Advaiya Solutions Inc v. Hartford Fire Insurance Company

[5] UNITED STATES DISTRICT COURT 6 WESTERN DISTRICT OF WASHINGTON AT SEATTLE [7] ADVAIYA SOLUTIONS INC, CASE NO. C23-0685-KKE [8] Plaintiff, ORDER GRANTING PLAINTIFF’S [9] v. MOTION FOR PARTIAL SUMMARY JUDGMENT [10] HARTFORD FIRE INSURANCE COMPANY, [11] Defendant. [12] This is an insurance coverage dispute. Plaintiff Advaiya Solutions Inc. (“Advaiya”) brings [13] this motion for partial summary judgment asking the Court to find that its insurer, Defendant [14] Hartford Fire Insurance Company (“Hartford”), has a duty to defend it against a claim by a vendor, [15] Ingram Micro (“Ingram”), for charges incurred as a result of a hacking incident. Hartford responds [16] that Advaiya is really seeking indemnification and that Ingram’s demand is not covered by the [17] insurance policy. The Court finds that the duty to defend standard applies and that Hartford has a [18] duty to defend Advaiya against the claim made by Ingram. [19] I. BACKGROUND [20] “Advaiya is a technology consulting and implementation company that delivers a variety [21] of business solutions to its customers.” Dkt. No. 21 ¶ 2. AA Asphalting hired Advaiya to help it [22] set up various Microsoft products. Id. ¶ 3. Advaiya made a secure portal on “Microsoft’s Azure [23] cloud platform” where AA Asphalting could access all the Microsoft products for a fee. Id. [24] 1 Advaiya purchased the Microsoft products through Ingram, who purchased them from Microsoft. 2 Id. ¶ 4. When AA Asphalting used the platform, Microsoft would invoice Ingram, who would 3 invoice Advaiya, who would invoice AA Asphalting. Id. 4 Advaiya purchased a claims-made enterprise liability policy for the term October 7, 2021 5 to October 7, 2022 (“Policy”). Dkt. No. 21-1. Hartford agreed to pay money “that you become 6 legally required to pay as damages” caused by certain wrongful acts, and Hartford had a duty to 7 defend covered claims. Id. at 9 (emphasis in original). Under the Policy, a claim is “a written 8 demand received by any of you for damages or injunctive relief” (id. at 11) and damages are “a 9 money award, judgment or settlement that you become legally required to pay” (id. at 12). The 10 Policy excludes the following from the definition of damages: 11 [A]ny kind of: refund, rebate, redemption coupon, offset, return or credit that has been paid to or by any of you, or that is owed to or by any of you; examples 12 include but are not limited to any of the following: any licensing fee or other fee, royalty, subscription or access charge, or other charge[.] [13] Id. at 13. [14] Over a weekend in July 2022, hackers “gained access to AA Asphalting’s” portal. Dkt. [15] No. 21 ¶ 6, see also Dkt. No. 28 at 5. The hack was detected the following Monday, July 11, 2022. [16] Dkt. No. 21 ¶ 6. “Because the fees that Microsoft charged Ingram were based on the amount of [17] usage,” the hackers’ use of the portal “generated roughly $334,000 in additional fees” that Ingram [18] owed Microsoft. Id. [19] Microsoft and Ingram contend Advaiya is to blame for the stolen services because Advaiya [20] “failed to [e]nsure that AA Asphalting’s portal used best security practices such as multi-factor [21] authentication.” Dkt. No. 30 at 4, Dkt. No. 21 ¶ 7; see also Dkt. No. 29-8 (email from Microsoft [22] to Ingram). Advaiya argues “Ingram was at fault for the bulk of its loss thanks to Ingram’s failure [23] to comply with a mutually agreed $30,000 cap on the amount of charges that could be incurred.” [24] 1 Dkt. No. 30 at 4; see also Dkt. No. 21 ¶¶ 7–8, Dkt. No. 21-8. Advaiya also “complained that 2 Microsoft had failed to make its fraud notification service available to Advaiya.” Dkt. No. 30 at 3 4, Dkt. No. 29-1 at 70–71. 4 On July 22, 2022, Advaiya sent a notice to Hartford informing it about the hacking. Dkt. 5 No. 21 ¶ 10. Hartford acknowledged the “submission” (Dkt. No. 21-5) and the parties remained 6 in communication. In particular, Advaiya provided an incident report (Dkt. No. 21-2), a summary 7 of current negotiations with Microsoft and Ingram, and continued to ask, “Is Ingram’s attempt to 8 collect on these charges enough to trigger a claim?” Dkt. No. 21-8 at 2, see also Dkt. No. 20-1 9 (excerpt from claim notes showing communication between Hartford and Advaiya from July 26, 10 2022 to November 1, 2022). 11 On October 17, 2022, Ingram sent a past due reminder to Advaiya stating, “The invoice 12 detail for the past due balance is as follows” and listing a line item for $323,919.66. Dkt. No. 21-3. 13 On November 1, 2022, Ingram sent a final demand notice stating, “Despite our attempts to assist 14 you in resolving the delinquency on the above named account, the balance of $333,846.06 remains 15 past due” (“Ingram’s Demand”). Dkt. No. 21-4. Ingram’s Demand was provided to Hartford. The 16 next day Hartford spoke with Advaiya’s counsel and, according to the claim notes, reported “as 17 this appears to be a request for payment [from] the Insured for services rendered it likely doesn’t 18 fall within the definition of damages under the Policy.” Dkt. No. 29-11 at 2. 19 On December 1, 2022, Hartford sent its coverage determination letter stating: “[T]here is 20 no coverage for the value of the stolen cloud services/resources or Ingram’s demand for payment.” 21 Dkt. No. 21-7 at 2. The letter explained: 22 The Ingram demand for unpaid fees is not a demand for injunctive relief and does not constitute a demand for damages as that term is defined in the Policy. Rather it 23 is a demand for fees/charges owed by Advaiya for purchased and/or consumed services/resources, which are specifically carved out by paragraph 1 above from 24 the definition of damages. As such, Ingram’s demand does not constitute a claim 1 for damages under the terms of the Policy, the insuring agreement is not triggered and there is no coverage with respect to Ingram’s demand. [2] Id. at 4. The letter also included two footnotes stating there was no dispute that the demand from [3] Ingram did not involve “a network wrongful act,” a “data privacy wrongful act,” or a “security [4] wrongful act.” Id. at 4 n.1, 5 n.2. [5] Advaiya filed this case in King County Superior Court on April 7, 2023. Dkt. No. 1-2. [6] Hartford removed the case to this Court on May 10, 2023. Dkt. No. 1. The second amended [7] complaint is the operative complaint and alleges causes of action for breach of contract, common [8] law bad faith, violations of the Washington Consumer Protection Act, violations of the Insurance [9] Fair Conduct Act (“IFCA”), and declaratory judgment. Dkt. No. 1-9. Advaiya now moves for [10] partial summary judgment and asks the Court to find that Hartford owed Advaiya a duty to defend [11] against Ingram’s Demand. Dkt. No. 19. Hartford submitted a response (Dkt. No. 28), Advaiya [12] filed its reply (Dkt. No. 30), and the Court heard oral argument (Dkt. No. 37). The matter is now [13] ripe for the Court’s consideration. [14] II. ANALYSIS [15] A. The Court Has Subject Matter Jurisdiction. [16] This Court has subject matter jurisdiction under 28 U.S.C. § 1332 (a) because the dispute [17] is between citizens of different states and the amount in controversy exceeds $75,000. See Dkt. [18] No. 1-9 ¶ 3.16 (alleging a demand to Advaiya for $333,846), ¶ 1.1 (Advaiya is a Washington [19] corporation); Dkt. No. 6 ¶ 1.2 (Hartford is a Connecticut corporation). “[F]ederal courts sitting in [20] diversity apply state substantive law.” Cuprite Mine Partners LLC v. Anderson, 809 F.3d 548 , [21] 554 (9th Cir. 2015). [24] 1 B. Legal Standard for Summary Judgment 2 To succeed on its motion for partial summary judgment, Advaiya must show “that there is 3 no genuine dispute as to any material fact” on whether Hartford owed it a duty to defend. Fed. R. 4 Civ. P. 56(a). A dispute is “genuine” if “the evidence is such that a reasonable jury could return a 5 verdict for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 248 (1986). A 6 fact is “material” if it “might affect the outcome of the suit under the governing law.” Id. The 7 court must view the evidence in the light most favorable to the nonmoving party and draw all 8 reasonable inferences in that party’s favor. Reeves v. Sanderson Plumbing Prods., Inc., 530 U.S. 9 133 , 150–51 (2000). 10 C. The Duty to Defend Standard Applies. 11 Advaiya insists it is seeking to invoke Hartford’s duty to defend. Dkt. No. 19 at 12–14, 12 Dkt. No. 30 at 5. In response, Hartford asserts that Advaiya is requesting indemnification coverage 13 because the duty to defend “requires the existence of something to assign a lawyer to defend 14 against[.]” Dkt. No. 28 at 12. Hartford ignores the reality that a lawyer can be assigned to defend 15 against a final demand or disputed invoice. Hartford further ignores that Ingram’s Demand 16 expressly threatened Advaiya with legal action. Dkt. No. 21-4 (“Should you fail to remit payment 17 in full…your account will be assigned to a third party collection agency or attorney[.]”). 18 Hartford also disregards the Policy language. In the Policy, Hartford agrees to defend “all 19 covered claims.” Dkt. No. 21-1 at 9. The Policy defines a claim as a “written demand received 20 by any of you for damages or injunctive relief.” Id. at 11 . The Policy does not limit the duty to 21 defend to lawsuits or “a legal complaint filed by a third party” as Hartford posits. Dkt. No. 28 at [22] 12. Ingram’s Demand is indisputably a “written demand”1 and Washington law does not require [23] 1 The Court addresses Hartford’s argument that the Ingram Demand is not for damages as defined in the Policy in 24 Section II(D)(1) of this order. 1 “a particular set of words of phrases” to trigger a duty to defend. Osborne Constr. Co. v. Zurich 2 Am. Ins. Co., 356 F. Supp. 3d 1085, 1095 (W.D. Wash. 2018) (rejecting argument that tender letter 3 to insurer had to explicitly ask for or reference the duty to defend to trigger such a duty). Because 4 the Policy provides a duty to defend claims, Advaiya makes a “claim” under the Policy, and 5 Advaiya moves for an order on Hartford’s duty to defend, the Court will apply Washington’s duty 6 to defend standard. 7 “The duty to defend is triggered if the insurance policy conceivably covers allegations in 8 the complaint.” Expedia, Inc. v. Steadfast Ins. Co., 329 P.3d 59, 64 (Wash. 2014) (en banc), as 9 corrected (Aug. 6, 2014). “[A]ny reasonable interpretation of the policy that invokes coverage for 10 the insured will control the question of whether a duty to defend has arisen, and the insured is 11 entitled to the benefit of any uncertainty, whether legal or factual.” Am. Best Food v. Alea London, 12 Ltd., 229 P.3d 693, 696 (Wash. 2010). “Exclusionary clauses are narrowly construed for the 13 purpose of providing maximum coverage for the insured.” George v. Farmers Ins. Co., 23 P.3d 14 552, 557 (Wash. Ct. App. 2001). 15 Turning to what materials the Court can consider, “[t]he duty to defend generally is 16 determined from the ‘eight corners’ of the insurance contract and the underlying complaint.” 17 Expedia, 329 P.3d at 64 . The insurer, and thus the Court, can look outside these eight corners 18 under two exceptions. Id. at 65 . 19 First, if coverage is not clear from the face of the complaint but coverage could exist, the insurer must investigate and give the insured the benefit of the doubt on 20 the duty to defend. Second, if the allegations in the complaint conflict with facts known to the insurer or if the allegations are ambiguous, facts outside the complaint 21 may be considered. However, these extrinsic facts may only be used to trigger the duty to defend; the insurer may not rely on such facts to deny its defense duty. [1] Id. (cleaned up).2 Here, the “complaint” is Ingram’s Demand. Dkt. No. 21-4. The parties agree 2 that, because Ingram’s Demand includes no specifics about what led to the amount it demands 3 (Dkt. No. 21-4), the Court can consider extrinsic evidence to find Hartford owed a duty to defend. 4 Dkt. No. 19 at 15, Dkt. No. 28 at 13. Thus, the Court will review Ingram’s Demand, the Policy, 5 and the extrinsic evidence submitted by the parties to determine whether Ingram’s Demand could 6 conceivably be covered under the Policy’s duty to defend. 7 D. The Policy Could Conceivably Cover Ingram’s Demand. 8 1. Ingram’s Demand is a written demand for “a money award, judgment or settlement.” 9 Hartford argues Ingram’s Demand is not a claim, as required by and defined by the Policy. 10 Dkt. No. 28 at 14. The Policy defines a claim as “a written demand received by any of you for 11 damages or injunctive relief” (Dkt. No. 21-1 at 11) and damages as “a money award, judgment or 12 settlement that you become legally required to pay” (id. at 12). Hartford asserts that the definition 13 of damages means only formal legal proceedings would qualify as a claim. Dkt. No. 28 at 14. But 14 Ingram’s Demand seeks a “money award, judgment, or settlement” because it seeks $333,846.06 15 from Advaiya and threatens to assign an attorney if Advaiya does not pay. Dkt. No. 21-4. 16 Hartford’s citation to an Ingram collections manager’s deposition testimony (Dkt. No. 28 at 14– 17 15 (citing Dkt. No. 29-10)) and his opinion on whether Ingram’s Demand was for damages, money 18 award, or legal judgment, does not change the Policy language or that Ingram’s Demand seeks 19 money under threat of legal action. 20 Under Washington law, if a Policy provides a duty to defend for “demands,” not only 21 “suits”—as is the case here—a demand letter can trigger the duty. Robbins v. Mason Cnty. Title [23] 2 Hartford argues that, even if the insurer cannot, the Court can consider extrinsic evidence to deny coverage. Dkt. No. 28 at 13. The Court need not address this question because there is no extrinsic evidence that would warrant 24 finding no duty to defend. 1 Ins. Co., 462 P.3d 430 , 436 (Wash. 2020) (en banc) (“The policy language in the present case 2 indicates that MCTI will defend not only against legal proceedings but also against demands. 3 Therefore, the duty to defend was triggered when the Tribe sent the letter to Robbins[.]”). Thus, 4 the Policy’s definition of a claim to be a “written demand” explicitly includes demand letters for 5 a “money award, judgment, or settlement.” Hartford’s citation to a California federal case 6 applying Georgia law does not warrant diverting from Washington precedent. See Dkt. No. 28 at 7 14 n.46 (citing Stout v. Media/Prof’l Ins. Agency, CV 07-2727-RGK (CWX), 2008 WL 11438029 , 8 at *3 (C.D. Cal. Feb. 5, 2008)). 9 Because the Policy defines claims as “written demands” for “money award[s],” Ingram’s 10 Demand for money is a claim. 11 2. Ingram’s Demand is not clearly excluded by the damages exclusion. 12 Hartford next argues that Ingram’s Demand does not comprise a covered claim because it 13 seeks “only licensing fees and subscription charges” which are excluded damages under the Policy. 14 Dkt. No. 28 at 16. Exclusions are “strictly construed against the insurer.” Stuart v. Am. States Ins. 15 Co., 953 P.2d 462, 464 (Wash. 1998). The Policy excludes the following from the definition of 16 “damages”: 17 [A]ny kind of: refund, rebate, redemption coupon, offset, return or credit that has been paid to or by any of you, or that is owed to or by any of you; examples include 18 but are not limited to any of the following: any licensing fee or other fee, royalty, subscription or access charge, or other charge[.] [19] Dkt. No. 21-1 at 13. Hartford’s fixation on “licensing fee” and “subscription or access charge” [20] misses the point. Even if the amount Ingram seeks to collect from Advaiya is technically for [21] licensing fees or subscription charges, such amounts are only excluded from coverage if such fees [22] are “owed to or by” Advaiya. Id. And Advaiya explains that the fees are not “owed to or by” it [23] through its licensing arrangement with Ingram but are instead a liability caused by a third-party’s [24] 1 criminal act. Dkt. No. 19 at 16–18, Dkt. No. 30 at 14. Hartford does not dispute that the charges 2 were incurred by a third-party hacker and not by services consumed by Advaiya. See generally 3 Dkt. No. 28 at 15–16. Moreover, Advaiya claims that Ingram should have capped any charges at 4 $30,000 per the parties’ contract (Dkt. No. 21-6 at 3), while Ingram’s Demand threatened legal 5 action if Advaiya did not pay (Dkt. No. 21-4). On this record, whether Advaiya actually “owes” 6 the fees, and the extent of any such liability, is in dispute. This is not, as Hartford claims, an effort 7 by Advaiya to pass on its routine business expenses to its insurer. Rather, Advaiya has shown that 8 Ingram’s Demand could conceivably constitute damages under the Policy sufficient to trigger 9 Hartford’s duty to defend, and the damages exclusion does not apply. 10 3. Ingram’s Demand could have resulted from a covered wrongful act. 11 The Policy covers claims “caused by” three categories of wrongful acts: professional [12] services wrongful acts,3 data privacy wrongful acts,4 and network wrongful acts.5 Dkt. No. 21-1 13 at 9. Hartford argues Ingram’s Demand arose from a debt, not any wrongful act by Advaiya, and 14 the duty to defend only arises from claims caused by wrongful acts. Dkt. No. 28 at 17 (“[T]he [15] Payment Demand Letter was not caused by anything Advaiya did wrong or failed to do.”).6 16 In support of this theory, Hartford cites Ingram’s collections manager’s testimony that the 17 Ingram Demand does not claim that Advaiya erred. Dkt. No. 28 at 17 (citing Dkt. No. 29-10). But [18] 3 The Policy defines “professional services wrongful act” as “the following when actually or allegedly committed [19] by you…a security wrongful act in your performance of enterprise services.” Dkt. No. 21-1 at 17. And a “security wrongful act” is “a failure to prevent…unauthorized access to, unauthorized use of…firmware, data, software, 20 systems, or networks[.]” Id. [21] 4 The Policy defines “data privacy wrongful act” as “any act, error or omission by you…that results in” improper disclosure, collection, or control of confidential information or violation of a data privacy law. Dkt. No. 21-1 at 14. 22 5 Under the Policy a “network wrongful act means any act, error or omission by you…or a third party service provider, which results in a network intrusion.” Dkt. No. 21-1 at 15. And a “network intrusion means the gaining 23 of access to or use of the computer system by an unauthorized person….” Id. 6 Hartford does not dispute that any wrongful act by Advaiya would fall into one of the covered categories. See Dkt. 24 No. 28 at 17–18. 1 “if coverage is not clear from the face of the complaint but coverage could exist, the insurer must 2 investigate and give the insured the benefit of the doubt on the duty to defend.” Expedia, 329 P.3d 3 at 65. As noted above, the language in Ingram’s Demand does not determine coverage, so Hartford 4 had a duty to investigate and consider extrinsic evidence to decide whether it was “conceivable” 5 that the amount sought by Ingram was caused by a wrongful act by Advaiya. See Woo v. Fireman’s 6 Fund Ins. Co., 164 P.3d 454, 459 (Wash. 2007) (“[If] coverage could exist, the insurer must 7 investigate and give the insured the benefit of the doubt that the insurer has a duty to defend.”). 8 The record contains multiple pieces of extrinsic evidence raising a question of whether 9 Advaiya was at fault for the cyber-attack, rendering coverage under the Policy “conceivable” for 10 purposes of the duty to defend. Specifically, the incident report prepared after the hack included 11 remediation recommendations for Advaiya to take to avoid such hacks in the future (Dkt. No. 21-2 12 at 6–7), Microsoft’s decision to not cancel the charges and its recommendation to “put in place 13 fraud prevention and detection risk mitigation controls” (Dkt. No. 29-8 at 2), and Ingram’s Cloud 14 Marketplace Terms that require Advaiya to “ensure that your customers implement best practices 15 for maintaining such security and confidentiality” (Dkt. No. 29-2 at 4) coupled with Ingram’s 16 belief that AA Asphalting “was hacked because they didn’t use double authentication like 17 Microsoft requires on Azure subscriptions” (Dkt. No. 29-10 at 42), all make it conceivable that 18 some act or omission by Advaiya caused the hack. 19 Thus, under Washington’s duty to defend standard, Hartford has a duty to defend Advaiya 20 in the claim asserted by Ingram. 21 // 22 // 23 // 24 // 1 III. CONCLUSION 2 For these reasons, the Court GRANTS Advaiya’s motion for partial summary judgment. 3 Dkt. No. 19. 4 Dated this 20th day of September, 2024. [5] A [6] Kymberly K. Evanson 7 United States District Judge