Why it matters
Another court has held that traditional general liability and property policies do not provide coverage for losses arising from a cyber attack. A grocery store in Alabama had its customers' credit and debit card information compromised, and was then sued by three credit unions for the cost of reissuing cards, reimbursing customers for fraud losses, and administrative expenses.
When the grocer tendered defense of the suit to State Farm, the insurer refused to defend or indemnify the claims. The policy only provided coverage for direct loss to computer programs and electronic data, the Alabama federal court determined, and not the harm alleged by the third parties in the underlying complaint. This decision highlights the challenges facing policyholders when seeking to recover for cyber-related events under traditional general liability and property policies, and underscores the need for companies exposed to cyber-related risk to consider purchasing specialized cyber policies.
An Alabama grocery store, Camp's Grocery, Inc., was hit with a lawsuit by three credit unions. The credit unions alleged that Camp's computer network was hacked, compromising confidential data on its customers, including their credit card, debit card, and check card information.
As a result, the credit unions alleged, they were forced to reissue cards, reimburse customers for fraudulent activity, pay various administrative expenses. In addition, the credit unions asserted, they suffered losses such as diminished goodwill and lost customers. The suit asserted claims for negligence, wantonness, misrepresentation, and breach of contract.
Camp's sought coverage for the lawsuit from State Farm Fire & Casualty Company, but State Farm refused to defend. Camp's then filed a declaratory action suit against State Farm. The relevant policy provided coverage for both first-party property losses and general liability, but expressly excluded coverage for "electronic data." Moreover, a covered "accident" was defined as not including any "loss of 'electronic data,' … or other condition within or involving 'electronic data' of any kind."
Camp's pointed the court in the direction of two endorsements attached to the policy, the "FE-8743 Inland Marine Computer Property Form" (IMCPF) and the "FE-8739 Inland Marine Conditions" (IMC). The IMCPF included a general insuring provision that State Farm would pay for "accidental direct physical loss" to computer equipment and removable data storage media.
State Farm countered with a motion to dismiss, arguing that the IMCPF could not be read to provide defense or indemnity for the underlying lawsuit because it was a first-party insuring agreement that covered only losses sustained directly by the insured itself.
U.S. Magistrate Judge John E. Ott agreed. The Alabama Supreme Court has recognized a distinction between first-party insurance and third-party insurance, he explained, and neither the IMCPF nor the IMC contained language in which State Farm promised to "defend" or "indemnify" Camp's "whether in regard to claims involving computer equipment, electronic data, or anything else, for that matter." Rather, the general insuring agreement of the IMCPF provided that State Farm "will pay for accidental direct physical loss."
"Such promises to pay the insured's 'direct loss' unambiguously afford first-party coverage only and do not impose a duty to defend or indemnify the insured against legal claims for harm allegedly suffered by others, as in third-party coverage," the court wrote, citing similar decisions from California, Colorado, Florida, New York, and the Ninth U.S. Circuit Court of Appeals. "Therefore, the terms of the IMCPF itself impose no obligation on State Farm to either defend or indemnify Camp's in the underlying action."
Judge Ott was not persuaded by Camp's alternative argument that the IMC provides that in the event of a covered loss, the insurer "may elect to defend [the insured] at [State Farm's] expense." While the policyholder read this language to mean that State Farm has assumed a duty to defend, the court disagreed. "On its face, a policy provision that the insurer 'may elect to defend' an insured unambiguously gives the insurer a discretionary choice or right to defend; it does not create a duty, that is a nondiscretionary legal obligation, to do so."
The insured then urged the court to declare the elective language in the IMC ambiguous in light of other provisions of the policy. The endorsements expanded the scope of liability under the policy, Camp's said, requiring State Farm to render a defense and indemnity for claims based on losses involving computers and electronic data. But the court again disagreed, finding the argument "fatally flawed." Because the credit unions did not allege "property damage" covered by the policy, the suit was therefore excluded from coverage, and the policy provisions and the endorsements did not render the policy ambiguous.
"Camp's suggests that it is merely interpreting the different coverages of the Policy as an integrated whole," Judge Ott wrote. "But what Camp's is actually doing is selectively reading the Policy in a piecemeal fashion, picking and choosing parts of different coverages while conveniently ignoring other terms from those same coverages that would preclude or exclude their application to the Credit Unions' claims."
The provisions of the endorsements "stand distinctly separate and apart from the business liability insurance afforded" by the policy and do not expand it, the court concluded. "In the end, the … endorsements afford only first-party coverage for certain computer equipment and electronic data, as specified in the IMCPF," the judge said. "Those endorsements do not create, recognize, or assume the existence of a duty to defend or indemnify against claims brought by third parties."
Finding the policy language was not ambiguous, the court held State Farm did not have a duty to defend or indemnify Camp's in the underlying action, granting the insurer's motion for summary judgment.
To read the memorandum opinion in Camp's Grocery, Inc. v. State Farm Fire & Casualty Co., click here.