Sony Insurer, Zurich, Files Suit to Deny Data Breach Coverage

One of Sony Corp’s insurers has asked a court to declare that it does not have to pay to defend the media and electronics conglomerate from mounting legal claims related to a massive data breach earlier this year.

The dispute comes as demand soars for “cyber insurance,” with companies seeking to protect themselves against customer claims and associated costs for data and identity theft.

How to write such policies has become a huge subject of debate in the insurance industry.

Zurich American Insurance Co asked a New York state court, in documents filed late Wednesday, to rule it does not have to defend or indemnify Sony against any claims “asserted in the class-action lawsuits, miscellaneous claims, or potential future actions instituted by any state attorney general.”

Zurich American, a unit of Zurich Financial Services, also sued units of Mitsui Sumitomo Insurance, AIG and ACE Ltd, asking the court to clarify their responsibilities under various insurance policies they had written for Sony.

“Zurich doesn’t think there’s coverage, but to the extent there may be a duty to defend it wants to make sure all of the insurers with a potential duty to defend are contributing,” said Richard Bortnick, an attorney at Cozen O’Connor and publisher of the digital law blog CyberInquirer.

Bortnick, who is not involved in the case, said that while Sony may be able to claim there was property damage as a result of the data breach, Zurich is likely to argue that the sort of general liability insurance it wrote for Sony was never intended to cover digital attacks.

Sony could not immediately be reached for comment. AIG declined to comment, and Mitsui Sumitomo could not immediately be reached.

In April, hackers accessed personal data for more than 100 million users of Sony’s online video games. Sony has said it could not rule out that some 12.3 million credit card numbers had been obtained during the hacking.

In May, Sony said it was looking to its insurers to help pay for its massive data breach.

Sony has said it expects the hacking to drag down operating profit by 14 billion yen ($178 million) in the current financial year, including costs for boosting security measures.

55 SUITS TO DATE
Zurich American, in its court papers, said 55 purported class-action complaints have been filed in the United States against Sony. The insurer also said Sony has been subject to investigations by state and federal regulators since the breach.

Zurich American has subsequently received claims for coverage from Sony under its policy, a commercial general liability policy written for Sony Computer Entertainment of America as of April 1.

The insurer said it does not have any obligation to defend any other Sony unit under that primary policy, since it only applies to the specific business in question.

In addition, Zurich American said its policy only covers the Sony unit for “bodily injury, property damage or personal and advertising injury.” It said no such claims have been made in any of the class-action lawsuits.

Even if such claims had been made, Zurich American said, the policy had exclusions in place that would deny Sony coverage for the claims made.

The case is Zurich American Insurance Co and Zurich Insurance Co Ltd vs. Sony Corp of America et. al., Supreme Court of the State of New York, No. 651982/2011.

(Reporting by Ben Berkowitz, additional reporting by Liana Baker in New York; Editing by Ted Kerr)