Insurer Must Defend Cyber Claim

    The federal district court determined that the insurer had a duty to defend a claim arising from a hacking incident suffered by the insured. Advaiya Solutions Inc. v. Hartford Fire Ins. Co., 2024 U.S. Dist. LEXIS 170505, (W.D. Wash. Sept. 20, 2024). 

    Advaiya was a technology consulting and implementation company that delivered a variety of business solutions to its customers. AA Asphalting hired Advaiya to help set up various Microsoft products. Advaiya made a secure portal on Microsoft's Azure cloud platform where AA Asphalting could access all the Microsoft products for a fee. Advaiya purchased the Microsoft products through Ingram Micro, who purchased them from Microsoft. When AA Asphalting used the platform, Microsoft would invoice Ingram who would invoice Advaiya, who would invoice AA Asphalting. 

    Advaiya held a claims-made enterprise liability policy with Hartford. Hartford agreed to cover amounts "that you become legally required to pay as damages" caused by certain wrongful acts, and Hartford had a duty to defend covered claims. A "claim" was "a written demand received by any of you for damages . . ." "Damages" were defined as "a money award, judgment or settlement that you become legally required to pay." The policy excluded from "damages" any kind "of refund, rebate, redemption coupon, offset, return or credit that has been paid to you or by any of you, or that is owed to or by any of you . . ."

    Hackers gained access to AA Asphalting's portal. Because the fees that Microsoft charged Ingram were based on the amount of usage, the hackers use of the portal generated roughy $334,000 in additional fees that Ingram owed Microsoft. Microsoft and Ingram contended Advaiya was at fault for the stolen servcies because Advaiya failed to ensure that AA Asphalting's portal used best security practices such as multi-factor authentication.

    Ingram sent a past due reminder to Advaiya seeking payment of $323,919.66. A second demand for payment was received. Ingram's demand was sent to Hartford. Hartford denied coverage, stating "There is no coverage for the value of the stolen cloud services/resources or Ingram's demand for payment." The letter further explained that the Ingram demand was not a demand for damages as defined in the policy. Instead, it was a demand for fees/charges owed by Advaiya for services. 

    Adviya sued Hartford and moved for partial summary judgment, seeking a determination that Hartford owed a duty to defend against Ingram's demand. Hartford argued Adviya was requesting indemnification coverage because the duty to defend required "the existence of something to assign ta lawyer to defend against." This ignored, however, that a lawyer could be assigned to defend against a final demand or disputed invoice. The policy agreed to defend "all covered claims." Claim was a "written demand received by any of you for damages or injunctive relief." Ingram's demand was a "written demand" for "money awards." This was a claim under the policy. 

    Hartford sought to invoke its exclusion from the definition of damages. Even if the amount Ingram sought to collect from Advaiya was technically for licensing fees or subscription charges, such amounts were only excluded from coverage if such fees were "owed to or by" Advaiya. Advaiya sufficiently demonstrated that Ingram's demand could conceivably constitute damages under the policy and Hartford's duty to defend was triggered.

    Hartford also argued Ingram's demand arose from a debt, not a wrongful act by Advaiya, and the duty to defend arose only from claims caused by wrongful acts. The record contained multiple pieces of extrinsic evidence raising a question of whether Adviya was at fault for the cyber-attack, rendering coverage under the policy conceivable for purposes of the duty to defend. For example, the incident report prepared after the hack included remediation recommendations for Advaiya to take to avoid such hacks in the future.

    Under Washington's duty to defend standard, Hartford had a duty to defend Advaiya in the claim asserted by Ingram. The court granted Advaiya's motion for partial summary judgment.