May 16, 2018 BY DEF Admin
Cyber Coverage May Be Affected by New and Traditional Defenses
In an article featured in DRI’s The Voice newsletter (May 2018), attorney Karen Karabinos and Eric Mull provide information on how misrepresentation on the applications for and the provisions of cyber policies may bar coverage in either first-party or third-party cyber claims.
As businesses realize the importance of obtaining cyber policies, insurance carriers and insureds must be cognizant of the applications for and the provisions of cyber policies that may bar coverage in either first-party or third-party cyber claims. Some of these defenses may be new, based on specialized provisions or coverages contained in the cyber policy. Other possible defenses may be traditional ones that insurers have previously raised in response to property claims.
The case of Columbia Casualty Co. v. Cottage Health System, No. 2:16-cv-3759 (C.D. Ca.), (filed May 31, 2016), highlights both the new and traditional defenses that can affect cyber coverage. Cottage Health System (Cottage) suffered a data breach that resulted in the release of private health-care patient information stored on network servers that Cottage owned and maintained. Columbia Casualty (Columbia) defended Cottage in a lawsuit brought by Cottage’s patients, and after Columbia reached a settlement with the patients, Columbia filed a declaratory judgment action against Cottage, seeking reimbursement of the costs in defending the patients’ lawsuit. In its complaint, Columbia raised several possible defenses that it has claimed warranted reimbursement by Cottage.
Columbia alleged that Cottage made misrepresentations and/or omissions of material fact concerning its data-breach risk controls when Cottage applied for the cyber policy. The application contained a “Risk Control Self Assessment” containing a list of questions, four of which asked Cottage about checking security patches, replacing default settings, and other actions that Cottage takes to reassess Cottage’s exposure to privacy threats. In response to these questions, Columbia alleged that Cottage mispresented that it had such risk controls in place.
About the Author
Karen Karabinos has been litigating cases for more the 25 years, with the last 16 focused on the complexities of property insurance law. She has successfully handled more than 75 trials and hearings and annually conducts approximately 50 depositions and examinations under oath.
Eric Mull has been practicing for 11 years in insurance defense litigation, with a focus in the areas of construction defect, professional malpractice, and first party property insurance matters.