions, administrative and regulatory investigations and litigation (e.g., Federal Trade Commission or Securities Exchange Commission), and derivative lawsuits brought by shareholders.
[] 103 F. Supp. 3d 1297 (D. Utah 2015).
[] Travelers Property, 103 F. Supp. 3d at 1302.
[] No.CV-15-01322, 2016 U.S. Dist. LEXIS 70749 (D. Ariz. May 31, 2016).
[] MasterCard initially imposed the assessments to BAMS, which included costs associated with fraudulent charges on the cards ($1,716,798.85), notifying affected cardholders ($163,122.72), and a case management fee ($50,000). BAMS then sought reimbursement from P.F. Chang's pursuant to the MSA.
[] P.F. Chang’s, 2016 U.S. Dist. LEXIS, at *12–15.
[] P.F. Chang’s, 2016 U.S. Dist. LEXIS, at *22–24.
[] P.F. Chang’s, 2016 U.S. Dist. LEXIS, at *25.
[] Complaint for Declaratory Judgement and Reimbursement of Defense and Settlement Payments, Columbia Cas. Co. v. Cottage Health Sys., No. 15-cv-03432 (C.D. Cal. May 7, 2015).
[] Columbia specifically argued that under an exclusion entitled “Failure to Follow Minimum Required Practices,” coverage was barred for “[a]ny failure of an Insured to continuously implement the procedures and risk controls identified in the Insured’s application for this Insurance and all related information submitted to the Insurer in conjunction with such application whether orally or in writing.” The cyber risk policy also contained the “Application” condition, which rendered the policy null and void in the event the insurance application contained any misrepresentations or omissions, as well as the “Minimum Required Practices” condition. Complaint for Declaratory Judgment and Reimbursement of Defense and Settlement at ¶¶ 39–44, Columbia Casualty, No. 15-cv-03432 (First Cause of Action).
[] See Columbia Cas. Co. v. Cottage Health Sys., No. 15-cv-03432, 2015 U.S. Dist. LEXIS 93456 (C.D. Cal. July 17, 2015).

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 § 445
 § 1747
 § 56
 § 5330
 v. 
 v. 
 v. 
 v.