Lack Of Cyber Caselaw Worked Against Insurer In $75M Data Breach Lawsuit

The lack of cyber case law worked against an insurer in the Ontario Superior Court of Justice recently, with the court deciding that The Co-operators has a duty to defend two parties named in a $75-million cyber breach class action lawsuit.

The Co-operators had denied a duty to defend on the basis of data exclusions written into two of its commercial insurance policies. But the absence of case law around the “broadly-worded” data exclusions meant the court did not feel comfortable deciding the issue in a “duty to defend” action.

“I agree that until the courts have had an opportunity to adjudicate the complex issues raised by these broadly worded data exclusion clauses, it would be improper for this court, having regard to present jurisprudence to uphold Co-operators’ denial of a duty to defend,” Ontario Superior Court Justice Andra Pollak wrote for the court in Laridae v. Co-operators, released in May.

Laridae is a communications consulting firm that advised Family and Children Services of Lanark, Leeds and Grenville (FCS) about issues relating to the design and security of the FCS’s website.

In 2016, an unauthorized party accessed documents from a secured section of FCS’s website in which documents for authorized users and accessible only with passwords were uploaded.