Recently, in Target Corporation v. ACE American Ins. Co. et al., Case No. 19-cv-2916 (Min. Dist. Mar. 22, 2022), a Minnesota District Court reversed its prior ruling in favor of an insurance carrier to find that Target’s settlement of payment card claims following a data breach constituted covered “property damage” under certain commercial general liability policies issued by ACE Insurance Company.
In 2013, Target discovered that a hacker stole payment card data and personal contact information of individuals with Target payment cards (the “Data Breach”). Because the Data Breach compromised payment cards, the banks that issued the cards cancelled the cards and issued replacement payment cards, incurring costs for which the banks sought compensation from Target. Target settled the banks’ claims and sought insurance coverage for its settlements under general liability policies issued by ACE.
The District Court initially found that Target’s claim was not covered by the policies at issue because Target could not demonstrate that its claim was related to the loss of use of tangible property that was not physically injured. Target filed a motion to alter or amend the judgment, which the District Court recently granted, vacating its prior order and granting Target’s motion for partial summary judgment.
The District Court’s recent ruling reasoned that under the terms of the policies, Target must satisfy three requirements to establish coverage for the cost of replacing the payment cards: (1) the losses must have been the result of an “occurrence”; (2) the “occurrence” must have resulted in the “loss of use” of the property; and (3) the property lacking use must have been “tangible property that is not physically injured.” The court examined each requirement in turn.
As respects an “occurrence,” while the policies did not define the term accident, the court concluded that the cancellation of the cards, rendering them inoperable, was neither expected nor intended from the standpoint of Target, and therefore, was the consequence of an accident (i.e., the Data Breach). As such, the court concluded that the Data Breach was an “occurrence” under the policies.
Second, the District Court considered whether the settlement included damages because of “property damage” as defined by the policies. The policies defined the term “property damage,” in relevant part, as “loss of use of tangible property that is not physically injured.” The parties disputed what constitutes “loss of use,” a term that was not defined in the policies and which had not been squarely addressed in applicable case law. The court, however, reasoned that cancellation of the compromised cards rendered them inoperable, and thus, the cards lost their use and could no longer serve their function. Accordingly, the District Court found that the expense Target incurred to settle the banks’ claims for the costs of replacing the compromised payment cards was a cost incurred due to the “loss of use” of the payment cards.
Finally, turning to the third requirement, the court addressed whether the loss of use was of “tangible property.” The policies expressly excluded electronic data from the definition of tangible property. ACE argued that Target was actually seeking compensation for the missing data, not for the payment cards. However, the District Court noted that there was no dispute that the payment cards—the damaged property for which Target sought coverage—were “tangible property that is not physically injured.” According to the District Court, it was the use of the payment cards, not the use of electronic data, that was lost. Thus, because the payment cards were tangible property and the payment cards were not physically injured, the District Court found that Target met the third requirement to establish a basis for its coverage claim.
The District Court concluded that the cost of replacing the payment cards is covered under the terms of the ACE policies. ACE, therefore, was obligated to indemnify Target for Target’s settlement with the issuing banks for the costs of replacing the payment cards. The District Court’s prior order in favor of ACE was vacated, and summary judgment was instead granted in favor of Target.