Target Corporation v. ACE American Insurance Company

Background

In 2013, a hacker stole payment-card data and personal contact information connected to Target payment cards. The issuing banks canceled the compromised cards and issued replacement cards, then sought compensation from Target for the resulting costs. Target settled those claims.

Target alleged that ACE’s general liability policies required ACE to indemnify Target for the settlement payments. The policies covered losses resulting from “property damage,” including the “loss of use of tangible property that is not physically injured,” when the property damage was caused by an “occurrence.” ACE denied coverage. Target sued for breach of contract and declaratory and compensatory damages.

The court had previously denied Target’s motion for partial summary judgment and granted ACE’s motion for summary judgment. Target then moved to alter or amend that judgment under Federal Rule of Civil Procedure 59(e), which permits a court to correct an error of law or fact or consider newly discovered evidence in limited circumstances.

Coverage Analysis

The parties agreed that Target had to establish three requirements for coverage: (1) the losses resulted from an “occurrence”; (2) the occurrence caused a “loss of use” of property; and (3) the property was tangible and not physically injured.

First, the court held that the data breach and resulting inoperability of the payment cards constituted an “occurrence.” The policies defined an occurrence as an accident, and the parties did not dispute that Target neither expected nor intended the data breach. Applying Minnesota law, the court concluded that an accident includes both the insured’s acts and the consequences of those acts. The cancellation and resulting inoperability of the cards were consequences of the data breach.

Second, the court held that the cards’ inoperability constituted a loss of use. Although the cards still physically existed, they could no longer perform their function after cancellation. The court relied on an earlier decision involving an infected computer that could no longer operate, reasoning that the payment cards were similarly unusable even though they were not physically damaged. The court also found a sufficient causal connection between the loss of use and Target’s settlement of the issuing banks’ claims.

Third, the court held that the payment cards were tangible property that was not physically injured. The policies excluded electronic data from the definition of tangible property, but the court found that Target sought coverage for the loss of use of the physical cards, not for the loss of the electronic data itself.

Duty to Indemnify and Disposition

A duty to indemnify is an insurer’s contractual obligation to pay for an insured’s liability to a third party when that liability falls within the insurance policy’s coverage. Because the court found that the replacement-card costs were covered, it held that ACE was obligated to indemnify Target for Target’s settlements with the issuing banks for those costs.

The court granted Target’s motion to alter or amend the judgment, vacated the February 8, 2021 order and judgment, denied ACE’s motion for summary judgment, and granted Target’s motion for partial summary judgment. The court declared that the issuing banks’ payment-card claims against Target were covered, that ACE was obligated to indemnify Target for related settlement payments incurred within the policies’ aggregate coverage layers, and that the amount of the covered loss would be determined at trial.