A Fortune 500 company (“Company”) experienced what was, at the time, the largest data breach reported. Hackers obtained credentials of a third party vendor of the Company, giving them direct access to all cash registers and servers in the individual retail stores of the Company. Approximately 40,000,000 credit card and debit card numbers were accessed, as well as 70,000,000 names and addresses of customers. The Company filed actions against several insurance companies in the cyber insurance tower and the mediation that I was involved in involved an excess insurer in that tower.
The insurance company defended on the basis that the Company had been advised by departments of the government about the potential breach, at or before the application for insurance was completed and the insurance company claimed that the prior and pending exclusion was applicable.