Judy Greenwald

Source: Business Source

10/1/2018 1:07:00 PM

A Travelers Cos. Inc. unit has successfully obtained a declaratory judgment it has no duty to defend a Florida hotel group under its commercial general liability coverage in connection with $2.4 million in fines and other costs it incurred stemming from a data breach.

Hartford, Connecticut-based St. Paul Fire & Marine Insurance Co. had filed suit against Orlando, Florida-based Rosen Millennium Inc. and Rosen Hotels & Resorts Inc. in connection with the data breach in March 2017.

Rosen began to receive reports indicating patterns of unauthorized charges to customer cards shortly after customers were guests at Rosen’s various hotels on or about Feb. 3, 2016, according to the lawsuit filed by Travelers.

Rosen allegedly incurred about $2.4 million in economic losses, which reflects credit card fines and attorneys fees. Millennium, which provided data security services for Rosen Hotels, had been issued two consecutive commercial general liability insurance policies that required the insurer to defend it against bodily injury or property damage claims, according to Friday’s ruling in St. Paul Fire & Marine Insurance Co. v. Rosen Millennium Inc. 

The issue of whether Travelers must provide coverage “is not ripe” because Millenium’s demand letter “makes no mention of, let alone a claim for, property damage or the costs incurred from complying with notifications statutes,” said the ruling.

On the issue of whether Travelers has a duty to defend, the ruling said the company’s personal injury claim is not covered under the CGL policies.

“Defendants point to several cases involving data breaches where courts have found a duty to defend. However, none of those involve data breaches perpetrated by third parties,” said the ruling, in holding Travelers did not have a duty to defend in the case and granting its motion for summary judgment.