Lesson From a Landmark Case: Carefully Assess Whether Any of Your
Insurance Policies May Cover Your Loss
In Spec’s Family Partners v. Hanover Insurance, the Fifth Circuit issued a landmark decision in which it found that an insurer may have a duty to defend against a data breach claim under a directors and officers (D&O) liability policy. 739 F. App’x 233, 239 (5th Cir. 2018). On remand, the trial court ruled that the insurer must defend against the claim. No. 16-cv-438, 2019 WL 3302816, at *4 (S.D. Tex. July 23, 2019). Spec’s was a remarkable albeit under-reported victory for policyholders as it cemented the notion that, depending on the circumstances, D&O policies may cover cyber-related incidents.
Taking a step back, the policyholder in Spec’s was clever to have looked to its D&O policy for coverage for a data breach claim. As one commentator put it:
There is an odd thing about all of this that should be mentioned at this point. That is – why are we talking about D&O insurance? Why aren’t we talking about coverage under Spec’s cyber liability policy? See Fifth Circuit Reverses Dismissal of Data Breach Coverage Suit Against D&O Insurer, the D&O Diary (July 17, 2018) (available here).
In line with that thinking, the ordinary policyholder may have looked no further than its cyber insurance, or lack thereof, for coverage for a data breach claim. But in Spec’s my colleagues, including Micah Skidmore, did what the best policyholder advocates do: they assessed whether any available policies may cover the claim.
The policyholder in Spec’s, a retail chain, was the victim of attacks on its credit and debit card payment network. As a result of the attacks, MasterCard and Visa imposed assessments on the policyholder’s credit card processor for costs associated with, among other things, card monitoring and replacement costs. The credit card processor in turn sent the policyholder a series of letters demanding reimbursement of the costs associated with the assessments. The policyholder tendered those demand letters to its D&O insurer, asserting that those letters constituted a covered “Claim.”
The D&O insurer argued that an exclusion applied and so there was no coverage. That argument was consistent with commentary offered by some insurer-side advocates. One insurer-side article argued that “D&O policies contain many exclusions and coverage limitations that should protect against undue, unintended expansion of such policies to encompass cyber risks.” Instead of engaging with arguments about what D&O policies are allegedly designed and not designed to protect against, the Fifth Circuit did exactly what our team advocated for: it compared the underlying data breach allegations with the text of the policy. Through that lens, the Fifth Circuit determined there may be coverage and, shortly thereafter, the trial court held there was coverage.
This creative thinking—broadly assessing which policies could possibly cover a loss—is what the best policyholder advocates do with every new claim. Here are some other creative wins our insurance recovery group at Haynes Boone have achieved:
- Coverage for a wrongful termination case under an aviation policy.
- Coverage for a slander of title case under a CGL policy.
- Coverage for trademark infringement cases under CGL policies with trademark infringement exclusions because those cases arguably involved trade dress infringement and implied disparagement claims.
- Coverage for TCPA claims under a CGL policy because the claims triggered the policy’s “written publication, in any manner, of matter that violates a person’s right of privacy.”
- Coverage for claims against a real estate developer for ADA violations because the allegations triggered the CGL’s policy’s “loss of use” definition of property damage.
- Coverage for a tortious interference case under a CGL policy because the allegations in the case arguably amounted to trade libel (although trade libel was not expressly alleged).
- Coverage for a product defect case under a CGL policy because the underlying plaintiff arguably had to “rip and tear” through covered property to replace the defective product.
- Coverage for COVID-related business losses under an event cancellation policy.
Quick Overview of the Play
In sum, the message is this: carefully review and analyze whether any available insurance policy may cover a loss, including those policies that, at first glance, may not seem to apply.
To receive future posts by email, please subscribe here.
