A federal district court in Florida has ruled that a claim against a policyholder arising out of a hacker’s theft of confidential credit card information was not covered under a commercial general liability (CGL) policy. St. Paul Fire & Marine Ins. Co. v. Rosen Millennium, Inc., M.D. Fla. Case No. 17-cv-540 (Sept. 28, 2018). This is not the first such decision. Courts have held similarly in Innovak Int’l, Inc. v. Hanover Ins. Co., 280 F.Supp.3d 1340, 1347-1348 (M.D. Fla. 2017) and Zurich American Ins. Co. v. Sony Corp. of America, 2014 WL 3253541, 2014 N.Y. Misc. LEXIS 5141 at *71 (N.Y. Sup. Ct. Feb. 21, 2014).
While we disagree with these courts’ reasoning, policyholders concerned about data breach liability should take note of these decisions and consider buying more reliable insurance protection for this risk.
In Rosen Millennium, a client of data security firm Millennium discovered that a hacker had stolen confidential credit card information from its computer system. The client responded to the breach and asserted a claim against Millennium for the fees and expenses it incurred, as well as other losses. The client contended, in a pre-litigation demand letter, that Millennium had been negligent in protecting the information on its computer system and, as a result, “made private information known to third parties that violated a credit card holder’s right of privacy.”
Millennium sought a defense against the claim from its CGL insurer, St. Paul. The St. Paul CGL policy covered suits alleging “personal injury,” defined as an “injury, other than bodily injury or advertising injury, that’s caused by a personal injury offense.” A “personal injury offense” included “[m]aking known to any person or organization covered material that violates a person’s right of privacy.”
Even though the client’s demand letter alleged that Millennium “made private information known to third parties”—fitting squarely within the policy’s coverage grant—the court found that St. Paul did not have a duty to defend. The court first noted that the parties agreed that “making known” had the same meaning as “publication.” It then relied on Innovak and Sony, which interpreted the word “publication” in CGL policies and found no coverage for hacking-related claims because the policyholder must be the one doing the “publishing.” The Rosen Millennium court then held that because the stolen credit card information was “made known” by a hacker, not an affirmative act of...
