The Connecticut Supreme Court on Monday unanimously affirmed a lower court ruling that a Chubb Corp. unit and Scottsdale Insurance Co. were not obligated to defend or indemnify under their general and umbrella liability policies the loss of cyber data on tapes that fell from a truck.

Chicago-based Recall Total Information Management Inc. had contracted with Armonk, New York-based IBM to transport and store computer tapes containing the personal information of current and former IBM employees, according to the ruling in Recall Total Information Management Inc. et al. v. Federal Insurance Co. et al.

Recall subsequently subcontracted with Executive Logistics Inc. to provide transportation services for the tapes.

Federal Insurance, a Warren, N.J.-based unit of Chubb Corp., and Scottsdale, Arizona-based Scottsdale Insurance Co. issued respectively a commercial general liability policy and an umbrella legality policy to Executive Logistics, both of which named Recall as an additional insured.

Executive Logistics lost the computer tapes when they fell from its truck onto the roadside by a highway exit ramp in New York and were retrieved by an unknown individual in February 2007, according to court documents. The 130 computer data tapes, which contained personal information on more than 500,000 current and former IBM employees, were never recovered.

IBM subsequently claimed a total of $6.2 million in damages in connection with the incident, including $2.5 million for notifying current and former employees, $595,000 for maintaining call centers and $3.2 million for credit monitoring services, according to court papers.

There is no evidence, however, that the information was ever misused, according to the Connecticut Supreme Court. Federal and Scottsdale refused to participate in settlement negotiations, or to provide coverage to the plaintiffs under the policies, according to the ruling.

In June 2009, Executive Logistics agreed to pay $6.4 million to Recall, and assigned its rights under the policies, including the right to sue, to Recall, according to court papers. Recall and Executive Logistics then filed suit in state superior court in Hartford, Connecticut, against the insurers, charging breach of contract, according to court papers.

Plaintiffs claimed the insurers were obligated to provide coverage because the loss constituted a “personal injury,” which is defined as violating a person's right of privacy under the policies.

Duty to defend not triggered

The Connecticut Supreme Court said in its ruling there was no purpose in repeating the discussion in the superior court's “well-reasoned” January 2014 ruling.

In that ruling, the superior court, which upheld a trial court ruling, concluded the insurers were not obligated to defend or indemnify the companies. The settlement negotiations did not constitute a “suit” which would have triggered a duty to defend, it said.

Furthermore, the computer tapes' loss did not constitute a personal injury as defined by the policies because there had been no publication of the information stored on the tapes that resulted in a violation of a person's right to privacy, said the appeals court.

Commenting on the ruling, policyholder attorney Joseph F. Bermudez, a Denver-based partner with law firm Wilson, Elser, Moskowitz, Edelman & Dicker L.L.P. who was not involved in the case, said he was not surprised by the ruling.

“It just confirms (general liability) policies were not intended, and do not, cover data breach crisis events,” he said.