A federal judge in Alabama has ruled that an insured was not entitled to coverage for a lawsuit brought by three credit unions alleging that the insured was liable for damage they suffered after the insured's computer network was hacked and customers' confidential data was compromised.
The Case
Three credit unions sued Camp's Grocery, Inc., which operated a grocery store in Hokes Bluff, Alabama, along with its franchisor, Piggly Wiggly, LLC, alleging that Camp's computer network had been hacked, compromising confidential data on its customers, including their credit card, debit card, and check card information. That breach, the credit unions claimed, caused them to suffer losses on their cardholder accounts, including for reissuance of cards, reimbursement of their customers for fraud losses, lost interest and transaction fees, lost customers, diminished good will, and administrative expenses associated with investigating, correcting, and preventing fraud.
The credit unions maintained that Camp's was liable for that damage on the theory that the data breach had been caused by Camp's failure to provide adequate computer systems and employee training and/or to maintain adequate encryption and intrusion detection and prevention systems.
Based on these allegations, the credit unions raised claims against Camp's under Alabama law for negligence, wantonness, misrepresentation, and breach of contract, as well as under federal law for violation of the Gramm-Leach-Bliley Act.
Camp's, in turn, filed an action against its insurance carrier, State Farm Fire & Casualty Company, demanding a declaratory judgment establishing that State Farm had to defend and indemnify Camp's in the underlying action. It relied in large measure on two forms or endorsements attached to the State Farm policy, one entitled “FE-8743 Inland Marine Computer Property Form” (the “IMCPF”)), and the other entitled “FE-8739 Inland Marine Conditions” (the “IMC”) (together, the “Inland Marine endorsements”).
The parties moved for summary judgment.
The State Farm Policy
The State Farm policy contained two principal sections, captioned:
Section I – Property
and
Section II – Liability
The general insuring clause of Section I contained a promise by State Farm to:
pay for accidental direct physical loss to…Covered Property
, encompassing
Buildings (“Coverage A”)
and
Business Personal Property (“Coverage B”)
, to the extent provided in the declarations.
The policy defined:
Business Personal Property
to include:
Property, used in your business, that you own, lease from others or rent from others, or that is loaned to you
as well as:
Property of others that is in your care, custody or control….
It also provided that:
Covered Property
did not include:
electronic data
The policy defined:
Accident
as not including:
any defect, programming error, programming limitation, computer virus, malicious code, loss of “electronic data”, loss of access, loss of use, loss of functionality or other condition within or involving “electronic data” of any kind.
The “Liability” insurance embodied in Section II of the policy included a:
Coverage L
for:
Business Liability
The general insuring clause of that section stated:
[State Farm] will pay those sums that the insured becomes legally obligated to pay as damages because of 'bodily injury,' 'property damage,' or 'personal and advertising injury' to which this insurance applies. [State Farm] will have the right and duty to defend the insured by counsel of our choice against any “suit” seeking those damages. However, [State Farm] will have no duty to defend the insured against any “suit” seeking damages for “bodily injury”, “property damage” or “personal and advertising injury”, to which this insurance does not apply. We may, at our discretion, investigate any “occurrence” or offense and settle any claim or “suit” with or without the insured's consent, for any reason and at any time.
Section II also stated that the term:
property damage
as used in Section II was limited to liability for harm to:
tangible property
, which was defined not to include:
electronic data
Section II also excluded from coverage:
damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data
An Inland Marine Computer Property Form (“IMCPF”)) attached to the policy provided:
INSURING AGREEMENTWe will pay for accidental direct physical loss to:
1. “Computer equipment”, used in your business operations, that you own, lease from others, rent from others, or that is loaned to you….
2. Removable data storage media used in your business operations to store “electronic data”.
* * *
We do not insure “computer programs” or “electronic data” except as provided in
the Computer Programs and Electronic Data Extension of Coverage.
The extension of coverage provided:
EXTENSIONS OF COVERAGE1. Computer Programs And Electronic Data
a. We will pay for accidental direct loss to:
(1) The following types of “computer programs” and “electronic data” that you own, license from others, lease from others, or rent from others:
(a) “Computer programs” used in your business operations;
(b) The “electronic data” that exists in “computer” memory or on “computer” storage media, used in your business operations;
(2) That portion of your customers' “electronic data” that is supplied to you for processing or other use in your business operations. Coverage for customers' “electronic data” is limited to the specific data file(s) containing the information you are processing or using in your business operations.
We do not cover any property you lease to others, rent to others or license to others. We do not cover “computer equipment” or removable data storage media under this Extension Of Coverage. This coverage extension is included in the Limit Of Insurance shown on the Schedule Page.
Loss does not include any consequential loss except as may be provided in the optional Loss Of Income And Extra Expense coverage.
The above-referenced “optional Loss Of Income And Extra Expense coverage” in the IMCPF provided:
OPTIONAL COVERAGE – LOSS OF INCOME AND EXTRA EXPENSE1. If a limit is shown on the Inland Marine Schedule Page for Loss Of Income And Extra Expense, coverage under this form is provided, subject to that limit, for the following:
a. The actual “Loss Of Income” you sustain due to the necessary “suspension” of your operations during the “'period of restoration”. The “suspension” must be caused by damage or destruction to property covered under this form, by a Covered Cause Of Loss;
b. Any necessary “extra expense” you incur during the “period of restoration” that you would not have incurred if there had been no damage or destruction to property covered under this form, by a Covered Cause Of Loss.
We will only pay for “Loss Of Income” or “extra expense” that you sustain during the “period of restoration” that occurs within 12 consecutive months after the date of loss. We will only pay for “ordinary payroll expenses” for 90 days following the date of loss.
2. We will not pay for:
a. Any “extra expense” or increase of “Loss Of Income” caused by suspension, lapse or cancellation of any license, lease or contract. But if the suspension, lapse or cancellation is directly caused by the “suspension” of your operations, we will cover such loss that affects your “Loss Of Income” during the “period of restoration”;
b. Any “extra expense” caused by suspension, lapse or cancellation of any license, lease or contract beyond the “period of restoration”;
c. Any other consequential loss;
d. Loss caused by seizure or destruction of property by order of governmental authority. But we will pay for acts of destruction ordered by governmental authority and taken at the time of a fire to prevent its spread.
The Inland Marine Conditions (“IMC”) attached to policy included the following:
Coverage in the Inland Marine Form is primary to any coverage provided in the policy this Form, is attached to, for the same property,The Court's DecisionThe following Conditions also apply:
1. Agreement. We agree to provide the insurance described in this policy. You agree to pay premiums when due and comply with the provisions of this policy.
* * *
4. Loss Payment. In the event of a loss covered by this policy:
* * *
b. We will not pay you more than your financial interest in the covered property.
c. We may adjust losses with the owners of lost or damaged property if other than you. If we pay the owners, such payments will satisfy your claims against us for the owners' property. We will not pay the owners more than their financial interest in the covered property;
d. We may elect to defend you, at our expense, against suits arising from claims of owners of property….
The court granted State Farm's motion.
In its decision, the court explained that there was no language in either the IMCPF or the IMC where State Farm promised to “defend” or “indemnify” the insured, whether with respect to claims “involving computer equipment, electronic data, or anything else, for that matter.”
Rather, the court continued, the IMCPF offered State Farm's promises to pay the insured's “direct loss.” According to the court, this “unambiguously” afforded first-party coverage only and did “not impose a duty to defend or indemnify the insured against legal claims for harm allegedly suffered by others, as in third-party coverage.”
Therefore, the court held, the terms of the IMCPF itself imposed “no obligation on State Farm to either defend or indemnify Camp's in the underlying action.”
The court next rejected Camp's argument that State Farm had assumed a duty to defend under the IMC, reasoning that a policy provision that the insurer “may elect to defend” an insured unambiguously gave the insurer “a discretionary choice or right to defend” and did “not create a duty” or a “nondiscretionary legal obligation, to do so.”
Finally, the court ruled that Coverage L did not afford a defense to Camp's, reasoning that the credit unions' claims for damages arising out of Camp's allegedly unlawful handling of electronic data on the credit cards were not claims for “property damage” under the policy and were excluded from coverage.


