Courts Weigh in on Insurers’ Liability for an Insured’s Losses Stemming from a Data Breach

When a cybersecurity-related incident occurs, an insured should not automatically assume a standard commercial general liability (CGL) policy issued by an insurer will cover their losses, as CGL policies generally afford coverage to an insured for losses resulting from bodily injury and property damage.

An insured’s cybersecurity losses can encompass much more, such as losses arising from a data breach concerning confidential or personal information of a client or customer, i.e., third parties who fall outside of the scope of an insured’s traditional CGL policy.

Therefore, to ensure cyber coverage exists in the wake of a cyber incident, an insured should make certain that potential cyber-related losses are included within the ‘four corners’ of the underlying insurance policy to secure a defense and, more importantly, coverage from an insurer.

In determining whether there is a duty to defend, a court must follow the ‘Eight Corners’ Rule and look at the ‘four corners’ of the complaint and the ‘four corners’ of the underlying insurance policies.

In other words, an insurer is obligated to defend its insured if the factual allegations of the complaint, on its face, encompass an injury that is actually or potentially within the scope of the policy.