Court Allows Insurers’ Contract Claims to Proceed in Cybersecurity Dispute
When Delaware-based software application and data hosting provider for nonprofits, Blackbaud Inc. suffered a major ransomware attack, sensitive data and information about their clients hung in the crosshairs.
The 2020 hacker threatened to publish the data unless Blackbaud paid ransom. Instead of transparency, Blackbaud revealed the breach on its website, stating that “[n]o action is required on your end because no personal information about your constituents was accessed.”
But that was untrue. By 2023, the company agreed to pay a $3 million fine to the SEC to resolve the charges that the company made misleading disclosures about the cybersecurity attacks. Blackbaud also paid out $49 million to resolve state law claims brought by the attorneys general of all 50 states.
Meanwhile, the clients whose data had been ransomed conducted their own investigation and took remedial steps to mitigate their losses.
They turned to their insurers for help. After some of the losses were covered, the insurers then sued Blackbaud as subrogees/assignees to recover their payments to the insureds.
In the Delaware Supreme Court case, Travelers Casualty and Surety Company of America v. Blackbaud, Inc., Travelers Casualty and Surety Company of America, Philadelphia Indemnity Insurance Company, Acadia Insurance Company, and Union Insurance Company jointly took on Blackbaud.
The insurers shared they collectively provided insurance coverage to 97 of Blackbaud’s educational and nonprofit clients, the insureds, for cyber and criminal incidents like data breaches. The court was made aware that Blackbaud and the insureds had also signed an agreement in which Blackbaud agreed to protect the insureds sensitive data, including maintaining a commercially reasonable information security procedure and standards, protecting against unauthorized access to or use of confidential information, and having a breach response plan in place, among other things.
After the trial court dismissed the claim twice, the Delaware Supreme Court reversed, holding that the insurers had adequately pled a breach of contract claim and could proceed. It acts as a stark reminder that courts are looking at cyber risk allocation in a new light, keeping insurers, vendors, and customers in the light while making their decision. &
