The Delaware Supreme Court has re-opened the door for cyber insurers to pursue recovery of claims payments they made to their insureds who took matters into their own hands after their data hosting company allegedly failed to adequately respond to a ransomware attack.
In July 2020, a cyber attacker accessed software and data hosting firm Blackbaud Inc.’s system for several months and exfiltrated confidential customer data from its servers. The attacker threatened to publish the data unless Blackbaud paid a ransom.
After the attack, dozens of Blackbaud’s customers contended that, even though their sensitive customer