Something to Keep an Eye On: Insurers and Insureds to Duke it Out in Data Breach Coverage Suit

A new Indiana coverage litigation regarding a CGL policy (and umbrella policy) may provide more guidance about how courts will approach data breach coverage under traditional insurance products. In National Fire Insurance Company of Hartford v. Medical Informatics Engineering, Inc. et al. (N.D. Ind., No. 16-cv-152), two CNA companies initiated a declaratory judgment action seeking a ruling they do not have the duty to defend or indemnify Medical Informatics Engineering, Inc. or NoMoreClipboard, LLC (collectively Medical Informatics) in relation to lawsuits filed against Medical Informatics.  The underlying lawsuits allege Medical Informatics, a provider of medical record storage services, failed to protect its databases containing sensitive personal medical information of approximately 3.9 million putative class members.  The insurers allege the underlying lawsuits do not seek “bodily injury,” “property damage,” or “personal and advertising injury,” but even if they did, numerous exclusions bar coverage.  Due to the wide-ranging coverage defenses asserted in the amended complaint, this lawsuit is sure to be followed closely by insurers and policyholder attorneys alike.