Home Depot’s general liability insurers relieved from covering data hack

Home Depot’s general liability insurers are not obligated to cover any portion of a $170 million settlement the retailer reached with financial institutions following a 2014 data breach, the 6th U.S. Circuit Court of Appeals said Monday.

The three-judge appellate panel in Home Depot Inc. v. Steadfast Insurance Co. et al. said an electronic data exclusion in policies issued by the Zurich Insurance Group Ltd. unit and Great American Insurance Group did not cover losses financial institutions incurred in reissuing credit cards to individuals. Similarly, the exclusion barred coverage related to individuals’ reduced usage of their credit cards.

Between April and September 2014, hackers accessed Home Depot’s point-of-sale system and stole credit card information and email addresses of more than 50 million customers. After Home Depot publicized the breach, financial institutions filed lawsuits over the costs of canceling and reissuing payment cards, investigating claims of fraudulent purchases, refunding fraudulent charges, and increasing fraud monitoring on affected accounts, court records show.

Home Depot settled the lawsuits for $170 million and its cyber insurers provided their full $100 million in coverage. The Atlanta-based retailer then sued Steadfast and Great American in federal court in Cincinnati to recover the $50 million it had in general liability coverage.

The trial judge awarded the insurers summary judgment, finding that their policies excluded coverage for electronic data. Home Depot appealed.

Representatives for the parties did not respond to requests for comment.