Conservative 5th Circuit Broadly Construes "Publication" in Policy to Cover Hack

Despite generally analogous insurance policies being available across the country, the location of a lawsuit and the predispositions of particular courts can often be determining factors in coverage lawsuits, particularly where a case comes down to conventions of policy interpretation. The United States Court of Appeals for the Fifth Circuit[1], and therefore all of the courts within the Circuit, tend to be uniquely difficult forums for policyholders to prevail. That makes it all the more notable that in a recent case, the Fifth Circuit found that coverage applied and that an insurer had a duty to defend a lawsuit pertaining to a data hack.

Landry’s, a Texas-based hospitality company, was the victim of a data breach in 2015 that compromised its payment-processing systems. An unauthorized software program had retrieved the credit card information of millions of Landry’s customers, with which fraudulent purchases were then made.

After the payment processing service used by Landry’s was found liable to various credit card companies for losses stemming from the breach, it sued Landry’s for refusing to indemnify. Landry’s was covered by a commercial general liability (“CGL”) policy from ICSOP, which stated that ICSOP “’will pay those sums that [Landry’s] becomes legally obligated to pay as damages because of “personal and advertising injury”’ and ‘will have the right and duty to defend [Landry’s] against any “suit” seeking those damages.’

The court determined that the policy’s publication provision was capacious as its text and structure called for the “broadest possible definition” of “publication.” This resulted in reversing the district courts finding and concluding that the data breach did result from the credit card information. Publication encompass merely exposed or presented information publicly known or generally accessible and triggered coverage for invasion of the customer’s right of privacy.

If you enjoy this content, you can find my full list of blogs here: https://docs.google.com/document/d/1N3YsMmn0Ii1GqHWSBEE1pPzh1jQbU6htkJZ2e55Y2eM/edit?usp=sharing

[1] Laundry’s Inc. v Insurance Co. of the State of Pennsylvania, 19-20430 (5th Cir. Court of Appeals)