Hunton Insurance Recovery Blog

Following an investigation involving public companies potentially impacted by the 2020 SolarWinds software compromise, the US Securities and Exchange Commission recently charged several companies with making materially misleading disclosures regarding cybersecurity risks and intrusions. The SEC’s enforcement is the latest example of “cyber as a D&O risk,” underscoring the importance of maintaining robust directors and officers (D&O) liability coverage, along with cyber insurance, as part of a comprehensive liability insurance program designed to respond to cyber incidents.

With increasing frequency, companies are coming under fire for changes in customer loyalty programs, many of which occur without warning or recourse. Whether it is a persistent devaluation of miles or points, arbitrary expiration dates or some other perceived loss of value, customers and regulators are becoming increasingly discontent with programs that are touted as an added value to repeat customers.

In a recent client alert, Hunton Andrews Kurth LLP real estate attorney Laurie Grasso and insurance attorneys Geoffrey B. Fehling, Cary D. Steklof, and Evan J. Warshauer discuss the important lesson real estate companies and their officers and directors can take away from the Illinois federal district court’s decision in Old Guard Insurance Company v. Riverway Property Management, LLC et al., No. 1:23-cv-01098 (C.D. Ill. Sep. 6, 2024). The court found a commercial general liability insurer had no duty to defend or indemnify a property management company or its owner in lawsuits that included allegations of intentional conduct, holding that the allegations did not fall within the policies’ definition of occurrence, which required “an accident.”

In a recent client alert, Hunton insurance lawyers Lorelie S. Masters, Geoffrey B. Fehling, and Charlotte E. Leszinske discuss emerging ESG-related risks and insurers’ interests in those risks when underwriting insurance policies.  Increased focus on ESG by regulators and the public have brought ESG programs and ESG-related liabilities, such as “greenwashing,” to the forefront.  Insurers are also paying attention to these risks and have signaled that their clients’ efforts to address ESG may factor into underwriting of their insurance policies.  Many emerging ESG risks may be covered under existing corporate insurance programs, including directors and officers insurance.  Before incurring a claim, companies should proactively evaluate their insurance program and assess ESG-related risks, expecting that they may need to explain such assessments to their insurers.  Read the full alert here.  

Recent high-profile cases involving Chief Information Security Officers (CISOs) have spotlighted the need for robust directors and officers (D&O) liability insurance tailored to cybersecurity executives. The SEC charges against the former SolarWinds CISO—which were not dismissed in the highly-anticipated decision truncating the SEC’s case against the company—and the 2022 criminal conviction of Uber’s former CISO underscore the growing personal liability risks faced by security leaders.

A recent New Jersey Superior Court decision highlights the risks policyholders face when officers or directors serve dual-capacity roles, such as participating on boards for multiple companies.

Directors and Officers (“D&O”) and cyber-related incidents continued to make headlines while ramped up regulatory enforcement and new legislation significantly altered the insurance landscape for both policyholders and insurers. Other noteworthy decisions reinforced the importance of foundational insurance coverage principals. Now that 2023 has wrapped, we highlight and review some of the most significant decisions and insurance developments that will continue to impact the world of insurance in 2024 and beyond.

Read More

As previewed in part 1 of our AI Policyholder’s Guide, we now discuss how businesses can assess their AI risk to ensure that they are properly positioned to secure insurance coverage should those risks come to fruition. Because no two businesses will have the same AI risk profile, businesses should consider undertaking organization-wide AI risk audits to evaluate their unique AI risk profile.

Understanding the nature of AI-focused legal risk is not only important for business planning, but essential to crafting a comprehensive AI-specific risk management plan. Indeed, because insurance is often underwritten relative to specific risks, knowing the risks to be insured is a prerequisite to procuring the right type of coverage with terms most suitable to a given risk profile.

Last week, the Delaware Insurance Commissioner announced a series of process and regulatory improvements to the state’s captive regime. Building upon last year's significant amendments to DGCL 145(g) expressly permitting captives to cover D&O liability, Bulletin No. 14 outlines several requirements for captives to write Side A D&O policies for Delaware corporations, including several process changes intended to improve approval timelines and speed to market.

As explained in a recent alert, now is the time for public companies to adopt compliant clawback policies. This is because the US Securities and Exchange Commission (SEC) recently approved final rules on June 9, 2023, that required national securities exchanges like the New York Stock Exchange (NYSE) and the Nasdaq to implement new listing standards requiring public companies to institute compliant incentive-based compensation clawback policies. The NYSE and Nasdaq rules require listed companies to adopt clawback policies by December 1, 2023, which policies must apply to incentive compensation awarded after October 2, 2023. As public companies prepare to adopt compliant policies before the December 1, 2023 deadline, they should not only consider the clawback policy itself, but also the overlap between that policy and any applicable directors and officers (D&O) liability insurance. Doing so is important to address the potential new exposures created by the new SEC rules.

Artificial intelligence (AI) is rapidly changing the way businesses operate, from the way we research and write, to the way data is processed, to the way inventory is measured and distributed, to the way employees are monitored and beyond. Soon, artificial intelligence might be providing life advice, saving hospital patients or accelerating the development of cities. It is already reshaping corporate America. Very few, if any, industries—including the insurance industry—are immune. As the consultancy McKinsey wrote in 2021, artificial intelligence “will have a seismic impact on all aspects of the insurance industry.” McKinsey’s prediction has proved prescient.

As AI continues to influence the insurance industry and the broader economy, new opportunities and risks abound for policyholders. It is therefore essential for policyholders to keep up-to-date about insurance law’s latest frontier. To help policyholders navigate this new frontier, Hunton Andrews Kurth LLP’s insurance recovery team is introducing a new resource: The Hunton Policyholder’s Guide to Artificial Intelligence.

Last week, we published a client alert discussing the importance of cyber and directors and officers liability insurance for companies and their executives to guard against cyber-related exposures.  In today’s ever-changing threat landscape, all organizations are at risk of damaging cyber incidents, and resulting investigations and lawsuits, underscoring the importance of utilizing all tools in a company’s risk mitigation toolkit, including insurance, to address these exposures. 

Hardly a day passes without hearing about another major cyber incident. Recent studies show that cybersecurity incidents are becoming more common, but they are also costly, with some reports estimating an average cost of $9.44 million for breaches in the US. In recognition of this mounting problem, government agencies continue to ramp up enforcement and issue new rules, regulations and other guidance aimed at curbing cyber risks. Last week, the SEC adopted final rules requiring registered entities to periodically disclose material cybersecurity incidents and annually disclose their cybersecurity risk management, strategy and governance plans. In announcing the new rules, the SEC specifically noted that “an ever-increasing share of economic activity is dependent on electronic systems.” According to SEC Chair Gary Gensler, “Whether a company loses a factory in a fire—or millions of files in a cybersecurity incident—it may be material to investors.” 

We recently posted about Nevada becoming the first state to prohibit defense-within-limits provisions in liability insurance policies. Defense-within-limits provisions—resulting in what is called “eroding” or “wasting” policies—reduce the policy’s applicable limit of insurance by amounts the insurer pays to defend the policyholder against a claim or suit. 

The Fifth Circuit recently held that Blue Bell Creameries’ commercial general liability (CGL) insurers do not have a duty to defend the ice cream company in a shareholder lawsuit, which arose from a Listeria outbreak. The decision underscores the importance of coordination of different coverages and policies across insurance programs, as well as the potential perils policyholders may face if forced to seek recovery for certain losses under non-traditional policies.

Nevada recently became the first state to prohibit defense-within-limits provisions in liability insurance policies. Defense-within-limits provisions—resulting in what’s called “eroding” or “wasting” policies—reduce the policy’s applicable limit of insurance by amounts the insurer pays to defend the policyholder against a claim or suit. These provisions are commonly included in errors and omissions (E&O), directors and officers (D&O) and other management liability policies. This is in contrast to other policies, most commonly commercial general liability policies, which provide defense “outside of limits” where defense costs do not reduce the policy’s limit. 

Artificial intelligence technology (“AI”) is poised to radically improve human functionality, although some say the technology is quietly learning how to overtake it. In the meantime, the insurance industry has been using AI to save time, attain consistency and improve risk mitigation. However, while the industry looks forward to cost savings and better business utilizing generative AI, some insurers have simultaneously cautioned policyholders about the potential risks that reliance on AI may pose. Insurer’s cautionary statements cast doubt on the integrity of their own reliance on the technology.

As discussed in a recent client alert, a Delaware court issued a significant opinion in a directors and officers liability claim involving a special purpose acquisition company. In an issue of first impression in Delaware, the Superior Court in Clover Health Investments Corp. v. Berkley Insurance Co. held that directors and officers of the post-merger entity were “Insured Persons” under the SPAC’s D&O policy because they were acting in “functionally equivalent” roles to directors and officers of the SPAC when the alleged pre-merger wrongful conduct took place. The court’s pro-policyholder rulings on coverage for government investigations, based on an ambiguous definition of “Claim,” and allocation of defense costs under the Larger Settlement Rule also have potential ramifications on future D&O claims in Delaware outside of SPAC deals.

Earlier this month, the US District Court for the Northern District of Illinois ruled that Call One Inc., a tele-communications company, must litigate a claim by its insurer, Berkley Insurance Company, seeking to rescind coverage based on the information provided by the policyholder in its application for insurance. The coverage dispute is illustrative of insurers’ increased scrutiny of the answers to all policy application questions—including where no response is provided—to identify new or additional grounds to avoid coverage, even if it requires rescission of the policy. Policyholders should thus carefully consider all questions and requirements during the policy application process (including during renewal) to avoid potential disclosure disputes should a claim arise.

The Delaware Chancery Court recently held that the duty of oversight extended to corporate officers. The important decision came after McDonald’s shareholders sued the company’s former head of human resources, alleging that the officer breached his duty of oversight by “allowing a corporate culture to develop that condoned sexual harassment and misconduct.” In that same decision, Vice Chancellor Laster also determined that acts of sexual harassment can constitute a breach of fiduciary duty. Officers are rightly focused on the potential ramifications on their personal liability following the ruling. But that potential increased exposure also raises several insurance implications for companies to consider while procuring and renewing directors and officers insurance coverage.

In what is an unfortunate sign of the times, Springpoint Senior Living, Inc. recently sued its insurers in New Jersey federal court claiming they abruptly stopped covering Springpoint’s defense costs after doing so for nearly a decade.  A copy of the complaint can be found here. Springpoint’s allegations are emblematic of a growing trend among insurers taking drastic measures to avoid coverage, which is no doubt in response to the tightening economic conditions and looming recession around the globe. 

Boston-based partner Geoffrey Fehling has been recognized for his extensive experience and insights into emerging issues affecting directors and officers liability and other specialty lines insurance coverage by being selected to Law360’s 2022 Editorial Advisory Board for Insurance Authority Specialty Lines. As a member of the board, he will provide counsel to the legal newswire on insurance coverage issues facing companies and their officers and directors to help shape Law360’s future coverage.

To read more about Law360’s Insurance Authority Specialty Lines ...

Policyholders must be mindful of expansive causation language in policy exclusions that could pose significant—and sometimes unforeseen—hurdles to obtaining coverage for D&O claims. In TriPacific Capital Advisors, LLC v. Federal Insurance Co., a California federal court recently ruled that a D&O insurer had no duty to defend an investment firm’s $8.5 million employment suit because coverage was barred by the policy’s broad contract exclusion, which applied not only to breach of contract claims but also any claims “arising from” contractual liability owed by the company.

The Delaware legislature recently passed an amendment to the statute governing Delaware corporations’ ability to indemnify directors and officers. That statute—8 Del. Law 145—provides that Delaware corporations “may” purchase “insurance” to insure liability of their directors, officers, employees, and agents “whether or not the corporation would have the power to indemnify such person against such liability.” The recent amendment clarifies that “insurance” includes captive insurance. It states: “For purposes of this subsection, insurance shall include any insurance provided directly or indirectly (including pursuant to any fronting or reinsurance arrangement) by or through a captive insurance company organized and licensed in compliance with the laws of any jurisdiction . . . .”

From event-driven litigation and event cancellations to securities claims and regulatory enforcement actions, the COVID-19 pandemic has led to a number of directors and officers liability exposures extending far beyond business interruption losses. The first wave of COVID-19 securities suits, for example, focused on allegations that companies made false and misleading statements or failed to disclose in securities filings how they responded to the pandemic (in the case of several cruise lines) or stood to benefit from it (in the case of pharmaceutical companies). Most, but not all, of those suits were dismissed on early motions. In all cases, however, those companies and individuals would have benefited from robust D&O liability insurance coverage.

2022 has kicked off with several new whistleblower awards, as the SEC announced earlier this week that it had awarded more than $4 million to whistleblowers who provided information and assistance in two government actions—one for misconduct occurring overseas and a second where the whistleblower’s assistance directly led to the success of the covered action.

We have written over the past year about a string of pro-policyholder decisions from Delaware courts. One policyholder, however, recently had its claims dismissed based on application of Delaware law, based on one of 2020’s important D&O cases that limited coverage for appraisal actions initiated by stockholders pursuant to Title 8, Section 262 of the Delaware Code. In Stillwater Mining Co. v. National Union, the Delaware Superior Court explained that Stillwater had seized upon the Court’s 2019 opinion in Solera Holdings v. XL Specialty, which had held that a Section 262 appraisal action constituted a “securities claim” because it alleged a “violation” of state statutory or common law regulating securities. The policyholder alleged in its complaint that Delaware law governed the D&O policy, but when the Delaware Supreme Court reversed Solera, Stillwater “pivoted” to the view that Montana law, rather than Delaware law, governed the policy.

Policyholders have scored another victory in the Delaware Superior Court, this time on the issue of whether a “mergers and acquisition” endorsement required payment of a higher retention in two securities class actions. In August, we reported that, in CVR Refining, LP v. XL Specialty Insurance Co., No. N21C-01-260 EMD CCLD, 2021 WL 3523925 (Del. Super. Ct. Aug. 11, 2021), a Delaware Superior Court judge upheld a policyholder’s preferred forum in Delaware, denying five insurers’ motion to dismiss or stay the Delaware coverage action filed after the insurers had filed suit preemptively in Texas.

The Central District of California recently rejected an attempt by Federal Insurance Company, a Chubb company, to avoid its duty to defend its insureds in an $8.5 million lawsuit with a former employee.

TriPacific Capital Advisors, LLC acquired Directors and Officers (D&O) coverage from Federal and Employment Practices Liability (EPL) coverage from Travelers Insurance Company. While those policies were in effect, a former TriPacific employee sued the company and its president, Geoffrey Fearns, for a variety of employment-related causes of action concerning his termination and compensation. TriPacific and Fearns tendered notice to both insurers, seeking indemnification and defense costs. Both policies contained a duty to defend.  While Travelers agreed to defend under a reservation of rights, Federal denied coverage based on multiple grounds, including its policy’s “other insurance” provision, contending that the provision rendered its policy “excess” to the Travelers policy.  Federal also argued that TriPacific had not satisfied the D&O policy’s $150,000 self-insured retention and, thus, coverage had not been implicated, in any event. TriPacific maintained that neither the SIR nor the “other insurance” provision pertained to Federal’s duty to defend and brought suit to enforce the duty to defend.

Last month, the US District Court for the District of Connecticut granted an insurer’s motion for summary judgment in the case of Connecticut Municipal Electric Energy Cooperative v. National Union Fire Insurance Company of Pittsburgh, PA, No. 3:19cv839 (JBA), finding that there was no coverage under a directors & officers policy for defense costs associated with responding to a government subpoena. Last week, in line with our commentary, which highlighted several critical flaws in the court’s initial ruling, the court reversed itself and granted reconsideration, finding that there actually is coverage.

While policyholders have experienced a wide range of conflicting rulings related to COVID-19 business interruption losses, a recent Northern District of Illinois decision shows that the pandemic continues to present a range of exposures beyond business interruption losses, including for claims under directors and officers liability policies. In Federal Insurance Co. v. Healthcare Information and Management Systems Society, Inc., No. 20 C 6797 (N.D. Ill. Oct. 19, 2021), the court rejected the insurer’s broad reading of a professional services exclusion, contract exclusion, and the insurability of alleged restitution to deny coverage under a D&O policy for losses arising from a cancelled trade show.

Last year, we wrote about the UK’s National Security and Investment Bill, which was pending approval at the end of 2020. A few months into the New Year, the bill received Royal Assent, making it the “biggest shake-up of UK’s investment screening regime in 20 years.”

The NSI Act is now scheduled to take effect on January 4, 2022. However, businesses should be aware of the Act’s requirements now because it has a retroactive effect, where the government can “call in” transactions that have closed since November 12, 2020 for in-depth review if it believes a transaction gives ...