Judge dismisses insurers’ attempts to revive ransomware claim dispute

A Delaware trial judge Thursday tossed two amended lawsuits brought by a combined seven insurers seeking to recover payments they made to nonprofits hit by a 2020 ransomware attack on data-hosting app service Blackbaud Inc.

New Castle County Superior Court Judge Kathleen M. Miller said in Travelers Casualty and Surety Co. of America v. Blackbaud Inc. and Philadelphia Indemnity Insurance Co. v. Blackbaud Inc. that the insurers did not adequately allege what types of data their policyholders stored in Blackbaud’s software and what state laws the institutions were obligated to comply with after the attack occurred.

The judge said the insurers also failed to sufficiently allege how their policyholders alleged damages resulted from Blackbaud’s breach of their agreements.

The insurers provided policies to at least 104 nonprofit organizations affected by the ransomware attack on Blackbaud and paid claims for damages caused by the incident. The insurers then sued Blackbaud to recover the payments. Travelers paid more than $1.5 million to its policyholders, and Philadelphia paid more than $600,000, court records show.

The insurers sued Blackbaud in December 2022, seeking recovery of the amounts paid to their policyholders. Travelers and Philadelphia Indemnity filed amended complaints after Judge Miller dismissed their lawsuits in March 2024.

Representatives for the parties did not respond to requests for comment.