The U.S. District Court for the Northern District of Alabama Finds No Coverage for Suit Alleging Insured’s Computer Network Was Hacked, Damaging Credit Unions

A federal district court in Alabama has ruled that a grocery store was not entitled to coverage of a lawsuit brought by credit unions alleging that they had been damaged when the store’s computer network was hacked.

The Case

Three credit unions sued Camp’s Grocery, Inc., which operated a grocery store in Hokes Bluff, Alabama, alleging that Camp’s computer network had been hacked, compromising confidential data on its customers, including their credit card, debit card, and check card information. That breach, the credit unions claimed, had caused them to suffer losses on their cardholder accounts, including for reissuance of cards, reimbursement of their customers for fraud losses, lost interest and transaction fees, lost customers, diminished good will, and administrative expenses associated with investigating, correcting, and preventing fraud.

The credit unions maintain that Camp’s was liable for their damage on the theory that the data breach had been caused by Camp’s failure to provide adequate computer systems and employee training or to maintain adequate encryption and intrusion detection and prevention systems.

The credit unions raised claims against Camp’s under Alabama law for negligence, wantonness, misrepresentation, and breach of contract, as well as under federal law for violation of the Gramm-Leach-Bliley Act (which requires companies that offer consumer financial products or services to explain their information-sharing practices to their customers and to safeguard sensitive data).

Camp’s, in turn, filed an action against its insurance carrier, State Farm Fire & Casualty Company, seeking a declaration that State Farm had to defend and indemnify Camp’s in the credit unions’ action.

The parties moved for summary judgment.

The District Court’s Decision

The district court granted summary judgment in favor of State Farm, finding that it had no duty to defend or indemnify Camp’s.

In its decision, the district court explained that State Farm had not promised to “defend” or “indemnify” Camp’s with respect to claims involving computer equipment or electronic data. Rather, the district court said, State Farm had promised to pay for an accidental “direct loss” to Camp’s computer programs or electronic data. This “unambiguously” afforded first-party coverage only and did “not impose a duty to defend or indemnify the insured against legal claims for harm allegedly suffered by others, as in third-party coverage,” the district court said.

The district court added that the policy provision that stated that State Farm “may elect to defend [the insured], at [State Farm’s] expense, against suits arising from claims of owners of property” gave the insurer a “discretionary choice or right to defend” and did “not create a duty” to do so.

Finally, the district court rejected the argument put forth by Camp’s that the credit unions’ lawsuit sought damages for “property damage” insofar as the credit unions had alleged that they had suffered “losses for replacement customer debit and credit cards.” The district court said that even if credit and debit cards were tangible property, the credit unions had not asserted that Camp’s acts or omissions had caused physical harm or damage to any cards as tangible property. Rather, the credit unions had asserted that Camp’s lax computer network security had allowed the intangible electronic data contained on the cards to be compromised such that the magnetically encoded card numbers could no longer be used, causing purely economic loss flowing from the need to issue replacement cards with new electronic data.

Claims for damages arising out of Camp’s allegedly unlawful handling of electronic data on the credit cards were not claims for “property damage” under the policy and were excluded from coverage, the district court concluded.

The case is Camp’s Grocery, Inc. v. State Farm Fire & Cas. Co., No. 4:16-cv-0204-JEO (N.D. Ala. Oct. 25, 2016).