Insurance Coverage for Data Breaches: A Pig in a Poke for Retail Establishments?

By Thomas Carey. Chair of our Business Practice Group

P.F. Chang’s China Bistro Inc., which operates over 200 restaurants in the United States, purchased a cyber insurance policy from Federal Insurance Company. Federal marketed the policy as “a flexible insurance solution designed by cyber risk experts to address the full breadth of risks associated with doing business in today’s technology-dependent world” that covers “direct loss, legal liability, and consequential loss resulting from cyber security breaches.”  (Emphasis supplied).

During the underwriting process, Federal classified PF Chang’s as a high-risk client because it conducts more than six million transactions per year with customer credit cards, begetting extensive exposure to customer identity theft.  PF Chang’s paid an annual premium of $134,000 for the policy.

In 2014, while the policy was in effect, PF Chang’s received notification from the United States Secret Service of a potential data breach involving credit and debit card numbers stolen from its restaurants.  The company immediately conducted an investigation and determined that 33 of its restaurants were potentially affected.

PF Chang’s notified its insurer, which ultimately reimbursed more than $1.7 million of costs resulting from the data breach. This reimbursement covered the cost of conducting a forensic investigation and, defending litigation filed by (a) customers who alleged their credit card information was compromised, and (b) a bank that issued credit cards that were allegedly compromised. More...