No Personal Injury Coverage for Payment Card Breach Because Damages Resulted from Hacker’s Criminal Conduct, Not Insured’s Data Security Practices

A Florida federal district court has ruled that a claim asserting that an insured’s negligent data security practices led to a payment card breach did not trigger personal injury coverage under a CGL policy.  See St. Paul Fire & Marine Ins. Co. v. Rosen Millennium, Inc., No. 6:17-cv-540-Orl-41GJK (M.D. Fla. Sept. 28, 2018).  The court reasoned that because the hacker’s conduct, not the insured’s omissions, led to the breach, the insured did not make known any private information.  The alleged damages therefore did not “result[] from [the insured’s] business activities” but instead arose from the third-party hacker’s criminal conduct.

The insured was a subsidiary of a hotel and hospitality company.  In February 2016, the parent company became aware of a potential payment card breach at one of its hotels.  Shortly thereafter, the parent retained a forensic investigator, identified malware on its payment network, confirmed a breach window, and provided notice to affected consumers.  The parent then made a claim against the insured subsidiary, asserting that the subsidiary was negligent in providing data security services to the parent.  The subsidiary sought coverage under its CGL policy, and the insurer sought a declaratory judgment that the claim was not covered.

The court focused on the allegations that the parent’s damages resulted from the insured “ma[king] private information known to third parties that violated a credit card holder’s right of privacy.”  The allegations tracked the personal injury coverage in the CGL policy, which included the covered offense of “making known to any person or organization covered material that violates a person’s right of privacy.”  The court ruled that coverage was not triggered, however, because the cause of the breach was hacking by a third party, not the insured, and thus the insured did not “make known” any private information.

As an independent ground for finding no coverage, the court observed that the policy required any covered offense to “result[] from [the insured’s] business activities.”  Here, the court noted that the alleged injuries did not result from the insured’s business activities but, instead, resulted from the actions of third parties, i.e., the hacker.