casenotes
Hacker Coverage
Lambrecht & Assoc., Inc. v. State Farm Lloyds, No. 12-01-00146-CV, 2003 WL 21078083, (Tex. App.-Tyler May 13, 2003, no writ history).
The Texas Court of Appeals in Tyler reversed a summary judgment for State Farm Lloyds last month in a lawsuit in which plaintiff, Lambrecht and Associates, Inc. sought coverage for the loss of computer data, and the related loss of business income, after an alleged hacker attacked the employment agency’s main server.
Lambrecht’s server was having difficulty booting up and ultimately froze-up. The employment agency lost numerous business contacts and information kept in electronic form as well as the software the company used in its day-to-day operations. Lambrecht ultimately replaced the server, purchased a new operating system and software and had its proprietary data manually re-entered. During this time period, Lambrecht’s employees were unable to use their computers to conduct business.
Lambrecht filed a claim with State Farm under its business insurance policy for lost business income and the expense of replacing the server and software and re-entering the data. State Farm denied coverage and Lambrecht filed suit alleging that a hacker has accessed the computer system and injected a computer virus, ultimately causing the server to freeze.
Section 1, Coverage B of the policy states that State Farm will pay for “accidental direct physical loss to business personal property at the premises described.” Further, Section 1, Coverage C states that, pursuant to the loss of income coverage, State Farm would pay for “the actual loss of ‘business income’ you sustained due to the necessary suspension of your ‘operations’ during this ‘period of restoration.’ The suspension must be caused by accidental direct physical loss to property at the described premises…”
State Farm and Lambrecht filed cross motions for summary judgment. State Farm asserted that the loss was neither “physical’ or “accidental.” State Farm further asserted that Lambrecht did not report the loss to police, condition precedent for coverage. The trial court granted summary judgment for State Farm but did not specify on what grounds it did so.
The Court of Appeals rejected State Farm’s argument that the act of the hacker that caused the loss was intentional and that intent should be imputed to its insured. In doing so the court relied on the rule recently addressed in King v. Dallas Fire Ins. Co., 85 S.W.3d 185 (Tex. 2002) that an insured’s injuries caused by the intentional acts of a third party are nevertheless accidental if, from the insured’s viewpoint, the conduct was not such as to cause the insured to reasonably believe it would result in his injury. King, 85 S.W.3d at 189-190; Heyward, 536 S.W.2d at 557. The court noted that State Farm did not allege that Lambrecht participated in conduct that would have caused it to believe the conduct would result in its loss. Therefore, the ”injection of the virus and resulting damage was an unexpected and unusual occurrence and was, from Lambrecht’s viewpoint, accidental.”
The court noted that the policy language clearly covered “electronic media and records” and held that the server fell within the policy’s definition. The policy specifically excluded losses to electronic or magnetic media “caused by an error in programming.” However, since the evidence in the record indicated a virus and not an error in programming caused the losses, coverage applied.
Finally, in response to State Farm’s contention that the policy, under a section entitled “Duties in the Event of a Loss” required Lambrecht to “notify the police if a law may have been broken,” the court found that, although the injection of a computer virus violated a section of the Texas Penal Code, the policy provision did not create a condition precedent because it did not condition payment of a covered loss on contacting the police if a law was broken.
This case, while currently unreported, raises questions regarding insurer exposure for losses caused by computer viruses in Texas. Indeed, when taking into account lost business income, such losses could comprise substantial losses for insureds.
