Rory Eric Jurman and Steven S. Cula

Fowler White Burnett

The Fowler White Burnett attorneys found some beneficial limits for their client on insurance coverage after a data breach.

Fort Lauderdale shareholder Rory Eric Jurman and associate Steven S. Cula represented Travelers unit St. Paul Fire and Marine Insurance Co. in a $2.4 million federal coverage dispute and prevailed on summary judgment.

U.S. District Judge Carlos Mendoza ruled St. Paul had no duty to defend Orlando-based Rosen Hotels & Resorts Inc.'s information technology subsidiary Rosen Millennium against allegations that the company was to blame for a data breach that exposed hotel customers' credit card data.

The company began receiving reports from former guests of unauthorized charges in early 2016. A forensic investigator tracked the breach to external malware installed on the hotel chain's payment network.

St. Paul owed no duty to defend the IT group under the personal injury provisions of its commercial general liability policies, the court found in September, rejecting Rosen Millennium's theories of coverage. Rosen filed a notice of appeal in October.

The court noted St. Paul never conceded coverage and didn't waive its right to deny coverage in a June 16, 2017, coverage letter.

Rosen Millennium sought coverage under the Rosen Hotels policy for property damage tied to the credit cards and the cost of complying with breach notification laws. Rosen was fined by Visa, MasterCard and American Express for the security breach, and other costs piled up.

The decision came down to an interpretation of the personal injury policy provisions and whether they covered claims for a data breach by third-party hackers.

A 2017 Middle District of Florida case asking a similar coverage question faulted hackers rather than the policyholder for a data breach under a policy that focused on coverage triggered by the publication of private information. Since the policyholder did not qualify as the publisher, there was no coverage.