T-Mobile entitled to cover from Zurich related to 2015 data breach

T-Mobile is still entitled to coverage in connection with a 2015 data breach from the Zurich Insurance Group Ltd. despite receiving a payment from Experian Information Solutions Inc., a Washington state appeals court ruled Monday, in upholding a lower court ruling.

The litigation in the case, T-Mobile USA, Inc. v. Steadfast Insurance Co.; and Zurich American Insurance Co. stems from an Experian data breach that exposed the personal information of about 15 million people who applied for service with T-Mobile.

Under its policy with Zurich American Insurance and its subsidiary Steadfast Co., T-Mobile self-insured the first $10 million of any loss, and Steadfast insured the next $15 million.

After facing multiple individual suits and class-action lawsuits stemming from the incident, T-Mobile incurred $17.3 million in costs and expenses in the matter, the ruling said.

It filed an arbitration demand against Experian, which led to Experian agreeing to pay T-Mobile $10.75 million to settle. 

Steadfast denied coverage to T-Mobile, arguing that because it had recovered $10.75 million from Experian, T-Mobile’s loss fell within its $10 million SIR.

T-Mobile sued Steadfast in March 2019, arguing the policy does not allow Steadfast to set off the Experian recovery against the insurer’s payment obligation. In siding with T-Mobile in the dispute, a three-judge appeals court upheld a lower court ruling.

According to Steadfast, the $10.5 million T-Mobile recovered from Experian “absolved” the insurer because as a result, T-Mobile did not satisfy its $10 million self-insured retention, the ruling said.

“But the Experian recovery did not ‘absolve’ T-Mobile from payment because it did not set free or release T-Mobile from its obligation to pay the costs and expenses it incurred from the data breach,” it said.

“T-Mobile remained directly liable for those obligations and paid them in full. Experian then reimbursed T-Mobile for some of the data breach-related cost and expenses T-Mobile already paid.

“We conclude that the policy does not exclude as a covered loss the $10.75 million T-Mobile recovered from Experian,” it said, in remanding the case for further proceedings.

Attorneys in the case did not respond to requests for comment.