Insurance Company Refuses to Cover Sony's Data Breach Costs

Zurich Insurance Company (ZIC) and Zurich American Insurance Company (ZAIC) is seeking a court ruling that the insurance policies they issued to Sony do not cover costs resulting from data breaches suffered by the company earlier this year.

The insurance companies note that Sony and its subsidiaries are currently the target of 55 class action lawsuits seeking damages on behalf of consumers affected by the cyber attacks.

The largest data breach suffered by Sony involved its PlayStation Network and resulted in the exposure of personal and financial information of over 77 million customers.

A subsequent instrusion on the Sony Online Entertainment Network, which operates servers for several popular MMORPG games, resulted in the theft of personal and financial information of another 25 million consumers.

A third breach occurred on the website of Sony Pictures Entertainment and resulted in the compromise of personal information belonging to thousands of users.

In addition to the numerous class action lawsuits, Sony and its subsidiaries are also the target of investigations launched by attorney general offices in several states which might result in legal actions against the companies.

"The Sony Defendants have tendered the Class Action Complaints, miscellaneous claims, and various investigative inquiries to ZAIC and ZIC, and have demanded that ZAIC and ZIC defend and indemnify them for the claims asserted," the complaint notes. [pdf]

The insurance companies claim that their policies to Sony only cover bodily injury, property damage, and personal and advertising injury. However the latest coverage only applies to specifically enumerated offenses that don't include cyber attacks.

ZAIC claims that the only Sony subsidiary covered by its policies is Sony Computer Entertainment America (SCEA) which operates the PlayStation Network. However, the claims set forth in the class actions complaints against SCEA do not entitle the company to be indemnified by ZAIC.

"ZAIC has no duty to defend or indemnify SCEA because the Class Action Complaints and miscellaneous claims do not allege injury or damages covered under Coverage A – Bodily Injury or Property Damage Liability or Coverage B – Personal and Advertising Injury Liability of the ZAIC Primary Policy," the insurance companies conclude in their complaint.