On August 16, 2023, The Southern District of Ohio issued a decision in The Home Depot Inc. et al. v. Steadfast Insurance Co. et al., holding that The Home Depot was not owed coverage for settlements with financial institutions to replace canceled bank cards compromised in a data breach. The decision was based upon an electronic data exclusion.
In the underlying action, The Home Depot experienced a data breach in 2014 in which hackers stole $56 million of customers’ payment information from credit and debit cards. Banks were forced to cancel customers’ cards and issue new ones. The banks then sued The Home Depot for the cost of replacing the cards. The Home Depot settled claims in a class action for $160 million, plus $12 million in fees.
The Home Depot then sued its insurers, Steadfast and Great American, accusing them of wrongly denying claims for defense and indemnity under their commercial general liability and excess policies.
In their motion for summary judgment, the insurance companies cited the electronic data exclusion which precluded coverage for loss of use that “arise[s] out of the loss of, loss of use of, damage to, corruption of, inability to access or inability to manipulate electronic data.”
The Home Depot argued that the data breach led to a loss of use of tangible property because the banks canceled their cards.
In granting summary judgment in favor of the insurers, although the court found the cards were not physically lost, the court found the cancellation of the cards rendered them useless. The court stated the cancellation qualified as a loss of use of tangible property not physically injured, and thus property damage had occurred.
The court next examined whether the “electronic data exclusion” applied to preclude coverage. The Home Depot conceded that the loss of use of the electronic data stored on the cards was not covered. The Home Depot instead argued that the loss of use of the physical numbers on the card was covered. The court disagreed, finding that the cards were useless once the electronically stored payment information no longer matched the numbers printed on the cards. The court further found that the loss of use of the physical card numbers arose from the loss of use of the electronically stored card numbers, and therefore, the electronic data exclusion was applied to preclude coverage.
As electronic data collection becomes more prevalent, insurers and policyholders alike should take notice of instances where courts apply a broad reach to the electronic data exclusion. For insurers, it appears courts will apply the exclusion in those instances where the loss is related to or arises from the loss of electronically stored data. For policyholders, it may be appropriate to seek out data liability coverage, either through a separate policy or endorsement, to prevent any potential gaps in coverage.
Grace Delott is an associate in Tressler’s Insurance Practice Group in our Chicago office. Grace provides comprehensive coverage analysis and defense in disputes involving a wide range of policies, including commercial general liability coverage, professional liability coverage and reinsurance.
