Hunton Insurance Recovery Blog

When a cyber incident occurs and the insurer pays out the claim, they often face the frustrating reality that pursuing the actual criminals – the threat actors – for indemnification is virtually impossible. Thus, insurers are now turning to subrogation claims against the very cybersecurity vendors entrusted by policyholders to protect their systems. Indeed, insurers are increasingly examining whether outsourced cybersecurity providers may have breached their contractual obligations or failed to deliver adequate protection, leading to the loss. This shift means policyholders may find their cybersecurity vendors facing legal action from their own insurer, creating a new layer of risk in vendor relationships.

The Fifth Circuit recently rebuffed an attempt by Chubb subsidiary Ace American Insurance Co. (“Ace”) to evade liability from its excess insurer, Zurich North America subsidiary American Guarantee & Liability Insurance Co. (“AGLIC”), after Ace unreasonably rejected a settlement offer within its policy limits in violation of its Stowers duty. See Am. Guarantee & Liab. Ins. Co. v. ACE Am. Ins. Co., 19-20779, 2020 WL 7487067 (5th Cir. Dec. 21, 2020). As a result, Ace must now pay approximately $7.27 million in damages to AGLIC to cover its costs to settle the underlying lawsuit plus prejudgment interest and court costs.