Travelers Pays Bank’s Cyber Breach Loss, Then Sues Bank’s Website Designer to Recover the Payment

In what might well be the beginning of a new wave of litigation arising out of the current epidemic of cyber breaches, Travelers Casualty and Surety Company of America has brought suit against Incognito Studios, a web designer, to recover payments Travelers paid to its insured, Alpine Bank, to cover losses caused by the breach of the bank’s confidential data by hackers. Travelers is suing as the assignee and subrogee of the bank. The Complaint alleges that the web designer was negligent by, among other things, not placing adequate anti-malware software on the bank’s server, not disabling one or more websites of other customers running on the same server, and failing to maintain adequate encryption of bank customer data.

The suit could be the beginning of a trend in which insurers, after paying their insureds’ claims for cyber breach losses, seek to recover those payments from other parties—such as the insured’s vendors, customers, suppliers or web designers—who allegedly bear some of the responsibility for the breach. In most states, insurers have the right to bring such subrogation claims, even without the insured’s consent, and even if the policy does not include language allowing such subrogation.

Such subrogation claims can obviously be quite disruptive of an insured’s business relationships, especially if the entity pursued by the insurer is one of the insured’s valued customers or vendors. A company that decides to purchase cyber insurance to cover data breaches (and a growing number of large and midsize companies are doing so) should carefully consider asking their insurers to include an anti-subrogation clauses in their policies. Such clauses are fully enforceable, and prohibit the insurer from bringing a subrogation claim against a third-party without the insured’s consent.

If you would like a copy of Traveler’s complaint, or have questions about obtaining insurance coverage for data breaches—or whether your existing liability policy already covers such losses--please contact Butzel Long’s Insurance Coverage Specialty Team Chair, Thomas Bick, at 202-454-2818 or bick@butzel.com.