Is Insurance Coverage Available Under Traditional Crime Policies For Computer Hacking?

Every day another corporation suffers a major data breach. Class action privacy breach lawsuits often follow, and companies often incur substantial nonlegal expenses in responding to data breaches. It is important for every business to understand cyber risks and how to insure against losses arising from data breaches and theft of electronically stored information. In a ruling that may enable companies to obtain insurance coverage for data breaches under traditional first party insurance policies, the United States Court of Appeals for the Sixth Circuit held in Retail Ventures, Inc. v. Nat'l Union Fire Ins. Co., 691 F.3d 821 (6th Cir. 2012) that losses resulting from the theft of customers' banking information from a retailer's computer system are covered under a commercial crime policy.

The Retail Ventures Decision

In February 2005, a computer hacker accessed the computer system of Designer Shoe Warehouse (DSW) and downloaded credit card and checking account information from 1.4 million DSW customers. Following the data breach, DSW incurred losses of more than $5 million, which included not only losses incurred by the company in connection with customer communications and public relations but also legal fees and expenses incurred in addressing customer claims, lawsuits and investigations by state attorneys general and the Federal Trade Commission. Losses associated with "charge backs, card reissuance, account monitoring, and fines imposed by" the credit card companies accounted for more than $4 million of those expenses.

DSW and its parent company, Retail Ventures, sought coverage for the losses under a commercial crime policy issued by AIG subsidiary National Union Fire Insurance Company of Pittsburgh, PA. DSW argued that coverage existed under a policy endorsement providing coverage for "[l]oss which the Insured shall sustain resulting directly from ... the theft of any Insured property by Computer Fraud." After National Union refused to provide coverage, the policyholders filed suit in Ohio federal court seeking coverage for all damages DSW experienced.

The central issue in the case was whether DSW could recover the amounts paid to third parties as a result of the data breach. The insurer argued that the policy at issue was a first-party fidelity bond, and therefore DSW was entitled to recover damages only for its own losses e.g., customer communication and public relations costs but not for any liability to third parties such as...