In a recent, unpublished opinion, the Fourth Circuit held that an insurer had a duty to defend its insured under a CGL policy for a cyber incident.   A class action complaint was filed against Portal Healthcare Solutions (“Portal”) alleging that Portal and others engaged in conduct resulting in plaintiff’s private medical records being posted on the internet for over four months.  Portal was insured under two Travelers policies at the time of the incident.

Travelers filed suit against Portal seeking a declaration that the duty to defend had not been triggered by the class action complaint because the complaint did not allege a covered “publication” by Portal.  The district court ruled that Travelers was obligated to defend Portal.  In reaching its decision, the district court had applied the “Eight Corners Rule” and recognized that the insurer’s duty to defend is broader than its obligation to pay.  Based on those principles, the district court had concluded that the complaint potentially or arguably alleged a “publication” because any member of the public with an internet connection could have viewed the records while they were available online.  The Fourth Circuit affirmed, specifically noting the district court’s “sound legal analysis.”

While this case was favorable to the insured, the ruling must be considered in full context.  The policy at issue here was an older CGL policy and it did not include a cyber exclusion, which is now found in most CGL policies.  If you are seeking protection from cyber incidents, it is best to work with an experienced broker and purchase a cyber policy.