Zurich fights Sony breach pay out

Sony's insurer is contesting any obligation to cover the electronics giant for costs related to lawsuits filed over its massive PlayStation Network breach earlier this year.

In a complaint filed with the state Supreme Court in New York, Zurich American Insurance Co. is seeking "declaratory relief" from having to defend and possibly compensate Sony over class-action lawsuits or state attorneys general actions filed in response to the breach.

The complaint contends that Sony has been named in 58 class-action lawsuits, including three in Canada.

Zurich argues that it is not liable to indemnify Sony for these costs because its policy with the company only covers claims for bodily injury, property damage or personal and advertising injury. Sony's policy contains "certain exclusions" related to "class-action complaints and miscellaneous claims," according to the complaint, filed Wednesday.

Peter Foster, executive vice president at insurance broker Willis North America, said he is not surprised Sony has turned to its general liability carrier for help paying for the breach.

"Whenever there's a loss like this, you look to all the insurance policies that could apply," Foster, who specializes in privacy and network security, told SCMagazineUS.com on Friday. "There's an expectation that if you bought a cyber risk policy, you're going to be declined coverage under the general liability policy. But it doesn't mean you stop pursuing those policies to see if they offer any coverage at all."

Foster said an underwriter informed him that Sony does in fact have a cyber insurance policy, which covers losses related to the breach. But it is likely that the company was hoping to lean on Zurich to cover the expected high costs related to defending itself against the slew of class-action lawsuits.

Foster added that business executives should keep a close eye on the case to determine whether a general liability policy offers any breach-related coverage at all, or if one must entirely rely on a cyber insurance policy.

Sony has previously estimated the breach would cost it at least US$171 million. However, that figure did not include any of the costs related to defense against customer lawsuits.

The incident in April exposed the personal information of some 100 million users of its PlayStation Network, Qriocity and Online Entertainment services.

A Sony spokesperson could not be reached for comment.

This article originally appeared at scmagazineus.com