Target Corporation v. ACE American Insurance Company

Background

In December 2013, Target Corporation discovered that an unauthorized individual had breached its computer networks and stolen customers’ payment-card data and personal contact information. Banks that had issued the compromised credit and debit cards canceled and reissued them and incurred related costs. The banks sued Target for those costs, and Target resolved those claims through confidential settlements.

Target sought coverage for some or all of its settlement liability from ACE American Insurance Company and ACE Property & Casualty Insurance Co. (collectively, ACE). ACE had issued two commercial general liability policies to Target. The policies covered Target’s “ultimate net loss” because of “bodily injury” or “property damage.” The policies defined property damage to include the loss of use of tangible property that was not physically injured. ACE denied coverage.

Target filed this breach-of-contract action seeking a declaration that its liability for the payment-card claims was covered and seeking judgment for the settlement payments. The parties agreed that the material facts were undisputed and filed cross-motions for summary judgment, a procedure allowing a court to decide a claim without a trial when no material fact requires a trial and one party is entitled to judgment as a matter of law.

Legal Standards

Minnesota law applied. Under that law, an unambiguous insurance policy is given its usual meaning, while an ambiguous provision—one reasonably open to more than one interpretation—is construed against the insurer as the drafter. The insured bears the burden of proving that the claimed losses are covered.

The parties agreed that the case concerned ACE’s duty to indemnify, not its broader duty to defend. An insurer has a duty to indemnify when the insured is liable for a third-party claim within the policy’s coverage, but not when the claim falls outside that coverage.

To establish coverage, Target had to show that its losses arose from an “occurrence” and that Target’s legal obligation to pay damages was because of the loss of use of tangible property that was not physically injured.

Analysis

The court did not decide whether the data breach was an “occurrence.” Instead, it assumed without deciding that it was and held that Target failed to satisfy the separate loss-of-use requirement.

The court rejected Target’s reliance on an earlier decision involving an insurer’s duty to defend. Because the duty to defend is broader than the duty to indemnify, coverage for defense purposes did not establish coverage for Target’s settlement liability.

The court also rejected ACE’s argument that loss-of-use damages must always be measured by time. Minnesota law did not expressly impose that limitation, and the court noted that loss-of-use damages can be measured in ways other than time. But the court held that the claimed damages still must have a connection, or nexus, to the value of using the property when it was unimpaired. A but-for connection—meaning that the loss would not have occurred but for the data breach—was not enough.

The record contained no allegation or evidence establishing or approximating the value of using the payment cards to the cardholders or card issuers. Target therefore did not establish a sufficient connection between the settlement amounts for replacing the cards and the value of using those cards. The court concluded that the settlement liability was not loss-of-use damage covered by the policies.

Because Target failed to establish loss-of-use damages, the court did not address the parties’ final issue concerning whether the payment cards were tangible property that was not physically injured.

Disposition

The court denied Plaintiff Target Corporation’s motion for partial summary judgment. It granted Defendants ACE American Insurance Company and ACE Property & Casualty Insurance Co.’s motion for summary judgment and ordered judgment to be entered accordingly.