The Pennsylvania Supreme Court recently upheld an appeals court’s opinion finding that a commercial property policy covered a theft of an insured’s data on a service provider’s server but held that the damages did not exceed the deductible. In Watchword Worldwide v. Eerie Insurance Exchange,308 A.3d 294 (Penn. Sup. Ct. 2024), the Superior Court, Pennsylvania’s intermediate court of appeals, considered an appeal by Erie Insurance Exchange of a verdict against it for breach of contract and bad faith under a commercial property insurance policy. The case arose from the theft by a hacker of electronic videos and API belonging to Watchword Worldwide that were stored on a server belonging to GoDaddy. Watchword Wells Bible videos through a cell phone app.
“Your Computers” Included Third Party Servers
In attempting to avoid coverage, Eerie argued that policy language which provided coverage for electronic data stolen from “your computers” did not apply to data on computers or computer equipment owned by third party service providers like GoDaddy. “Your computers” was not defined in the policy. The appeals court found that this term was ambiguous and must be construed in favor of the insured. As result there was coverage for damages caused by the theft of the videos and API from GoDaddy's servers.
Damage was Under the Deductible
Unfortunately for the insured, the court also found that the actual cost of replacing the videos and API was less than $2500 which was the amount of the deductible. Because of this, the appeals court reversed the judgment in favor of the policyholder on breach of contract.
No Bad Faith
As to the bad faith claim, the court held that Eerie had a reasonable basis for denying the claim because it's interpretation of “your computer,” albeit ultimately wrong, was at least reasonable and because Erie was correct in arguing that the damage did not exceed the policy deductible. (As to the first reason, other jurisdictions, including Alabama differ from Pennsylvania and find that an insurance company commits bad faith when it denies a claim on the basis of an ambiguous provision. This is because the insurance company drafts the policy and has the ability to draft a clear policy.)
Watch Out for Coverage Gaps and Limitations; Consider Buying Dedicated Cyber Policy
This decision highlights some of the potential coverage gaps that businesses face with respect to insuring against cyber threats. It is important for a policyholder to check their policy and make sure that it covers cyber events and data breaches that affect the policyholder’s data even when that data is on a third-party server. This is very important considering the amount of data being stored on the cloud. Policyholders should consider buying a cyber policy in addition to general liability and property policies. While many property and liability policies do provide some cyber protection, it can be very minimal and riddled with exclusions.
If you have a cyber insurance claim and your insurer is denying or underpaying you, give us a call.
댓글