A lawsuit filed by Columbia Casualty over a cyber insured’s failure to prevent a data breach by following “minimum required practices” has been dismissed by the US District Court for Central California, sending the parties to an alternative dispute-resolution process.
Cottage Health Systems experienced a data breach in 2013, due to a third-party vendor storing the unecrypted confidential medical records of 32,000 patients on a server accessible to the general Internet. Cottage was hit with a $4.1 million class action lawsuit, which Columbia, a unit of CNA, agreed to defend and indemnify against with a reservation of rights based on the exclusion for any loss due to “continuously” update and implement cyber risk controls.
The case was highlighted as one to watch in the cyber insurance world, being one of the first to test the limits.
ALSO READ : The devil in the cyber insurance details | Applications matter: CNA denies cyber insurance claim; insurer seeks $4 million
Columbia argued that Cottage falsely implied it regularly checked its cybersecurity practices and required all third parties to safeguard information. The insurer then sought a declaratory judgment that it had to no duty to defend or indemnify Cottage based on the policy language and should be entitled to reimbursement.
Cottage, however, moved to dismiss Columbia’s complaint noting that along with the exclusion cited by the insurer the policy contains a mandatory alternative dispute resolution provision, a step Columbia skipped over when filing suit.
The two parties argued briefly, but agreed to pursue dispute resolution before proceeding to a lawsuit. The Court dismissed the complaint without prejudice.
Erin is the managing editor of Advisen’s Front Page News. She has been covering property-casualty insurance since 2000. Previously, Erin served as editor-in-chief of The Standard, New England’s Insurance Weekly. Erin is based in Boston, Mass. Contact Erin at [email protected].
