Appeal from the United States District Court for the Southern District of Ohio at Columbus. No. 2:06-cv-443--Michael H. Watson, District Judge.
The opinion of the court was delivered by: Ralph B. Guy, Jr., Circuit Judge.
RECOMMENDED FOR FULL-TEXT PUBLICATION
Pursuant to Sixth Circuit Rule 206
Before: GUY, and CLAY, Circuit Judges; HOOD, District Judge.*fn1
Defendant National Union Fire Insurance Company of Pittsburgh, PA, a subsidiary of AIG, Inc., appeals from the final judgment entered in favor of plaintiffs Retail Ventures, Inc., DSW Inc., and DSW Shoe Warehouse, Inc., for more than $6.8 million in stipulated losses and prejudgment interest. Plaintiffs prevailed on cross-motions for summary judgment with respect to the claim for coverage under a computer fraud rider to a "Blanket Crime Policy" for losses resulting from a computer hacking scheme that compromised customer credit card and checking account information. Defendant claims the district court erred: (1) in finding that plaintiffs suffered a loss "resulting directly from" the "theft of any Insured property by Computer Fraud"; and (2) in rejecting application of the exclusion of "any loss of proprietary information, Trade Secrets, Confidential Processing Methods or other confidential information of any kind." Plaintiffs' cross-appeal challenges the district court's rejection of the tort claim for breach of the duty of good faith and fair dealing. After review of the record and consideration of the arguments presented on appeal, the judgment of the district court is affirmed.
The circumstances surrounding the hacking incident are not at issue on appeal, although it is now known that it was part of a larger scheme led by convicted computer hacker Albert Gonzalez. Briefly, between February 1 and February 14, 2005, hackers used the local wireless network at one DSW store to make unauthorized access to plaintiffs' main computer system and download credit card and checking account information pertaining to more than 1.4 million customers of 108 stores.*fn2 Fraudulent transactions followed using the stolen customer payment information, to which plaintiffs were first alerted by one of the affected credit card companies on March 2, 2005. Plaintiffs launched an investigation that quickly revealed the data breach; National Union was notified of the insurance claim at issue; and, in April 2005, National Union, through its affiliate AIG Technical Services, Inc., advised plaintiffs that an investigation would be carried out "under a full reservation of all rights and defenses at law, in equity, and under the terms and conditions of the bond."
In the wake of the data breach, plaintiffs incurred expenses for customer communications, public relations, customer claims and lawsuits, and attorney fees in connection with investigations by seven state Attorney Generals and the Federal Trade Commission (FTC). The FTC's inquiry was resolved administratively with a consent decree requiring, inter alia, that plaintiffs establish and maintain a comprehensive information security program designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. In the Matter of DSW, Inc., No. C-4157, 2006 WL 752215 (FTC Mar. 7, 2006). The largest share of the losses--more than $4 million--arose from the compromised credit card information: namely, costs associated with charge backs, card reissuance, account monitoring, and fines imposed by VISA/MasterCard. That amount was determined by the settlement of plaintiffs' contractual obligations with credit card processor, National Processing Company, LLC (a/k/a BA Merchant Services, LLC).
Plaintiffs submitted an initial partial proof of loss and supporting information in September 2005. Defendant sent that partial claim to outside counsel for analysis of the coverage question--first to John Petro, Esq., and then to Thomas Hanlon, Esq.--before denying coverage for the reasons stated in a letter dated January 30, 2006. Petro initially opined that there was coverage under the computer fraud rider, but he later backtracked and agreed with Hanlon's assessment that the loss was excluded. Asserting that defendant's investigation was so inadequate or "one-sided" as to establish bad faith, plaintiffs point to defendant's pursuit of the second opinion from an attorney whose firm regularly provided services to AIG and Petro's explanation of how he "missed" the exclusion pointed out by Hanlon.
The January 2006 denial letter questioned the "location" of the loss; stated that the loss appeared to be excluded because it related to the theft of confidential customer information excluded by Paragraph 9 of the computer fraud rider; and added in a footnote that the policy did not cover "indirect loss" in light of Exclusion 2(m). Plaintiffs responded by disclosing additional information--including the forensic analysis of the computer breach prepared a year earlier--to defendant on April 24, 2006; submitting a supplemental partial proof of loss on May 8, 2006; and commencing this lawsuit on May 9, 2006. Defendant subsequently clarified its position, but continued to deny coverage in a letter dated May 12, 2006. That letter explained that coverage would still be excluded because the claims arose from "third party theft of proprietary confidential customer credit card information." A final proof of loss was not submitted by plaintiffs until June 29, 2007.
Plaintiffs' claims for declaratory judgment, breach of contract, and breach of the duty of good faith and fair dealing were answered by defendant's counterclaim seeking declaratory judgment in its favor. Defendant alleged that plaintiffs had not sustained loss "resulting directly from" the theft of customer information; that general exclusions in Paragraph 2(k), (m) and (n) applied; and that coverage was specifically excluded under Paragraph 9 of Endorsement 17. After discovery, cross-motions for summary judgment were filed in two waves. The district court resolved the coverage and exclusion issues in plaintiffs' favor in the opinion and order issued March 30, 2009, and rejected plaintiffs' claims of bad faith in a separate opinion and order issued September 28, 2010. Then, to resolve the issues that remained for trial without waiving the right to appeal, the parties stipulated to a summary of losses incurred by plaintiffs (minus the self-insured retention) totaling more than $5.3 million and the calculation of associated prejudgment interest in excess of $1.49 million. Judgment was entered accordingly. Defendant appealed, and plaintiffs have cross-appealed.*fn3
Summary judgment is appropriate when, viewing the factual inferences and all reasonable inferences in favor of the nonmoving party, there are no genuine issues of material fact in dispute and the moving party is entitled to judgment as a matter of law. See FED. R. CIV. P. 56(a). Our review of the district court's decision granting summary judgment is de novo. La Quinta Corp. v. Heartland Props. LLC, 603 F.3d 327, 335 (6th Cir. 2010). We apply the same standard in reviewing decisions on cross-motions for summary judgment, evaluating each motion on its own merits. Id.
In this diversity action governed by Ohio law, contract interpretation is a question of law for the court. Leber v. Smith, 639 N.E.2d 1159, 1163 (Ohio 1994). The district court correctly summarized the general principles of contract interpretation as follows:
In interpreting an insurance contract, the court is to give effect to the intent of the parties to the agreement. Hamilton Ins. Serv., Inc. v. Nationwide Ins. Cos., 86 Ohio St. 3d 270, 273 (1999), citing Employers' Liab. Assur. Corp. v. Roehm, 99 Ohio St. 343 (1919) (syllabus). Ohio courts shall give insurance contract terms their plain and ordinary meaning unless another meaning is clearly apparent from the contents of the policy. Alexander v. Buckeye Pipe Line Co., 53 Ohio St. 2d 241 (1978) (syllabus ¶ 2). Further, a court must give meaning to every paragraph, clause, phrase, and word. Affiliated FM Ins. Co. v. Owens- Corning Fiberglas Corp., 16 F.3d 684, 686 (6th Cir. 1994). When the language of a written contract is clear, a court may look no further than the writing itself to find the intent of the parties. Id. As a matter of law, a contract is unambiguous if it can be given a definite legal meaning. Westfield Ins. Co. v. Galatis, 100 Ohio St. 3d 216, 219 (2003), citing Gulf Ins. Co. v. Burns Motors, Inc., 22 S.W.3d 417, 423 (Tex. 2000).
A term is ambiguous if it is reasonably susceptible of more than one meaning. St. Mary's Foundry, Inc. v. Employers Ins. of Wausau, 332 F.3d 989, 992 (6th Cir. 2003) (citations omitted). Where the written contract is standardized and between parties of unequal bargaining power, an ambiguity in the writing will be interpreted strictly against the drafter and in favor of the non-drafting party. Cent. Realty Co. v. Clutter, 62 Ohio St. 2d 411, 413 (1980). In the insurance context, as the insurer customarily drafts the contract, an ambiguity in an insurance contract is ordinarily interpreted against the insurer and in favor of the insured. King v. Nationwide Ins. Co., 35 Ohio St. 3d 208 (1988) (syllabus). Nonetheless, this rule "will not be applied so as to provide an unreasonable interpretation of the words of the policy." Morfoot v. Stake, 174 Ohio St. 506 (1963) (syllabus ¶ 1).
We must determine how the Ohio courts would interpret the policy by looking first to Ohio law as determined by the Ohio Supreme Court, and then to all other sources. Bovee v. Coopers & ...