Legal developments

Cyber coverage under other forms of insurance

Recent court opinions confirm that more traditional forms of insurance may cover certain losses arising from cyberattacks.

For instance, in 2022, a federal court in Minnesota ruled that Target Corp. was entitled to coverage under general liability policies for certain losses associated with a well-publicized 2013 data breach. Target sought coverage for the costs incurred in settling thousands of claims for replacement of payment cards after card data was compromised. Target Corp. v. ACE American Insurance Co. (D. Minn. Mar. 22, 2022). Target’s insurer, ACE, argued that those costs were not covered because they were not “damages because of loss of use of tangible property” as required by the policies. The court held that the costs of replacing the payment cards were “damages because of loss of use” because the payment cards had to be cancelled following the data breach and were therefore inoperable.

However, on December 27, 2022, the Ohio Supreme Court reversed its appellate court and held that an insured was not entitled to coverage under a businessowners insurance policy for losses resulting from a ransomware attack. EMOI Servs., L.L.C. v. Owners Insurance Co. (Ohio 2022). The insured suffered a ransomware attack that encrypted its system and rendered its files unavailable. The insured paid the ransom requested, upgraded its software system and tendered a claim to its business owners insurer under a policy that provided coverage for “direct physical loss of or damage to ‘media’ which you own,” including “costs to research, replace or restore information on ‘media’ which has incurred direct physical loss or damage.” The court concluded the insured was not entitled to coverage because “software is an intangible item that cannot experience direct physical loss or direct physical damage.”

The EMOI ruling stands in contrast to a 2020 Maryland federal court ruling that held the opposite. National Ink & Stitch, LLC v. State Auto Prop., & Cas. Insurance Co. (D. Md. 2020). The court in National Ink concluded that the insured screen printing business suffered a “direct physical loss of or damage to” its computer system when a ransomware attack prevented the insured from accessing art files, data, and software on its server. The policy provided coverage for “electronic media and records,” defined to include “storage media” and “data stored on such media.” The court concluded that the inability to access data and software constituted a “direct physical loss.” The opposing conclusions reached by the EMOI and National Ink courts demonstrate the complexity of determining coverage for cyber events, and show how differences in policy language and applicable law can affect the availability of coverage.

Coverage for “catfishing”

In November 2022, a federal court in Minnesota ruled that technology consulting company Fishbowl was entitled to coverage for losses that occurred after a bad actor infiltrated a senior staff accountant’s email and, posing as the accountant, provided fraudulent account information to a Fishbowl client seeking to pay invoices. Fishbowl sought coverage under a cyber-business interruption and extra expense coverage form in its technology professional liability policy for the BEC-related loss. Fishbowl’s insurer, Hanover, argued that coverage was not available because the loss did not arise out of Fishbowl’s “business operations” and the loss sought recovery of money “already earned” rather than money that “would have been earned.” The court disagreed, holding that Fishbowl was entitled to coverage for the “catfishing” hack for loss of business income. Fishbowl Solutions, Inc. v. Hanover Insurance Co. (D. Minn. Nov. 3, 2022).

Cyber risks affecting other insurance sectors

Cyber risks for directors and officers

In March 2022, the SEC issued its proposed new proposed cybersecurity rules for public issuers, which, if adopted, would require companies to disclose in their public filings information concerning their cybersecurity measures and expertise. The proposed rules could increase exposure under D&O policies for suits alleging violations of securities laws and breaches of fiduciary duty due to alleged cybersecurity oversight failures. Policyholders should be aware that the risks associated with maintaining a cybersecurity program and engaging in oversight of cybersecurity and cyber risks not only arise in the context of cyber insurance itself, but can also increase potential exposure under other insurance coverage.

Cyber risks for plan administrators

A federal court in New York ruled that an ERISA suit brought by a former employee seeking to recoup funds from her retirement account that were stolen after a 2020 cybersecurity incident could move forward against the employer and the plan administrator. The court denied the company’s and the plan administrator’s motions to dismiss. This case demonstrates how risks associated with cybersecurity can create unexpected risk exposures in other business areas. Disberry v. Employee Relations Comm. of the Colgate-Palmolive Co. (S.D.N.Y. Dec. 19, 2022). Companies should review their employee benefit plan fiduciary liability insurance to determine whether it may respond to potential liability arising from cyber risks.

As cyber risks continue to evolve, businesses seeking to mitigate risks should consider the above cyber risk trends when considering insurance coverage for 2023.