On October 23, the U.S. District Court for the District of Puerto Rico denied motions to dismiss gross negligence claims against former directors and officers brought by the FDIC as receiver for a failed bank. The court further held that the FDIC as receiver is not precluded from recovering under the directors and officers’ insurance policies. W Holding Co. v. Chartis Ins. Co.-Puerto Rico, No. 11-2271, slip op. (D. Puerto Rico Oct. 23, 2012). The FDIC sued former officers and directors of the bank, alleging that they were grossly negligent in approving and administering commercial real estate, construction, and asset-based loans and transactions and seeking over $176 million in damages. The court concluded that the FDIC could not maintain claims for ordinary negligence against the former officers and directors because of the business judgment rule, but that the FDIC had stated sufficient facts to allege a plausible claim for gross negligence. The court held that (i) the FDIC’s complaint adequately specified which alleged misconduct was attributable to each director or officer, (ii) the claims should not be dismissed on statute of limitations grounds, and (iii) separate claims against certain former officers and directors concerning fraudulent conveyances should not be dismissed. In addition, the court denied the insurers’ motions to dismiss the FDIC’s claims for coverage under the directors and officers’ liability policies. The court held that the policies’ “insured versus insured” exclusion did not apply to an action by the FDIC as receiver because the FDIC was suing on behalf of depositors, account holders, and a depleted insurance fund.

Last month, the U.S. Court of Appeals for the Sixth Circuit affirmed a district court holding that the computer fraud rider to a retailer’s Crime Policy covered losses resulting from the theft of customers’ financial information by computer hackers. Retail Ventures, Inc. v. Nat’l Union Fire Ins. Co. of Pittsburgh, Pa., No 10-4576/4608, 2012 WL 3608432 (6th Cir. Aug. 23, 2012). The retailer incurred millions of dollars in expenses and attorney fees related to a data breach in which computer hackers stole customers’ credit card and bank account information. The retailer submitted a claim for the losses under the computer fraud rider to its Blanket Crime Policy, which the insurer denied because the policy excluded third-party theft of “proprietary” or “confidential information.” The retailer filed suit and prevailed on summary judgment. On appeal, the court upheld the district court’s application of a proximate cause standard to determine that the losses were covered as losses sustained as a direct result of the theft. The court also rejected the insurer’s argument that the losses were excluded as losses of “proprietary or confidential information” because the retailer did not “own or hold single or sole right” to the stolen information and the information did not relate to the manner in which the business operated.

On June 29, the U.S. Court of Appeals for the Seventh Circuit directed a D&O insurance provider to cover certain claims against defendants insured under the same policy as some plaintiffs despite an “insured vs. insured” exclusion from coverage under the insurance arrangement. Miller v. St. Paul Mercury Ins. Co., No. 10-3839 (7th Cir. June 29, 2012). The dispute began when five plaintiffs sued Strategic Capital Bancorp, Inc. (“SCBI”) for fraud and other state law claims flowing from SCBI’s alleged material misstatements relating to the company’s financial condition. Three of the plaintiffs were directors or officers covered under SCBI’s policy; the other two plaintiffs were not insureds under the policy. When SCBI notified its insurance carrier and requested indemnity and defense coverage under the insurance agreement, the carrier refused, citing the policy’s “insured vs. insured” provision. All parties to that initial lawsuit then filed a new action against the carrier in an effort to force it to provide coverage. The Seventh Circuit reversed the district court’s dismissal of those claims brought by the two non-insured plaintiffs. In a lawsuit involving both insured and non-insured plaintiffs, the court ruled, the insurance carrier must “provide indemnity for losses on claims by non-insured plaintiffs but not for losses on claims by insured plaintiffs.” The court reasoned that such a holding conforms to the parties’ expectations, minimizes the risk of arbitrary results, and discourages efforts to manipulate the result through strategic party joinder or case consolidation.

On May 23, Fannie Mae announced the postponement of its June 1, 2012 effective date for lender-placed property insurance requirements applicable to servicers (Fannie Mae’s initial announcement was reported in InfoBytes, Mar. 16, 2012). The May 23 announcement does not provide a new effective date. Until Fannie Mae announces a new effective date, it is encouraging servicers to implement the requirements “as practically feasible.”