Following the data breach, on March 2, 2015, MasterCard issued an “ADC Operational Reimbursement/Fraud Recovery Final Acquirer Financial Responsibility Report” to Bank of America Merchant Services (“BAMS”), which had a master service agreement (“MSA”) with Chang's to process credit card payments made by Chang's customers. This report imposed three assessments on BAMS:

- A Fraud Recovery Assessment of $1,716,798.85;

- An Operational Reimbursement Assessment of $163,122.72 for Chang's data breach; and

- A Case Management Fee of $50,000.

The Fraud Recovery Assessment reflected costs, as calculated by MasterCard, associated with fraudulent charges that might have arisen from, or might be related to, the security compromise. The Operational Reimbursement Assessment reflected costs to notify cardholders affected by the security compromise and to reissue and deliver payment cards, new account numbers, and security codes to those cardholders. The Case Management Fee was a flat fee and related to considerations regarding Chang's compliance with Payment Card Industry Data Security Standards.

On March 11, 2015, BAMS sent Chang's a letter (the “BAMS Letter”) stating:

MasterCard's investigation concerning the account data compromise event involving [Chang's] is now complete. [BAMS] has been notified by MasterCard that a case management fee and Account Data Compromise (ADC) Operational Reimbursement and Fraud Recovery (ORFR) are being assessed against [BAMS] as a result of the data compromise. In accordance with your [MSA] you are obligated to reimburse [BAMS] for the following assessments:

• $50,000.00 – Case Management Fee

• $163,122.72 – ADC Operational Reimbursement

• $1,716,798.85 – ADC Fraud Recovery

$1,929,921.57

Chang's notified Federal of the BAMS Letter on March 19, 2015 and sought coverage for the assessments.

Pursuant to the MSA, and in order to continue operations and not lose its ability to process credit card transactions, Chang's reimbursed BAMS for the assessments on April 15, 2015.

Federal denied coverage for the assessments and Chang's sued. Chang's alleged that the policy's insuring clauses covered each assessment from the BAMS Letter. Specifically, Chang's claimed that Insuring Clause A covered the ADC Fraud Recovery Assessment, Insuring Clause B covered the ADC Operational Reimbursement Assessment, and Insuring Clause D.2 covered the Case Management Fee.

For its part, Federal argued that the BAMS Letter and the assessments did not fall within the coverage provided by any of the policy's insuring clauses. Additionally, Federal contended that certain exclusions contained in the policy barred coverage.

The Bank of America Master Service Agreement

The Master Service Agreement (“MSA”) between Chang's and BAMS provided:

[Chang's] agrees to pay [BAMS] any fines, fees, or penalties imposed on [BAMS] by any Associations, resulting from Chargebacks and any other fines, fees or penalties imposed by an Association with respect to acts or omissions of [Chang's].

It also provided:

In addition to the interchange rates, [BAMS] may pass through to [Chang's] any fees assessed to [BAMS] by the [Associations], including but not limited to, new fees, fines, penalties and assessments imposed by the [Associations].

The Federal Policy

Insuring Clause A provided that:

[Federal] shall pay for Loss on behalf of an Insured on account of any Claim first made against such Insured … for Injury.

It defined:

Claim

as:

a written request for monetary damages … against an Insured for an Injury

, which included:

Privacy Injury

, defined as:

injury sustained or allegedly sustained by a Person because of actual or potential unauthorized access to such Person's Record, or exceeding access to such Person's Record

, which included:

any information concerning a natural person that is defined as: (i) private personal information; (ii) personally identifiable information … pursuant to any federal, state … statute or regulation, … where such information is held by an Insured Organization or on the Insured Organization's behalf by a Third Party Service Provider

or

an organization's non-public information that is … in an Insured's or Third Party Service Provider's care, custody, or control

In addition, it provided:

Third Party Service Provider means an entity that performs the following services for, or on behalf of, an Insured Organization pursuant to a written agreement: (A) processing, holding or storing information; (B) providing data backup, data storage or data processing services 

Insuring Clause B provided that:

[Federal] shall pay Privacy Notification Expenses incurred by an Insured resulting from [Privacy] Injury.

The policy defined:

Privacy Notification Expenses

as:

the reasonable and necessary cost[s] of notifying those Persons who may be directly affected by the potential or actual unauthorized access of a Record, and changing such Person's account numbers, other identification numbers and security codes 

Under Insuring Clause D.2:

[Federal] shall pay: … Extra Expenses an Insured incurs during the Period of Recovery of Services due to the actual or potential impairment or denial of Operations resulting directly from Fraudulent Access or Transmission.

It defined:

Extra Expenses

to include:

reasonable expenses an Insured incurs in an attempt to continue Operations that are over and above the expenses such Insured would have normally incurred. Extra Expenses do not include any costs of updating, upgrading or remediation of an Insured's System that are not otherwise covered under [the] Policy.

In the context of Extra Expenses, Period of Recovery of Services:

begins: … immediately after the actual or potential impairment or denial of Operations occurs; and will continue until the earlier of…the date Operations are restored, … to the condition that would have existed had there been no impairment or denial; or sixty (60) days after the date an Insured's Services are fully restored … to the level that would have existed had there been no impairment or denial.

computer time, data processing, or storage functions or other uses of an Insured's System

a person has: fraudulently accessed an Insured's System without authorization; Exceeded Authorized Access; or launched a Cyber-attack into an Insured's System. 

Exclusion D.3.b provided:

With respect to all Insuring Clauses, [Federal] shall not be liable for any Loss on account of any Claim, or for any Expense … based upon, arising from or in consequence of any … liability assumed by any Insured under any contract or agreement.

Under Exclusion B.2:

With respect to Insuring Clauses B through H, [Federal] shall not be liable for … any costs or expenses incurred to perform any obligation assumed by, on behalf of, or with the consent of any Insured. 

The district court, applying Arizona law, found no coverage for the assessments.

In its decision, the district court ruled that Exclusions D.3.b and B.2 and the definition of Loss – which barred coverage for contractual obligations an insured assumed with a third-party outside of the policy – barred coverage for all of the assessments.

It observed that, in “no less than three places in the MSA,” Chang's had agreed to reimburse or compensate BAMS for any “fees,” “fines,” “penalties,” or “assessments” imposed on BAMS or, in other words, to indemnify BAMS. Moreover, the district court continued, there was no evidence indicating that Chang's would have been liable for these assessments absent its agreement with BAMS.

Simply put, the district court stated, “these exclusions unequivocally bar[red] coverage for the [a]ssessments.”

Finally, the district court rejected Chang's claim that coverage existed pursuant to the “reasonable expectation” doctrine, noting that this doctrine applied only if the insured's expectation of coverage was “objectively reasonable” and the insurer “had reason to believe that the [insured] would not have purchased the … policy if [the insured] had known that it included” the complained of provision. The district court found no evidence that during the underwriting process Chang's expected that coverage would exist for assessments following a hypothetical data breach and no evidence showing that Chang's insurance agent had asked Federal's underwriter if such assessments would be covered during their correspondence.

The district court determined that “no expectation existed at the time it purchased” the policy and that there was no evidence that Chang's had bargained for coverage for potential assessments, “which it certainly could have done.” Because no expectation existed for this type of coverage, the district court said, it was unable to find that Chang's had met its burden of satisfying the “objective reasonableness” requirement to invoke the reasonable expectation doctrine.

The case is P.F. Chang's China Bistro, Inc. v. Federal Ins. Co., No. CV-15-01322-PHX-SMM (D. Ariz. May 31, 2016).