As cyber risks only continue to worsen, these lawsuits spotlight potential cyber coverage issues for D&O policies.
n recent years, more than half a dozen securities and shareholder derivative lawsuits were brought against companies and/or their directors and officers arising out of an underlying data breach.
Following multiple cybersecurity incidents that allegedly affected millions of patients at LabCorp, which operates one of the country’s largest clinical laboratory networks, a shareholder filed a lawsuit against certain of the company’s directors and officers.
The lawsuit against LabCorp’s directors and officers is part of a growing trend of claims against directors and officers of companies arising out of data breaches or other cybersecurity incidents.
In recent years, more than half a dozen securities and shareholder derivative lawsuits were brought against companies and/or their directors and officers arising out of an underlying data breach. As cyberattacks become more frequent, the number of lawsuits brought by shareholders related to cyber incidents will likely increase as well.
Such lawsuits typically allege that the company’s management failed to implement adequate safeguards against such incidents, failed to adequately disclose the company’s cybersecurity protections and/or the impact of a data breach on the company’s business. While D&O liability insurance generally affords coverage for securities and shareholder derivative lawsuits, specific coverage issues may arise when coverage is sought under a D&O policy for a cyber-based claim.
This article will discuss the growing trend of securities and shareholder derivative lawsuits arising from cyber-related events. Next, we will discuss the potential coverage issues that could arise under D&O policies for such cases. Finally, we will also provide recommendations for D&O insurers looking to manage the growing risk of shareholder lawsuits arising from cyber incidents.
Derivative and securities litigation arising from cyber incidents
Shareholder derivative or securities class-action lawsuits arising out of underlying cybersecurity incidents or data breaches are a relatively new phenomenon.
According to Stanford Law School’s Securities Class Action Clearinghouse (SCAC), the first known securities class action lawsuit against a company following a cyber incident was filed in 2015 against LifeLock Incorporated. Since 2015, six (6) total securities class actions arising out of a data breach incident have been commenced, according to SCAC.
One high-profile example followed the 2016 reporting of two data breaches of Yahoo’s systems. After the report, Yahoo was named in a securities class action, and its management was sued in a shareholder derivative action. The securities lawsuit which was brought against Yahoo alleged that Yahoo and certain of its directors and officers made materially false and/or misleading statements and failed to disclose certain material facts of the data breaches in its public filings. The securities class action was reportedly settled in March 2018 for $80 million. In addition, a shareholder derivative lawsuit filed against certain of Yahoo’s directors and officers was settled for $29 million. The stipulation of settlement in the derivative action called for the settlement to be paid for by the defendants’ insurers.
Conversely, a shareholder derivative lawsuit was commenced against Target’s management following a data breach that occurred in 2013. The breach allegedly affected as many as 110 million customers, who had credit/debit information compromised. A shareholder derivative lawsuit was commenced against Target’s directors and officers, alleging that the defendants failed to provide for and oversee an information security program properly and failed to provide customers prompt and accurate information in disclosing the breach. In July 2016, District Court Judge in the U.S. District Court for the District of Minnesota dismissed the lawsuit.
As noted above, most recently, a shareholder lawsuit was filed against certain LabCorp directors and officers. This lawsuit appears to be novel in that the allegations are based not only on LabCorp’s own purportedly inadequate cybersecurity protections but also are based on a breach of a third-party vendor’s systems.
It is alleged in the derivative lawsuit that the third-party debt collection company, American Medical Collection Agency (AMCA), had suffered a breach of its payment portal, which affected more than 10.2 million LabCorp patients. It is further alleged that LabCorp’s management breached their fiduciary duties to the company by, among other things, providing personally identifiable information and private health information to a “business associate” with deficient cybersecurity and data breach detection and safeguards.
Coverage implications and exclusions to consider
While directors and officers of publicly traded corporations are the named defendants in securities and shareholder derivative actions, as the Yahoo example illustrates, it is the company’s D&O insurers that may be called upon to fund a settlement or an award of damages.
Although the terms of the specific policies will control, some exclusions that are common in many D&O policies may be relevant to securities and derivative lawsuits arising from a cyber incident. It should also be noted that since such claims are relatively new, there does not appear to be any insurance coverage litigation in which courts considered issues of coverage for D&O claims arising from cyber-incidents.
However, given that this claim trend is still developing, D&O insurers may consider adding a specific exclusion for claims arising out of data breaches or other cyber incidents if it wants to be protected from such claims.
An exclusion that is common to many D&O policies, which may apply to a claim arising from a cyber incident, excludes coverage for lawsuits alleging bodily injury, property damage, and a number of torts, including publication of material which violates a person’s right of privacy. Given that a data breach may result in the release of private information online, such breach may constitute an excluded publication of material that violates a person’s right of privacy.
Here, the wording of the D&O policy’s exclusion, particularly the specific “lead-in” language, will control. Some D&O policies will contain broad “lead-in” language providing that coverage will be excluded for a claim “based upon, arising out of, or attributable to” invasion of privacy. Other policies, conversely, have narrower lead-in language, which excludes coverage only for claims “for” or “alleging” invasion of privacy.
The wording of this lead-in language is significant because the derivative lawsuit is unlikely to contain a direct allegation of invasion of privacy; however the broad “based upon, arising out of or attributable to” lead-in may allow the privacy invasion that caused the loss to trigger the exclusion absent such a direct allegation.
Other exclusion options for D&O insurers to note
Other exclusions that may be implicated are the “war” or “terrorism” exclusions, which typically excludes losses arising out of acts of war or terrorism. These types of exclusions may be implicated where the cyber incident is attributed to a hostile government.
For example, previous cyberattacks have been attributed to the Russian military, including the NotPetya malware attack in 2017. Currently, Mondelez International, a company impacted by the attack, was denied coverage for its losses by Zurich, which had issued a property insurance policy to Mondelez. Zurich’s denial relied upon a war exclusion in the policy, and Mondelez subsequently commenced coverage litigation against Zurich. The result of the Mondelez will be instructive in the use of such exclusions.
Lastly, the “professional services” exclusion may be implicated in cases where the company is a tech or cyber-security firm. A “professional services” exclusion will typically exclude coverage for claims that would instead be covered by a professional liability or E&O policy, alleging that the company committed a wrongful act in the rendering of or failure to render “professional services.” Where the company itself is a cyber-security firm, allegations that the company failed to implement adequate safeguards could implicate the professional services exclusion.
Advice to D&O insurers
As cybersecurity incidents and data breaches become increasingly common, D&O insurers need to be aware of the recent trend of securities and shareholder derivative lawsuits brought against public companies and their directors and officers for failing to implement adequate protections against cyber-related risks, and/or to engage in a sufficient oversight of such protections. While some exclusions may limit exposure to these claims, D&O insurers who wish to exclude coverage for such claims fully should consider including cyber-specific exclusions in their policies.
