Travelers Prop. Cas. Co. of Am. v. Fed. Recovery Services. The first widely-recognized case interpreting a cyber insurance policy put a win squarely in the insurer column.

Federal Recovery Services Inc. (FRS) is a data processing vendor that handles electronic payment transactions. In connection with these services, FRS stores and transmits electronic data, including personal identification information, used to process payments. FRS purchased a Travelers CyberFirst Policy, which provided technology errors and omissions coverage.

The underlying plaintiff, Global Fitness Holdings LLC, owned and operated fitness facilities in several states and contracted with FRS to handle customer payments. Pursuant to an asset purchase agreement with LA Fitness, Global Fitness asked FRS to surrender payment data for inclusion in the asset purchase, but FRS allegedly refused until Global Fitness met certain demands. Global Fitness sued FRS for withholding the data, asserting claims for conversion, tortious interference and breach of contract.

Granting Travelers' motion for partial summary judgment in May 2016, the Utah federal court decided none of the allegations against FRS “sound[ed] in negligence” as required to trigger the cyber coverage. Rather, the underlying lawsuit alleged only “knowledge, willfulness and malice”—not “errors, omissions, or negligent acts,” as required by the technology errors and omissions liability form.

LESSON #1: The details matter. Note the placement of the word “negligence,” which arguably modifies only “act”—not “error” or “omission.”

Security Protocols and “Mistake” Exclusions

Columbia Casualty Co. v. Cottage Health System. Concerns that cyber insurers might attempt to deny coverage based on an insured's failure to implement appropriate security protocols began taking shape last year, when CNA filed suit seeking to avoid coverage for a hospital system based on the system's failure to abide by “minimum required practices” disclosed in its policy application.

In 2013, the insured experienced a data breach implicating more than 30,000 confidential patient records stored without encryption on internet-accessible network servers. Breach litigation ensued, alleging the insured violated its duties to maintain the security of patient data and to detect and prevent breaches. The putative class action was settled for $4.1 million.

When the breach occurred, the insured was covered under a $10 million “NetProtect360” policy issued by Columbia Casualty Co., a CNA insurer. In the coverage lawsuit, CNA sought a declaration that it owed no coverage under the policy because the insured failed “to continuously implement the procedures and risk controls identified in the [insurance application].” Based on the insured's representations regarding its security protocols, CNA argued coverage was barred by the “Failure to Follow Minimum Required Practices” exclusion because the data breach was caused by unsafe file transfer protocol settings.

LESSON #2: Although Cottage Health was dismissed based on the insurer's failure to comply with the policy's ADR clause, corporate policyholders should watch carefully for exclusions that effectively shift the risk back to the insured to follow certain protocols, policies, procedures, etc. Insurance, after all, is arguably designed to protect the insured against such failures.

Assume Nothing— Understand the Policy and its Limitations

P.F. Chang's China Bistro, Inc. v. Fed. Ins Co. Although coverage for fines, penalties and other assessments is a widely-available component of cyber insurance, policies are not standardized. In June 2014, P.F. Chang's learned that computer hackers obtained and posted to the internet approximately 60,000 customer credit card numbers. After reimbursing more than $1.7 million for costs incurred because of the breach, including expenses associated with a forensic investigation and the costs of defending customer litigation, P.F. Chang's cyber insurer denied coverage for assessments charged back to P.F. Chang's by Bank of America, its servicer for processing credit card payments. While important to an insured classified as “high risk” based upon more than six million transactions annually, P.F. Chang's cyber policy omitted this coverage. “[B]ecause cybersecurity insurance policies are relatively new to the market,” the court resorted to cases interpreting other types of policies, concluding that the coverage sought by P.F. Chang's was not provided by its policy. Notably, the court found “no evidence that [P.F.] Chang's bargained for coverage for potential [a]ssessments, which it certainly could have done.”

LESSON #3: To address potentially significant gaps in coverage and avoid unpleasant surprises, corporate policyholders must understand both the exposures they seek to insure and the scope of the coverage provided by their policies.

As cyber insurance continues to evolve, policyholders and insurers alike must manage exposures in an environment that faces new threats on daily basis. Until the provisions of these non-standardized policies are tested by the courts, the uncertainty is best addressed by careful risk assessment and proactive negotiation during the underwriting process.

Originally published on texaslawyer.com. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.