The hits just keep coming for Sony. In addition to defending 58+ class action lawsuits in the U.S. and Canada, and responding to numerous governmental inquiries into the hacking of its PlayStaion Network and Sony Online Entertainment earlier this year, Zurich has filed suit against Sony seeking a declaration that various Zurich policies do not provide coverage for the hacking claims.
According to the complaint, which was filed in New York state court on July 20, 2011, Zurich issued three policies to the affected Sony companies. Specifically, Zurich American Insurance Company issued a primary CGL policy to Sony Online Computer Entertainment America LLC (“SCEA”). It also issued an excess liability policy to Sony Corporation of America. The excess policy attaches above a lead umbrella policy issued by National Union. Finally, Zurich Insurance Company issued a primary CGL policy to SCEA for its Canadian operations.
Sony is seeking a defense to coverage under the Zurich policies for the class action lawsuits that have been filed against it, as well as miscellaneous claims and potential actions by state attorney generals. The class actions generally allege that Sony’s customers suffered damages as a result of the unauthorized access to and alleged theft of their personal identification and financial information. The complaints also allege that the customers were further damaged by Sony’s delay in notifying them of the attacks. Although the complaints vary, for the most part, they set forth common law claims, as well as alleged statutory violations.
All of the Zurich policies provide coverage for “bodily injury,” “property damage” and “personal and advertising injury” arising out of an “occurrence.” Zurich argues that the Sony claims do not allege any such injury or damage and therefore Zurich does not owe a defense or indemnification to the Sony entities under any of its policies.
The Zurich complaint also names as defendants other Sony insurers — National Union, Mitsui Sumitomo, ACE American and other unidentified insurers. The single count against the defendant insurers is an alternative count. In the event the court determines that the Zurich policies provide coverage, Zurich is seeking a declaration of the allocation and/or apportionment of defense and indemnity obligations of the Sony insurers.
The Zurich suit is a classic example of the pitfall that awaits companies that have not yet purchased cyber insurance policies. Traditional commercial insurance policies were not drafted with cyber breaches in mind and as result, cyber claims often fall through the cracks in the coverage provided by such policies. Cyber policies, however, fill the coverage gaps by specifically providing insurance for these types of claims. With cyber crime on the rise and the costs of such attacks escalating at a significant rate, cyber insurance is becoming a critical and necessary product for companies.