Cybersecurity Insurance Coverage: Prudent Risk Management for Companies of All Sizes

Background

The facts are relatively straightforward, yet unique when compared with other cases where a data breach occurs as a result of hacking, encryption or pirating. See Recall Total Info. Mgmt., Inc. v. Fed. Ins. Co. (“Recall I“), 2012 Conn. Super. LEXIS 227 (Jan. 17, 2012) (both the Connecticut Appellate and Connecticut Supreme Courts adopted their facts from the Connecticut Superior Court's decision, which are set forth in summary below). In this instance, plaintiff Recall Total (“Recall”) entered into a contract with IBM to transport and store tapes containing electronically stored personal information of 500,000 current and past IBM employees. Recall, in turn, subcontracted with another company, Executive Logistics Services, LLC (“Ex Log”) (and together with Recall, “Plaintiffs”), to provide transportation services for the tapes. These tapes were not encrypted, but “[were] not the type that [could] be read by personal computer.” Recall I, 2012 Conn. Super. LEXIS, at *24. Pursuant to the contract, Ex Log maintained a $2 million CGL policy, a $1 million automobile liability policy, a $2 million fidelity bond/commercial crime policy, a $2 million professional liability policy, and a $5 million umbrella/excess liability policy, all naming Recall as an additional insured. Specifically, Federal Ins. Co. issued the CGL policy and Scottsdale Ins. Co. issued the commercial liability umbrella policy.