This blog was originally posted to the BT Policyholder Protection Blog
Two years later, and the Target data breach continues to make headlines.
Does anyone need to be reminded that Target suffered a data breach in 2013? Seeing that the breach continues to be litigated and settlements continue to be announced with payment card brands, it is difficult to forget the incident.
Most recently, Target announced that it had reached a settlement with Visa. According to reports, Target could “pay as much as $67 million to banks that issue Visa cards.” Target’s earlier $19 million settlement with MasterCard ended up being scuttled; Target and MasterCard reportedly are working on another resolution.
What is Target settling?
Target’s settlement with Visa likely is to resolve the alleged damages resulting from Target’s payment card breach. The payment card brands allegedly act on behalf of the issuing banks, seeking recovery of damages for the issuing banks’ alleged losses resulting from a retailer’s data breach. The payment card brands seek damages from the retailers, asserting that the retailers are responsible for the fraudulent charges that were incurred and the amounts spent to replace payment cards.
What insurance policies should cover these settlements?
We previously discussed whether Target’s cyberinsurance would cover the earlier proposed $19 million settlement with MasterCard. And we concluded with a bold, “Probably.” We reached that conclusion after reviewing writings by insurance underwriters, who would have policyholders boxed in to a certain kind of coverage in a cyberinsurance policy to cover the losses, as well as Target’s filing explaining that it has $50 million in sublimited coverage in its network security insurance policies (i.e., cyberinsurance) for this exact type of loss.
What about other coverage? Would commercial general liability (CGL) insurance policies cover? We previously have asserted that CGL policies should provide coverage for retailers that have suffered a data breach. The previous post discussed putative class action claims against retailers post-data breach. CGL policies, in our view, also should provide coverage for demands by the payment card brands after a credit card data breach. As discussed previously, CGL policies should be read to provide coverage for damages because of both property damage and personal and advertising injury for losses resulting from a data breach.
We believe that the financial liabilities to the payment card brands, payment card processors, or acquiring banks also could be viewed as covered under a CGL policy.
A typical CGL insurance policy states that the insurance company will pay those sums that the insured becomes legally obligated to pay as damages because of property damage or personal and advertising injury. Are the assessments from payment card brands “damages”? For purposes of an insurance analysis, we believe that the amounts paid to the card brands, processor, or acquiring bank could be viewed as resolving financial liabilities, and the resolution of those liabilities could be viewed as damages.
It should be seen as a basic insurance coverage principle that a settlement of a financial liability meets the definition of “damages.”
Money taken by the payment card processor or acquiring bank should be seen as a resolution of financial liabilities. And, in the words of MasterCard and Visa documents, the amounts paid to resolve the financial liabilities may be viewed as “settlements.” In the MasterCard Account Data Compromise User Guide, (June 26, 2014), it states that the final step in a credit card data breach privacy incident is the: “financial settlement of losses encountered as a result of an ADC [Account Data Compromise] Event, including operational reimbursement, fraud recovery, and ADC Event case management.”
A version of Visa’s Global Compromised Account Recovery Guide (GCAR) that may be found on the web defines Visa’s imposition of financial liability as an acquiring bank “Settlement.”
In sum, if the insured were legally obligated to pay “damages” (settlement of financial liability) because of property damage (loss of use of credit cards) or personal and advertising injury (publication of private information), the requirements a CGL policy’s insuring agreement should be viewed as being satisfied.
Takeaways
The Target payment card data breach continues to provide food for thought when it comes to insurance coverage and risk transfer. New information that develops about Target’s liabilities, and resolution of them, provides a good time to evaluate how insurance would cover the losses. Policyholders should consider using announcements like this as an opportunity to evaluate their insurance program and consider how the policies would apply.
Advisen generates, integrates, analyses and communicates unbiased, real-time insights for the global community of commercial insurance professionals. As a single source solution, Advisen helps the industry to more productively drive critical business decisions about pricing, loss experience, underwriting, marketing, transacting or purchasing commercial insurance. Visit www.advisenltd.com to learn more.
