Fishbowl Solutions, Inc. v. Hanover Insurance Company, The

Background

Fishbowl Solutions, Inc. sued The Hanover Insurance Company over Hanover’s denial of an insurance claim. Fishbowl alleged that, in November 2019, an unknown person gained access to its senior staff accountant’s email account, created rules that redirected or hid certain messages, and impersonated the accountant and an insurer in communications about invoice payments. Two payments totaling $176,962 were sent to the fraudster. After recovery of $29,035.79, Fishbowl alleged that its remaining loss was $147,926.21.

Hanover had issued Fishbowl a Technology Professional Liability Policy covering certain losses of business income and extra expenses directly resulting from a data breach that impaired or denied business operations. Hanover denied Fishbowl’s claim. Fishbowl’s original lawsuit asserted breach of contract and sought declaratory and monetary relief.

Motion to Amend and Objection

Fishbowl moved to amend its complaint to add a bad-faith claim under Minnesota Statutes section 604.18. That statute requires an insured to plausibly allege two things: first, that the insurer lacked a reasonable basis for denying benefits; and second, that the insurer knew, or recklessly disregarded, that it lacked such a basis.

Magistrate Judge Becky R. Thorson denied the motion to amend as futile. She found that Fishbowl plausibly alleged the first requirement based on its allegation that Hanover’s claims director testified that Fishbowl had suffered a data breach and an actual loss of business income under the policy. But she found that Fishbowl did not plausibly allege the second requirement because it was an unresolved legal question whether the policy covered a “man in the middle” cyberattack. Fishbowl objected to that order, arguing that its allegations were sufficient and that the magistrate judge improperly relied on information outside the pleadings.

Court’s Analysis

Judge Nelson reviewed the magistrate judge’s decision independently because the denial of amendment was based on futility. An amendment is futile when the proposed claim would not survive a motion to dismiss for failure to state a claim. At this stage, the court generally accepts the complaint’s factual allegations as true, but it does not accept unsupported legal conclusions as facts.

The court agreed that Fishbowl plausibly alleged the first requirement of a bad-faith claim. Accepting the alleged testimony as true, a reasonable insurer would not have denied benefits if the loss involved a covered data breach and covered business-income loss.

The court rejected Fishbowl’s argument that alleged investigative failures—such as not seeking more documents, police reports, third-party information, recorded statements, or an expert examination—were enough to establish the second requirement. Even if Hanover’s investigation had shortcomings, a bad-faith claim could not be added while coverage remained fairly debatable.

The court explained that Fishbowl had not cited authority establishing that a “man in the middle” attack met the policy’s definition of a data breach, and Fishbowl acknowledged that the issue was legally unresolved. An insurer may dispute coverage when the policy question is fairly debatable. The insurer’s interpretation need not ultimately be correct to be reasonable; it must instead lack a reasonable basis before it can support a bad-faith claim.

Disposition

The court found that it was fairly debatable whether the policy covered Fishbowl’s loss. It therefore concluded that the proposed bad-faith amendment was futile, overruled Fishbowl’s objection, and affirmed Magistrate Judge Thorson’s April 6, 2022 order. The opinion addressed whether Fishbowl could add the bad-faith claim; it did not decide whether the insurance policy ultimately covered the underlying loss.