Following a 2013 data breach in which the credit and debit card information of more than 110 million customers was stolen or exposed, Target Corp. sought coverage from its CGL insurers for $74 million that it incurred in settlements with various banks (the credit and debit card issuers) for their costs in issuing new payment cards (both credit and debit cards) to the customers. In a recent decision on the parties’ cross-motions for summary judgment, the U.S. District Court for the District of Minnesota, applying Minnesota law, rejected a but-for theory of recovery and found that Target had not established any evidence of a connection between the damages Target incurred in settling claims related to replacing the payment cards, and the value of the use of the payment cards, and therefore could not recover under a policy provision providing coverage only for “loss of use.” The court denied Target’s motion for partial summary judgment and granted the insurers’ motion for summary judgment.

Background

Target discovered in 2013 that an intruder had breached its computer networks and had stolen payment card data and personal contact information of its customers. Target settled with the issuer banks in 2016 on claims they had brought relating to the data breach. The settlement was for $138 million, of which $78 million was for the costs of the banks in replacing payment cards that were compromised by the data breach.

Target’s applicable CGL policies provided insurance coverage “for the ‘ultimate net loss’ … because of ‘bodily injury’ or ‘property damage.’” The policies defined “property damage” as the “[l]oss of use of tangible property that is not physically injured.” The policies further stated that “[a]ll such loss of use shall be deemed to occur at the time of the ‘occurrence’ that caused it.”

In its coverage action against the insurers, Target sought to recover for its settlement of the costs incurred by the banks in replacing the customer payment cards. There was no dispute about the insurers’ duty to defend, only whether there was a duty to indemnify for Target’s settlements with the banks. Target argued that the payment cards lost their function after the customer accounts were breached, and that such circumstance met the policy requirement of “loss of use of tangible property that is not physically injured,” and that the damages incurred were because of “loss of use.” The insurers argued that there is a distinction between property damage and diminution in the value of property, contending that the payment cards lost their value but not their use as tangible property, and that in the absence of loss of use, there is no coverage. The insurers’ argument was based largely on a Minnesota case, Federated Mutual Insurance Co. v. Concrete Units, Inc., which had held that diminution in value is not “property damage” when defined as either “physical injury to … tangible property” or as “loss of use of tangible property,” and thus “diminution in value was not a recoverable damage under a loss-of-use policy.”

The parties also disagreed as to whether Minnesota law required that loss-of-use damages be measured exclusively by time. The insurers argued that replacing payment cards is not a time-based damage and that therefore the policies do not cover such damage. Target disputed that loss-of-use damages could be measured exclusively by time.

The Opinion

The district court addressed both parties’ arguments, assuming, without deciding, that the data breach constituted an “occurrence” under the terms of the CGL policies. The court went on to note that “[t]he facts of this case … do not involve the value of the plastic payment cards. … No party submits that the value of the plastic payment cards diminished after the Data Breach.” The court further declined to rule that, under Minnesota law, loss-of-use damages are exclusively measured by time. Rather, the court noted that the parties seemed to frame the issue as being “in essence, a but-for theory of loss-of-use damages,” stating:

Here, the parties dispute whether damages arising out of the Payment Card Claims are damages “based on” loss of use of the payment cards. [The insurers] contend[] that there is no nexus between the loss-of-use damages alleged here and the value of the loss of the use of payment cards. Target’s theory appears to be that, because the payment cards allegedly lost their use and Target resolved the Payment Card Claims by paying a settlement, the settlement of that liability necessarily constitutes damages because of a loss of use.

The court went on to state:

Other courts considering similar loss-of-use damages claims under similar CGL policies have concluded that there must be a nexus between (1) the value of the customer’s or company’s ability to use the product or service that has been lost and (2) the damages associated with that loss of use. In doing so, courts have rejected a “but for” test for loss-of-use damages.

Although a but-for theory of loss-of-use damages has not been expressly articulated, Minnesota courts have held that loss-of-use damages must be “based on” the alleged loss of use. See Concrete Units, 363 N.W. 2d at 756-57 (discussing loss-of-use damages “based on lost use” of grain elevator); see also Atl. Mut. Ins. Co. v. Judd Co., 367 N.W.2d 604, 608 (Minn. Ct. App. 1985) (observing that whether loss-of-use insurance policy coverage applies “turns on whether the claimed damages are based on or causally related to property damage”), aff’d, 380 N.W.2d 122 (Minn. 1986). This suggests that Minnesota law requires loss-of-use damages to have some connection to the value of the use of the now-damaged property when it previously was unimpaired.

The district court went on to determine:

Here, the record is devoid of any allegation or evidence as to what the value of the use of the payment cards is, either to Target’s customers or to the payment card companies. And as the value of the use is not established or even approximated, damages cannot be “based on” the loss of use because there is no nexus between the damages and the loss of use. Target has not established a connection between the damages incurred for settling claims related to replacing the payment cards and the value of the use of those cards, either to the payment-card holders or issuers. For this reason, the connection between the damages claimed and the loss of use of the payment cards is insufficiently direct and, therefore, the damages claimed are not loss-of-use damages covered under the Policies.

The court concluded that although the parties agree that the plastic payment cards constitute “tangible property” under the CGL policies, there was no need to address that element “because Target has not established loss-of-use damages. In summary, Target has not met its burden of demonstrating coverage under the [p]olicies.”

Takeaway

The decision in Target Corp. is based on a close analysis of Minnesota law, which requires that loss-of-use damages “must be ‘based on’ the alleged loss of use,” i.e., having “some connection to the value of the use of the now-damaged property when it previously was unimpaired.” Notably, the district court declined to apply a but-for theory for loss-of-use damages, instead requiring “some connection” to be established. The decision is also case-specific insofar as it is based on the court’s finding that no evidence was submitted on the value of the use of the payment cards. Nevertheless, the court’s analysis will be useful to keep in mind for insurers handling claims in jurisdictions that do not have a but-for standard for loss-of-use damages, and as a road map for defending claims in those jurisdictions where “some connection” is required.