Landry's, Inc. v. Ins. Co. of the Pa.

Landry's, Inc. v. Ins. Co. of the Pa.

Opinion

 [*367]  Andrew S. Oldham, Circuit Judge:

The question presented is whether the Insurance Company of the State of Pennsylvania ("ICSOP") has a duty to defend its insured, Landry's, in data-breach litigation. At summary judgment, the district court said no. We disagree and reverse.

Landry's is a Houston-based company that operates retail properties like restaurants, hotels, and casinos. Paymentech, LLC—a branch of JPMorgan Chase Bank—processes Visa and MasterCard payments to those properties. A typical payment process follows the same steps: (1) [**2]  The customer presents his card to a Landry's property; (2) a point-of-sale system at Landry's sends the credit-card information to Paymentech; (3) Paymentech obtains an authorization from Visa or MasterCard and from the bank that issued the customer's credit card; and (4) the funds are collected and sent to JPMorgan Chase.

On December 2, 2015, Paymentech² discovered credit-card problems at some Landry's properties. Paymentech began an investigation, which uncovered a data breach that occurred across 14 Landry's locations between May 2014 and December 2015. Landry's then initiated its own investigation, and it discovered that the data breach involved the unauthorized installation of a program on its payment-processing devices. The program was designed to search for data from credit cards' magnetic strips—including the cardholder's name, card number, expiration date, and internal verification code—as the information was being routed through the payment-processing systems. Over approximately a year and a half, the program retrieved personal information from millions of customers' credit cards. And at least some of that credit-card information was used to make unauthorized charges.

As relevant [**3]  here, the fallout from the data breach implicated four contracts. The first two bound Paymentech to Visa and MasterCard. In its membership agreement with Visa, Paymentech agreed to participate in the Global Compromised Account Recovery ("GCAR") Program. And in its membership agreement with MasterCard, Paymentech agreed to participate in the Account Data Compromise ("ADC") Program. These programs protect Visa and MasterCard customers by requiring Paymentech to pay for data-breach-related losses. Under the GCAR Program, Visa determined that the total amount of Paymentech's liability for the data breach was $12,678,367.13. And under the ADC Program, MasterCard determined that the total  [*368]  amount of Paymentech's liability was $7,383,839.75.

Full case includes Shepard's, Headnotes, Legal Analytics from Lex Machina, and more.