A federal court in Alabama granted summary judgment in favor of an insurer in a lawsuit brought by credit unions following a cyberbreach of the insured’s network, finding the insurer did not have to defend or indemnify. Camp’s Grocery, Inc. v. State Farm Fire & Cas. Co., 2016 WL 6217161 (N.D. Ala. Oct. 25, 2016).

Credit unions that operated in the insured’s store sued the insured alleging that a cyberhack of the insured’s network compromised customers’ confidential information and credit and debit card data. The credit unions alleged they suffered losses as they were forced to reissue and reinstate customer’s cards and that the hacking compromised their customer’s confidential data that resulted in the loss of cardholder’s accounts, reissuance of cards, reimbursement of their customers losses and the loss of current and potential customers. The insured had a liability policy for which coverage was limited to harm to “tangible property,” which did not include “electronic data.” The policy also excluded coverage for “damages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.” However, the policy included an endorsement which covered “accidental direct physical loss” to computer equipment and removable data storage media used in the insured’s business.

The insured sought a declaratory judgment on the insurer’s duty to defend and indemnify, and both parties moved for summary judgment. The insurer argued that coverage was not available because the policy covered damages for only “tangible property” loss, which did not include electronic data. The court granted the insurer’s motion for summary judgment, holding that coverage was not available under the policy because the underlying lawsuit only alleged claims of purely economic loss. The court additionally found that the credit unions’ claims for “property loss” were based on breached electronic data contained on the cards, which was intangible, and thus not covered. It also held that the endorsement covering “accidental direct physical loss,” which afforded first-party coverage, did not impose a duty to defend or indemnify against claims for harm allegedly suffered by the credit unions.