Specialty Podcast: From First Notice to MOVEit - Navigating Coverage, Duty to Defend and Cyber Litigation

Intro (00:00):
You are listening to the Alliant Specialty Podcast, dedicated to insurance and risk management solutions and trends shaping the market today.

Mike Radak (00:09):
Hey everybody. Thanks for tuning in to the Alliant Claims and Legal podcast for this month. I'm Mike Radak, a senior claims attorney with Alliant's Claims and Legal team. Joined again by my colleague and our resident cyber expert, David Finz. At Alliant, we spend a lot of time reading through relevant legal decisions that impact the financial lines industry as well as impact our clients. You can read about these decisions including some of what we're talking about today in our monthly Executive Liability Insights newsletter. If you don't already subscribe to that and you would like to, please reach out, we'll get you added to the list. I'm going to talk about two cases and then I think David's going to tell us about some issues impacting the cyber world involving MOVEit. First case I wanted to talk about highlights the critical importance of the first notice of loss when you're making a claim. You need to make sure that that notice is made on behalf of all insureds under the policy because as this case is an example of, it can be very problematic down the road if you don't do that. At Alliant, we spend a lot of time and consideration goes into all of our notices, but this ruling is a warning about novel ways that carriers can and will find to deny claims based on technical issues. In this case, the court partially sided with an insurer in a coverage dispute finding that employees of an insured entity failed to comply with a strict claims made policy reporting requirements for each insured. In this case, it was a fertility clinic that noticed a wrongful termination claim made by a former employee to its insurer. The following year, the former employee filed suit against the clinic and added several individual physicians with that clinic as defendants in that lawsuit as well. The clinic tendered the lawsuit to its insurer identifying only the entity clinic as the insured seeking coverage and failed to mention any of the named individual physicians within that notice. They did include the lawsuit, as I understand it, so the insurer could have looked at the lawsuit and seen that individual physician employees were named, but instead the insurance carrier looked only at the notice as far as which insureds were tendering notice under the policy. During arbitration of the matter, the case eventually settled, and the insurance carrier was not involved in the settlement of the matter and actually refused to agree to terms of the settlement based on the limited time constraints they had to consider the offer.

After the matter settled, the insurance carrier filed coverage litigation seeking a declaration that amongst other things, they had no duty to defend or pay any claim expenses for the physicians due to the failure to properly notice the matter, meaning that the physicians were not specifically included in the written notice of the matter. This went to coverage litigation. The clinic argued that they had provided constructive notice of the claim against the physicians in the notice that they provided with the lawsuit and the physicians were insured persons under the policy. Again, there were some ancillary issues here, but the primary issue was this notice and coverage for the individual physician defendants. The court ruled in favor of the insurer finding that the physicians failed to comply with the policy strict notice provision and therefore were not entitled to coverage. Some important takeaways from this one, from my review of this case, this seems like an outrageous position taken by the carrier and the court. As I mentioned earlier, the carrier had notice of the claim on behalf of the entity and the individual insureds and could have clearly read the complaint to see that there were individual insureds named in this. But the court looked at the black letter of the policy and said that because these individual defendants were not specifically referenced on the notice, there was no coverage for them. This decision gives more ammunition to the insurance carriers to deny claims for insufficient notice. This is something that at Alliant, we put a lot of thought and consideration into our notices before they go out, including language to the effect that the notice is made on behalf of all insureds under the policy, whether individually named or not. This is another example as to why the first notice of a claim is never as simple as just flipping a lawsuit to an insurance carrier with the policy information on it because it can come back to bite you just like this one did. The next case that I wanted to talk about, it's a Delaware lawsuit that contains an interesting ruling on what triggers coverage for a regulatory investigation. In this case, SEC commenced an investigation into an advertising company, and after some discussions with the SEC, the company ultimately entered into a tolling agreement with the SEC. The company promptly provided notice to its D&O carrier of the tolling agreement and sought coverage for defense costs incurred for the time period after the tolling agreement was executed.

The carrier denied coverage, took an aggressive stance that despite the policy's definition of claim, which included a tolling agreement as a proper trigger for coverage, this did not fall within the specific coverage granted under the policy because it was an investigation rather than a claim alleging a wrongful act. The investigation, it's worth noting, did not include any specific allegations of federal or state securities law violations. The insurance carrier said, without any allegations of wrongdoing in the tolling agreement, there's no coverage here, and ultimately the court agreed with them. This case is a really great example of the importance of knowing exactly what's covered under your D&O policy and confirming that if there's an exclusion for investigations, regulatory investigations, or more importantly, if there's a lack of any affirmative coverage for investigations of the entity as opposed to just insured persons, you need to look at adding the coverage to the policy. We're seeing more and more of these large regulatory investigations that can lead to millions and millions of dollars in expenses for the insureds. Having that affirmative investigation coverage in the D&O policy is something we can and do solve for and we've added for most of our clients during policy reviews. Just from experience, I have at least two active claims right now where clients are incurring well over $10 million in investigation expenses from regulatory investigations. Without the investigation coverage that we had put into their policies, they'd probably be left holding the bag uninsured for those expenses. Two important decisions, but with that said, I'll turn it over to David. I know he wanted to talk through the MOVEit litigation that's currently going on.

David Finz (06:39):
Thanks, Mike. Yes, so we've been following the MOVEit litigation for some time now, and we've spoken about this incident on a few past episodes over the last two years. The decision that was made by this federal judge in Massachusetts this past week really, really split the baby. There's no other word for it. Now, please understand, this is a massive federal litigation involving over a hundred defendants right now, mostly corporate entities that utilized the MOVEit file transfer tool and of course progress software, the maker of MOVEit itself. What the judge did here was go through a total of 30 counts in this multi-district litigation complaint, or I should say actually six complaints that had been consolidated based upon the lawsuits that have been filed around the country, and tossed out roughly half, 16 out of the 30, counts from the complaint. The gist of it, if you will, is that the negligence claims remain, and that is really what is being alleged here against progress software as what the courts refer to as a third-party tortfeasor, what duty they may have held towards these downstream individuals, the individual patients, employees, customers that had their data compromised as a result of this incident. Essentially what the judge said was that a defendant could be held liable for negligence when their act or omission creates what she called an unreasonable risk of harm to another by the foreseeable conduct of a third party. Both the software developer and its corporate clients are potentially liable for negligence here, and because of that, the judge did not dismiss those counts in the complaint. Additionally, the judge dismissed an allegation in these complaints that the software developer intentionally invaded the privacy of these individuals or had their data published. The judge held that simply stating that allegation in the complaint does not make it viable and that no evidence had been proffered to that effect. So that particular count does not survive a motion to dismiss. Simply saying that somebody did something on purpose doesn't make it so. But what I really wanted to talk about today was that this multi-district litigation offers a classic example of what I call a mixed bag of covered and non-covered allegations in a complaint. From a claims and coverage standpoint, it's important for our clients to understand how these mixed bag complaints are treated under their policy. You could have a situation where, as is the case here, a plaintiff alleges negligence but also alleges some counts that may not be covered such as intentional invasion of privacy or even invasion of privacy under various state laws that may or may not be covered under the policy due to the exclusions for wrongful collection.

A plaintiff may allege negligence alongside a breach of contract, or in this case here, unjust enrichment, which is a category of loss that's typically excluded from coverage as well. How would an adjuster treat a claim where you have a mixture of covered and non-covered allegations? That is going to depend upon whether your policy is written on what is known as a duty to defend basis or whether you have, subject to the carrier's consent, greater latitude in your choice of counsel. Now, larger clients of ours that tend to have a robust in-house legal department and extensive relationships with outside law firms want to maintain a greater degree of control over the defense of the matter. They want a say so in selecting defense counsel. They don't want that to be assigned by the insurance carrier. That's understandable, and we will advocate on their behalf when they wish to have that latitude. However, that also comes with a drawback, and it's a drawback that clients need to be aware of, which is that when you have greater latitude over the choice of counsel, when you relieve the insurer of their duty to defend, you now have a situation where the insurer is no longer obligated to defend 100% of the complaint regardless of what portion of it is covered under the policy. As a result of that, you could have a situation where the insurer comes in and says, okay, we consent to your choice of counsel, but we couldn't help but notice here that only three out of 10 allegations in the complaint trigger coverage under the policy. So we're only going to cover 30% of the defense clause. Now, obviously as your advocate, we wouldn't necessarily take that lying down. If it turns out that the defense counsel is spending 80 or 90% of their billable hours on the covered allegations, we're certainly going to make the argument for a greater allocation of defense costs to be covered by the carrier. But again, this is a conversation that needs to take place between a business and their risk advisor, their insurance broker, about the relative advantages and disadvantages of a duty to defend policy against a choice of counsel. This isn't just true for cyber, although we see it play out quite a bit in the cyber arena. It's true for any liability policy where there is the option of having a choice of counsel, such as a directors and officers or an employment practices liability policy.

Many of the specialty lines coverages present this dilemma. Again, for smaller insureds, a duty to defend is not only prudent, it's probably the only available option. As your organization grows, you may wish to consider moving to a choice of counsel arrangement, but understand the risks or the disadvantages involved in doing so, and then make an informed decision. This particular case gives an excellent example of where that issue might come into play.

Mike Radak (13:05):
Yes, thanks David. Tons of super interesting and important issues in what you just talked about. I would just add with respect to the choice of counsel versus duty to defend, it's definitely something you want to have that conversation at the time your policy renews versus at the time you have a claim and need to select counsel. But it is an issue that we see all the time, and we are always advocating in the best interest of our clients for, so good stuff. I'll also be interested to see how this MOVEit litigation impacts future cyber related class actions because I'm sure it's going to have some implications down the road. With that said, thanks everybody for tuning in. As always, if you have questions or want additional info on any of the topics that we talked about, please don't hesitate to reach out. Thank you.