There has been oodles of discussion over the past couple of years about cyber coverage. But what there has not been are judicial decisions addressing the issues. For this reason, when a case comes down on the subject of cyber coverage, it usually takes on more significance, and gets more attention, than it would if there were a more fuller developed body of law in the area. These days, a Justice of the Peace in South Dakota could issue a decision about coverage for a breach of the Commodore 64 at Cletus’s Feed Store and it would be news. So, needless to say, an opinion from the New York Appellate Division cannot go unnoticed.

As is not unusual for an opinion from the New York Appellate Division, RVST Holdings, LLC v. Main Street America Assurance Co. (N.Y. App. Div. Feb. 18, 2016) is brief. I’ve seen CVS register receipts, for a pack of Chiclets, that contain more words than New York Appellate Division decisions. But, in this case, the opinion didn’t need to be any longer than it was.

In RVST Holdings, the New York Appellate Division, Third Department, addressed coverage under the following circumstances. RVST Holdings was an operator of fast food restaurants that stored its customers’ credit card information on its computer network. The court further described the situation: “The network was infiltrated by unknown individuals who unlawfully obtained the customers’ card information and then used that information to make numerous fraudulent charges. Nonparty Trustco Bank subsequently commenced an action against [RVST Holdings] that alleged, as relevant here, that plaintiffs had negligently failed to exercise reasonable care in safeguarding the information of Trustco cardholders, which, in turn, caused Trustco to sustain damages related to its reimbursement of the fraudulent charges. [RVST Holdings] then sought coverage under their business owner’s insurance policy issued by defendant [Main Street America Assurance]. After an investigation, however, [Main Street America] declined to defend or indemnify plaintiffs in the underlying Trustco action, asserting that the policy excludes from coverage third-party claims arising out of the loss of electronic data.”

For reasons not explained by the Appellate Division, the trial granted summary judgment for RVST, holding that Main Street America had a duty to defend. Main Street America appealed and the Appellate Division reversed. And it didn’t struggle to reach its decision.

First, there was no dispute between the parties that Trustco’s complaint was based upon “losses due to the theft and subsequent misuse of electronic account data and/or electronic vandalism at certain [of plaintiffs’ restaurant] locations.” Nor was “there any dispute that the electronically stored cardholder information at issue in the underlying action qualifies as ‘electronic data’ under the policy’s definition of that term.”

With that as the foundation, the court turned to the principal policy provisions: The insurer “will pay those sums that [RVST] become[ ] legally obligated to pay as damages because of ... ‘property damage.’ ‘The policy defines ‘property damage’ as ‘[p]hysical injury to tangible property ... or ... [l]oss of use of tangible property that is not physically injured.’”

However, as the court noted, “crucially” -- and, indeed, it was crucial -- the policy stated that, “‘[f]or the purposes of this insurance, electronic data is not tangible property.’ Moreover, the policy specifically excludes ‘[d]amages arising out of the loss of ... electronic data.’”

Based on this “unambiguous language,” the court held that Trustco’s claim, for damages arising out of RVST’s negligent handling of electronic data, is not a claim for “property damage” and is excluded from coverage. Therefore, the New York Appellate Division reversed, holding that the insurer had no duty to defend RVST against Trustco’s claim.

In case you’re wondering what RVST argued in support of coverage, it was this: The policy also contained a separate section providing coverage for property damage. However, as the court pointed out, this section provides coverage for “direct physical loss of or damage to” plaintiffs’ own property. “Unlike the liability section of the policy, for which plaintiffs paid a separate premium, the property damage section contains no language indicating that it covers the claims of third parties. Thus, the property damage section of the policy provides only first-party coverage for direct damage to plaintiffs’ property, a claim not made by plaintiffs here and, further, one that ‘does not involve any need or duty to provide the insured with a legal defense.’”