D&O and Cyber Insurance: Loss Causation, Related Claims and Policy Wording

Welcome (00:00):

Welcome to the Alliant Specialty Podcast, your source for insights on emerging risks, market trends, and specialty insurance solutions.

Peter Kelly (00:09):

Hi, everybody. It's Peter Kelly. Thanks for joining us for today's episode of Alliant Specialty's Claims and Legal Podcast, where we highlight important legal developments in the financial alliance insurance world. I'm joined by our resident cyber expert attorney, David Finz. I'm going to go through a couple cases that we will be reporting on in Alliant Executive Liability Insights monthly newsletter concerning securities class action loss causation and related claims. And then, I will turn it over to David who will be updating us on what is happening in the world of cyber. So the first case that I will be sharing concerns securities class action loss causation. At first glance, this may seem like a technical securities law decision, but the issue at the center of the case, loss causation, has direct implications for the likelihood value and insurability of securities claims. Here, a biotechnology company made statements concerning the methodology that it intended to use in a clinical trial and seemed to imply that the FDA had approved that methodology.

Peter Kelly (01:10):

Several days later, the company disclosed that it would not use the methodology. The investors characterized that announcement as corrective disclosures, which is the point at which the market supposedly learned the truth. But on the day of the corrective disclosure, the company's stock actually increased. It then declined over the next two trading days. The investors brought a securities class action alleging that the earlier misrepresentation caused her investment loss. Ultimately, the court held the investor had not plausibly alleged lost causation. In other words, the complaint did not adequately connect the alleged misrepresentation to the claimed economic loss. Interestingly, the court rejected any bright line rule that a stock must decline immediately after corrective disclosure in order to show lost causation. Rather a delayed reaction can support loss causation, but when the loss is delayed, the plaintiff must provide a plausible explanation for that delay. Here, the complaint did not explain why the stock price rose on the disclosure date, why the meaningful decline occurred later, or why the decline was caused by company specific disclosure rather than general market conditions.

Peter Kelly (02:16):

Loss causation is different from merely showing that a company made a potentially misleading statement and that investors later lost money. Plaintiff must show a plausible causal connection between the alleged fraud and the loss. It reminds us that securities loss is not established merely because a company's stock declined after an allegedly misleading statement. The claimant must plausibly connect the alleged misconduct to the loss, and that connection becomes more demanding when the stock initially rises, the decline is delayed, or the market is moving in the same direction. The next case concerns related claims. However, the insured took an unusual approach or position to challenging the application of the related claims provision here. An employee first filed an administrative complaint alleging sex and pregnancy-based discrimination and retaliation with the New Hampshire Commissioner of Human Rights and the US Equal Employment Opportunity Commission, the EEOC, prior to the inception of the policy that's at issue here.

Peter Kelly (03:09):

The employee was notified of this administrative complaint, which was subsequently dismissed by the New Hampshire Commission. However, the EEOC authorized the employee to sue. The employer never notified its carrier about the administrative complaint. The employee then subsequently sued during the policy period at issue based on the same alleged workplace conduct. After winning a default judgment against its employer, the employee sued the employer's D&O carrier to cover the judgment under the policy's employment practices liability endorsement. The carrier denied coverage based on the policy's related claims provision because the employer had notice of the administrative complaint prior to the policy period and the later lawsuit was related to that complaint. There was no coverage. Based on this back pattern, you would expect the employee to argue that the claims were not related for purposes of coverage and look to ways to differentiate these claims. However, the employee did not dispute that the administrative complaint was an employment claim or that it was first made before the policy period or that the later lawsuit was related to it.

Peter Kelly (04:10):

The position the employee took was that the related claims provision itself could not be applied to EPL matters. The original policy was a D&O policy, which the employer later purchased EPO coverage as an endorsement to that policy. The employee argued that the EPL endorsement was purchased after the initial policy was issued and therefore superseded the policy's liability coverage terms and conditions, which contains the related claims provision. The court disagreed, not surprisingly, and held that these provisions must be read together. The EPL endorsement determined whether there was an employment claim while the related claims provision determined when related claims were deemed made. It was a creative approach, especially if the underlying facts of the related claims were not favorable for coverage, but ultimately did not work out here in the employee's favor. Now I'm turning it over to my colleague, Mr. David Finz.

David Finz (05:03):

Thanks, Peter. So today I'll be speaking once again about the interplay between cyber and D&O insurance. This is not the first time I've discussed this topic, but it's back in the news. As recently reported by the Wall Street Journal, Boston Scientific announced that it expects to miss its third quarter and full year of 2026 financial guidance because of a major cyber attack it suffered in August that severely disrupted its ability to manufacture, process, and ship its medical devices. According to an SEC filing by the company on September 8th, the temporary network outage caused a material impact on operations. Now, despite making strong progress in restoring its distribution network and ramping up manufacturing, the company stated it is now unlikely to hit its previously projected targets. The specific reasons why the cyber attack is causing Boston Scientific to miss its financial goals include disrupted supply chain and operations.

David Finz (06:12):

Reuters noted that the cyber attack, which was first detected on August 25th, took down critical internal network infrastructure, and this immediately hamstrung the company's ability to manufacture medical equipment and paralyzed its fulfillment centers. This left them temporarily unable to process or ship customer orders. Another reason is the fact that they have such a focus on single use consumable sales, which are unrecoverable in terms of bouncing back from this incident. According to financial analysts from JP Morgan, Boston Scientific now faces an unique structural disadvantage compared to its competitors. A massive portion of its portfolio is heavily weighted towards single use medical consumables rather than big ticket capital hardware. So when an outage occurs, the hospital procedures that will go unserved during that window result in lost sales that cannot be recovered as doctors often swap to a competitor's available stock rather than delaying the procedure indefinitely on account of the supply chain interruption.

David Finz (07:25):

And finally, Boston Scientific has limited runway to recover from this incident. The Wall Street Journal notes that the attack, which occurred late in the third quarter, left the company with only about four months remaining in the calendar year. And this tight deadline gives Boston Scientific very little runway to ramp up production, clear its remaining backlogs, and make up the multimillion dollar revenue deficit before the 2026 fiscal year closes, such as the life of a publicly traded company that must answer to its shareholders on a quarterly and annual basis. And so all of this has affected their Q3 net sales growth, their full year sales growth, and their adjusted earnings per share. So we talk about how D&O is designed to pick up claims of investor loss that are not covered under a traditional cyber policy because when we look at a claim, the first thing we need to ask is who is the claimant?

David Finz (08:20):

And if the claimant is an aggrieved consumer who is saying that their data has been breached and now their identity and their credit is put in jeopardy, well, that's one type of claim. But a company has either mishandled its response to an incident or was not adequately prepared for the incident and was especially vulnerable and that resulted in a drop in their share price? Well, that type of claim is covered under D&O because that's securities litigation. These two types of policies should work in tandem. The problem is that sometimes you have overly broad exclusions on the D&O policy that say claims involving technology or cyber failures or security compromises, data privacy, those types of matters, that if a claim is based upon arising out of or in any way attributable to those types of incidents, then the claim will be excluded. Now, this is not a claim for the incident, it is a claim arising out of the incident, and that is a problem because then there could be a gap in coverage.

David Finz (09:21):

Cyber is not going to pick up a claim of investor loss. The D&O ideally should, but you need to check that exclusion wording to make sure that its not so broad that a creative adjuster could not assert that the claim is excluded. So as I'm sure you will agree with me, Peter, policy wording matters. And with that, I'll turn it back over to you.

Peter Kelly (09:42):

Thank you, David. Yes, policy wording always matters. Exclusions can certainly be finicky. Thanks to our listeners for tuning in today. If you'd like more information on some of these recent developments, please reach out and subscribe to our Executive Liability Insights monthly newsletter, and be sure to check out alliant.com to learn about a more rewarding way to manage risk. Until next time, thank you.