Newsletters
Risk Central
Digital Edition6th Circuit Rules Data Breach Claims Not Covered by CGL Policies
Commercial general liability (CGL) insurance policies do not cover losses stemming from a data breach when such policies contain an electronic data exclusion, according to a recent decision by the 6th U.S. Circuit Court of Appeals.
In a case closely watched by the insurance industry, the court’s decision in Home Depot Inc. vs. Steadfast Insurance Co. affirmed a lower court’s decision denying Home Depot’s claim against Steadfast Insurance Co. and Great American Assurance Co. for costs related to a major data breach, highlighting the critical distinction between cyber insurance and general liability coverage.
Between 2014 and 2015, Home Depot suffered a significant cyberattack where hackers accessed the company’s computer system and stole payment card information from millions of consumers who used self-checkout terminals. Following the breach, financial institutions sued Home Depot for costs incurred when they had to cancel and reissue payment cards, notify customers, investigate fraud claims, and refund fraudulent charges. Home Depot ultimately settled these claims for approximately $170 million.
Home Depot’s dedicated cyber insurance policies covered $100 million of the settlement amount. For the remaining costs, Home Depot turned to its general liability insurers, Steadfast and Great American, arguing coverage under two theories.
First, the “reissuance theory” claimed the insurers should indemnify costs incurred when financial institutions reissued physical payment cards. Second, the “reduced usage theory” sought indemnification for lost interest and transaction fees resulting from consumers using their cards less frequently after the breach. Home Depot also claimed the insurers owed a duty to defend against the financial institutions’ lawsuits.
The insurers denied coverage, pointing to policy language that specifically excluded “[d]amages arising out of the loss of, loss of use of, damage to, corruption of, inability to access, or inability to manipulate electronic data.” They also highlighted policy provisions stating that “electronic data” is not considered “tangible property.”
In its analysis, the 6th Circuit determined that the electronic data exclusion unambiguously barred coverage for both of Home Depot’s theories. Writing for the court, Judge Thapar explained: “When hackers broke into Home Depot’s system, they gained access to payment card data. The hackers’ access made that data useless. Why? The entire value of a credit card—or any payment card—is the ability to make secure and seamless transactions.”
The court rejected Home Depot’s argument that the electronic data exclusion was ambiguous, finding instead that the plain text of the policy clearly excluded coverage for damages arising from the data breach. Regarding the duty to defend, the court noted that the financial institutions’ complaint expressly dealt with harms arising from an electronic data breach, which fell squarely within the CGL policy exclusion.
View the full 6th Circuit decision here. &
