On December 8, 2015 an insurer for Premera Blue Cross sued to terminate its defense obligation (and any indemnity obligation) in a class-action lawsuit involving the theft of 11 million medical records. We have previously reported on the massive Premera breach and the many class action lawsuits that followed the breach (now consolidated in Oregon). The insurer - Atlantic Specialty, a division of OneBeacon - seeks a declaratory judgment that it can cease defending Premera, and that it has no obligation to indemnify, based on several exclusions in its policy.
OneBeacon did not issue a cyber-liability policy to Premera; rather, the dispute centers on a general liability policy. OneBeacon likely picked up the defense because of the "personal and advertising injury" coverage part (more on that later). OneBeacon's policy did not include any of the 2013 standard-form exclusion endorsement that broadly exclude cyber-breach-related claims, which we have written about.
Instead OneBeacon appears to be relying on several more subtle changes to the standard liability policy language to excuse it from providing coverage. One of those changes is this: a change to the standard definition of "personal injury" from "e. Oral or written publication, in any manner, of material that violates a person's right of privacy" to "e. Oral or written publication of material that violates a person's right of privacy." Can you spot the difference? It's the deletion of "in any manner" as a modifier to the term "publication." That "in any manner" phrase has been interpreted as making the coverage pretty broad, and to include situations in which a hacker -- and not the insured -- views, and perhaps attempts to sell stolen personal information (as opposed to a more traditional form of "publication"). OneBeacon also cites a number of other exclusions and modifications to standard-form coverage, of course, including several that make similarly subtle changes.
This suit is a great example of why organizations at risk of significant claims should parse every proposed endorsement or alteration to standard coverage forms carefully, before purchase. While it may not be possible to avoid every coverage dispute, and some carriers may not be willing to discuss language changes, a careful read of a proposed policy can at least avoid surprise when a big claim comes in and you need the coverage most.
