Beazley Insurance Company, Inc. v. Trustware Holdings, Inc.

• Court: Superior Court of Delaware
• Decided: March 14, 2024
• Docket: N18C-06-162 PRW CCLD
• Status: Published

Opinion

IN THE SUPERIOR COURT OF THE STATE OF DELAWARE

TRUSTWAVE HOLDINGS, INC. ) Plaintiff, ) ) v. ) ) BEAZLEY INSURANCE COMPANY, INC., ) and LEXINGTON INSURANCE COMPANY ) Defendants. ) _____________________________________ ) ) C.A. No. N18C-06-162 PRW BEAZLEY INSURANCE COMPANY, INC., ) CCLD and LEXINGTON INSURANCE COMPANY ) Counter-Plaintiffs/ ) Third-Party Plaintiffs, ) ) v. ) ) TRUSTWAVE HOLDINGS, INC., ) TRUSTWAVE CORPORATION, and ) AMBIRONTRUSTWAVE, LTD. ) Counter-Defendants/ ) Third-Party Defendants. )

Submitted: December 15, 2023 Decided: March 14, 2024

Upon Plaintiff/Counter-Defendant Trustwave Holdings and Third-Party Defendant Trustwave Corporation’s Motion for Summary Judgment, DENIED.

Upon Defendants/Counter and Third-Party Plaintiffs Beazley Insurance Company and Lexington Insurance Company’s Motion for Partial Summary Judgment, DENIED.

Upon Third-Party Defendant AmbironTrustWave, Ltd.’s Motion for Partial Summary Judgment, GRANTED. MEMORANDUM OPINION AND ORDER

Jody Barillare, Esquire (argued), Beth Herrington, Esquire (pro hac vice), Zachary Ryan Lazar, Esquire (pro hac vice), Morgan, Lewis & Bockius, LLP, Wilmington, Delaware, Attorneys for Plaintiff.

Michael C. Heyden, Esquire (argued), Scott Schmookler (pro hac vice), Gordon Rees Scully Mansukhani, LLP, Wilmington, Delaware, Attorneys for Defendants.

WALLACE, J. Before the Court are three motions for summary judgment. The largest is by

Trustwave Corporation and Trustwave Holdings, Inc. (together, “Trustwave

Entities” or “Trustwave”) and seeks resolution of all remaining issues in this case.

Next, Beazley Insurance Company and Lexington Insurance Company (together,

“Insurers”) seek summary judgment on one of their two theories, but the practical

result of granting it would be a complete win for Insurers. Finally,

AmbironTrustwave, Ltd. seeks to be released from this action, claiming it has no

connection to the underlying events.

Those underlying events culminated in the historically large breach of

non-party Heartland Payment Systems’ credit card data. As will be detailed below,

Trustwave Entities had contracted with Heartland to provide data security services.

During the period of Trustwave’s performance, a hacker was able to infiltrate

Heartland’s network and steal millions of credit card numbers. This resulted in

liability for Heartland. Insurers paid a combined $30 million for Heartland’s losses

and now seek to recover that amount from Trustwave Entities as subrogees.

Each party suggests its entitlement to a favorable judgment is undisputed.

With the exception of AmbironTrustwave, Ltd., none is correct. Indeed, despite the

cross-motions, this matter is rife with unresolved with genuine issues of material

fact.

The first such dispute relates to whether a certain contract, upon which

-1- Insurers’ motion relies, even applies. Application of that contract would require

finding Heartland exercised an option therein, which is in doubt. Too, the interplay

of a relevant limitation of liability and indemnity provision is ambiguous, deterring

summary judgment. Next, there are genuine disputes as to whether Heartland

breached an applicable contract and whether such breach was material. If so, at least

part of Trustwave Entities’ relevant performance would have been excused. Lastly,

there is the central inquiry of whether Trustwave Entities breached warranties made

to Heartland and whether that caused the losses within the meaning of the relevant

indemnity provision. As might be expected, those fact-sensitive questions are not

ripe for summary judgment.

The lone issue that does seem ready for resolution is AmbironTrustwave,

Ltd.’s motion. It claims it is a United Kingdom corporation, located in the United

Kingdom, which has never done business in the United States, and which had no

role in any of the conduct at issue here. Though they oppose the motion, Insurers

offer no true response to any of those contentions. What’s more, although

overlooked by the parties, each claim against AmbironTrustwave, Ltd. was

dismissed by this Court’s opinion on Trustwave Entities’ Motion to Dismiss. So, it

seems clear there are no genuine issues of material fact left to be decided with regard

to AmbironTrustwave, Ltd.

-2- II. FACTUAL AND PROCEDURAL BACKGROUND

A. THE PARTIES

Beazley Insurance Company is a Connecticut corporation with its principal

place of business in Connecticut.1 Its parent company is a Delaware corporation.2

Beazley is admitted to do business in Delaware and writes insurance policies that

cover risks located in Delaware.3 Lexington Insurance Company is a Delaware

corporation with its principal place of business in Massachusetts.4

Insurers insured non-party Heartland Payment Systems, a company that

facilitated credit card purchases by connecting merchants and banks.5 After

Heartland incurred a loss by having sensitive cardholder data stolen, Lexington

provided $20 million and Beazley provided $10 million to reimburse Heartland.6

Now, subrogated to Heartland’s claims, Insurers seek recovery from Trustwave

Entities.7

Trustwave Holdings, Inc. is a Delaware corporation with its principal place of

1 Insurers’ Answer to the Complaint [hereinafter “Answer to Compl.”] ¶ 3 (D.I. 42). 2 Answer to Compl. ¶ 3. 3 Id. ¶ 3. 4 Id. ¶ 4. 5 Insurers’ Counterclaim and Third-Party Complaint [hereinafter “Countercl.”] ¶ 52 (D.I. 42); Insurers’ Motion for Summary Judgment Opening Brief [hereinafter “Insurers’ Mot.”] at 1 (D.I. 147); Insurers’ Mot., Ex. 4 [hereinafter “Humphrey Expert Report”] ¶ 9. 6 Countercl. ¶¶ 53-54; Insurers’ Mot., Ex. 7 [hereinafter “Cybertrust Report”] at 4. 7 Countercl. ¶ 55.

-3- business in Illinois.8 Trustwave Holdings, Inc. was formed in 2005 to effectuate the

merger of Trustwave Corporation and Ambiron, LLC.9 Trustwave Holdings Ltd., a

subsidiary of Trustwave Holdings, Inc., is a United Kingdom corporation with its

principal place of business in the United Kingdom.10 Trustwave Holdings Ltd. was

formerly known as AmbironTrustwave, Ltd.11

Trustwave Entities provided data security services to Heartland during the

period when Heartland suffered its data breach.12 Following Insurers’

reimbursement of Heartland, they demanded indemnification from Trustwave

Entities.13 Thereafter, Trustwave Holdings, Inc., filed its complaint seeking a

declaratory judgment that it is not liable to Insurers.14

B. HEARTLAND’S CONTRACTS WITH TRUSTWAVE ENTITIES

Heartland had three contracts with Trustwave Entities that are relevant to this

litigation. The first is an agreement Ambiron LLC and Heartland entered into in

8 Trustwave Entities’ Answer to the Counterclaim [hereinafter “Answer to Countercl.”] ¶ 3 (D.I. 60). 9 Answer to Countercl. ¶ 4. 10 Id. ¶¶ 5-6. 11 Id. ¶5. 12 Id. ¶11. 13 Id. ¶15. 14 See generally Complaint [hereinafter “Compl.”] (D.I. 1).

-4- October 2004 (the “2004 Agreement”).15 The purpose of that agreement was for

Ambiron—which later became part of Trustwave Holdings, Inc.—“to validate

[Heartland’s] compliance with the data security regulations of the credit card

associations.”16 A central fixture of the 2004 Agreement was Ambiron’s obligation

to provide monthly “vulnerability scans” of Heartland’s systems.17 Those scans used

proprietary technology to detect potential vulnerabilities in Heartland’s network and

thereby ensure compliance with the data security regulations imposed by Visa,

MasterCard, and Discover.18 Importantly, Ambiron did not agree to indemnify

Heartland under this agreement.19 The 2004 Agreement had an initial term of three

years and provided for automatic renewal.20

The next relevant contract is one between Trustwave Corporation and

Heartland that was entered into in February 2005 (the “2005 Agreement”).21 This is

the agreement upon which Insurers base their summary judgment motion and is the

subject of much dispute.22 The 2005 Agreement—self-titled the “Trustwave

15 Trustwave Entities’ Brief in Opposition to Insurers’ Motion for Summary Judgment [hereinafter “Trustwave Opp’n Br.”], Ex. 4 [hereinafter “2004 Agreement”] (D.I. 171). 16 2004 Agreement at 3. 17 Id. at 7, 9. 18 Id. at 4, 6-7. 19 See id. at 15-16. 20 Id. at 15. 21 Trustwave Opp’n Brief, Ex. 6 [hereinafter “2005 Agreement] (D.I. 171). 22 See Insurer’s Mot. at 2.

-5- Preferred Sales Agent Agreement”—is primarily an agreement for Heartland to refer

clients to Trustwave in exchange for a commission.23 But some language in it

suggests Heartland itself would become a Trustwave client by virtue of the

agreement.24 Still other language suggests Heartland merely retained the option to

engage Trustwave’s services25—leading to the parties’ dispute.

The 2005 Agreement does describe Trustwave’s services, but in considerably

less detail than the 2004 Agreement.26 Trustwave warranted it would perform its

services “using reasonable care and skill.”27 Of note, and unlike the 2004

Agreement, the 2005 Agreement provides that Trustwave would indemnify

Heartland for losses “arising out of or connected with any third party claim relating

to” “TrustWave’s breach of any representation or warranty.”28 This agreement had

an initial term of one year and provided for automatic renewal.29

Lastly, there is the contract Trustwave Holdings, Inc., and Heartland entered

23 See 2005 Agreement at 1-4 (all capitals in original). 24 Id. at 3 (“during the Term TrustWave will provide to [Heartland] the services (the ‘TrustWave Services’)”). 25 Id. (“Should [Heartland] elect to utilize any of the TrustWave Services for its own internal use . . . .”). 26 Compare 2005 Agreement at 1-2 with 2004 Agreement at 6-13. 27 2005 Agreement at 3, 4. 28 Id. at 8-9. 29 Id. at 6.

-6- into in December 2007 (the “2007 Agreement”).30 This agreement was presented

by Trustwave to Heartland in October 2007, which corresponds to the end of the

2004 Agreement’s initial term.31 Similarly to the 2004 Agreement, the 2007

Agreement focuses on Trustwave providing its “Compliance Validation Service” to

Heartland.32 That service included conducting monthly vulnerability scans,

providing a “Compliance Validation Report” to document non-compliance with the

applicable standards and suggest remedies, and issuing a “Report on Compliance”

(“ROC”) once Heartland achieved full compliance.33 This description of

Trustwave’s services was again much more detailed than what is contained in the

2005 Agreement.34

The 2007 Agreement also contained an indemnification provision for any

costs “arising out of or relating to” “claims or suits attributable to breaches of the

other party’s express representations and warranties.”35 Trustwave warranted that it

would perform its services “in a professional and workmanlike manner.”36 This

contract also contained a limitation of liability, stating Trustwave would only be

30 Trustwave Opp’n Brief, Ex. 7 [hereinafter “2007 Agreement] (D.I. 171). 31 2007 Agreement cover page; 2004 Agreement at 15. 32 Id. at 3-8. 33 Id. at 3-5, 7. 34 Compare 2007 Agreement at 3-8 with 2005 Agreement at 1-2. 35 2007 Agreement at 9-10. 36 Id. at 9.

-7- liable for its gross negligence, would only be liable up to the amount of fees paid by

Heartland, and would “in no event . . . be liable for any special, indirect, exemplary,

incidental or consequential losses or damages.”37 This agreement had an initial term

of three years and provided for automatic renewal.38

C. DATA BREACH AND INSURERS’ PAYMENTS

To maintain the security of the payment card data it processed, Heartland’s

computer network was bifurcated.39 One part of the system was unsecured and only

used for standard business tasks, such as email.40 The other side was secured and

only used for processing the sensitive data.41 As described in the relevant industry

standards—the Payment Card Industry Data Security Standard (“PCI DSS”)—

segregating the portions of a company’s network that contain sensitive data is critical

because “seemingly insignificant paths to and from the Internet can provide

unprotected pathways into key systems.”42 Indeed, installing and maintaining a

“firewall” to separate publicly accessible servers from the secured network was the

37 Id. at 9 (all capitals in original). 38 Id. at 10. 39 Trustwave Holdings, Inc., and Trustwave Corporation’s Motion for Summary Judgment Opening Brief [hereinafter Trustwave’s Mot.] (D.I. 149), Ex. 3 [hereinafter “Sims Dep.”] at 108 (D.I. 160). 40 Sims Dep. at 108. 41 Id. 42 Trustwave’s Mot., Ex. 22 [hereinafter “PCI DSS 1.1”] at 3 (D.I. 164).

-8- first requirement of the PCI DSS.43 It was a failure of this network segregation that

led to the eventual data theft.44

The digital heist began in late 2007.45 In July of that year, an application

called Payroll Manager, which was housed in the unsecured side of Heartland’s

network, became vulnerable to attack.46 Specifically, Payroll Manager became

susceptible to an “SQL Injection”—an attack that imparts malware by taking

advantage of weaknesses in “public facing information input fields on a web

application such as the ‘First Name’ field.”47 In late December 2007, a hacker

injected malware through Payroll Manager and Heartland detected the malicious

activity in less than two days.48 Although Heartland acted “quickly and aggressively

to scope and contain the incident,” its efforts fell short.49 Remnants of the SQL

attack’s malware “remained unnoticed during the entire time-frame between

December 2007 through January 2009.”50

The SQL injection affecting the corporate side of Heartland’s network wasn’t

43 PCI DSS 1.1 at 3-4. 44 Cybertrust Report at 15. 45 Id. at 17. 46 Id. 47 Id. 48 Id. at 18. 49 Id. at 19, 21. 50 Id. at 21.

-9- able to steal the payment card data on its own, though. Instead, the hackers needed

access to the payment card network. That access was provided by at least three

digital bridges between the two networks: (1) a “dual VPN connection between the

[Heartland] corporate and [Heartland] processing environments” set up by

Heartland’s Chief Technology Officer, Alan Sims; (2) a “server sitting on the

corporate [Heartland] network whose function is to connect to merchant POS

devices in the field for the purpose of passing install software and firmware updates”;

and, (3) another corporate-network server meant to support “service and help desk

requests and functionality” that “maintained the ability to connect to the production

payment environment.”51 The eventual investigation into the data breach revealed

those connections “could have acted as conduits” to steal the card data from the

secured environment.52 The “earliest known date” of the network’s payment

processing side being infiltrated via one of those connections is May 14, 2008.53

In summary, a hacker injected malware onto the corporate side of Heartland’s

network through Payroll Manager. That malware then migrated to the payment

processing side of the network through connections between the ostensibly separate

networks. Once it infected the payment processing side, the malware enabled the

51 Id. at 22. 52 Id. at 22. 53 Id. at 21.

-10- hacker to capture and exfiltrate cardholder data.

On October 27, 2008, Visa contacted Heartland about reported fraud that

suggested a data breach.54 The breach was “effectively closed” two days later.55 In

December 2008, Verizon Business was retained to conduct a forensic examination,

leading to the Cybertrust Report.56 By January 2009, Heartland confirmed the data

breach and notified the card companies and law enforcement.57 In all, more than 88

million card numbers were stolen before the breach was contained.58 Naturally,

litigation ensued.

The details of Heartland’s array of extensive liabilities aren’t particularly

relevant to this matter. Suffice it to say, Heartland’s losses far exceeded Insurers’

combined limit of $30 million. So, Lexington and Beazley each paid up to their

limits—$20 million and $10 million, respectively.59 That is the sum Insurers seek

now that they are subrogated to Heartland’s claims.60

D. TRUSTWAVE ENTITIES’ SERVICES TO HEARTLAND

Though the parties dispute which contract applied when, there is no dispute

54 Id. at 4. 55 Id. at 5. 56 Id. at 4. 57 Id. at 4. 58 Insurers’ Mot., Ex. 10 [hereinafter “Visa Qualification Summary”] at 9 (D.I. 147). 59 Compl. ¶ 26; Countercl. ¶¶ 53-54. 60 Countercl. ¶¶ 93-95, 105-07, 192-94.

-11- that Trustwave Entities were responsible for Heartland’s data security compliance

during the period when its systems were infiltrated. In that role, Trustwave had two

primary responsibilities relevant to this litigation: (1) performing “vulnerability

scans” of Heartland’s systems at least quarterly; and (2) annually ensuring

Heartland’s compliance with the PCI DSS requirements.61 These are the services

Trustwave Entities failed to perform adequately thus triggering indemnification,

Insurers say.62

1. Vulnerability Scans

One requirement of the PCI DSS is vulnerability scans performed by an

approved scan vendor (“ASV”) at least once per quarter.63 Simply put, these scans

consist of the ASV using its automated “scanning tool,” which must first be

approved by the PCI Security Standards Council (“PCI SCC”), to look for potential

weaknesses in a secure system.64 Insurers specifically challenge the scans performed

in August and September 2007 because those scans occurred while Payroll Manager

was vulnerable to attack but before the vulnerability had been exploited.65 Insurers

61 See Trustwave’s Mot., Ex. 30 [hereinafter “2007 ROC”], Ex. 32 [hereinafter “2008 ROC”] (D.I. 164). 62 Insurers’ Brief in Opposition to Trustwave Holdings, Inc. and Trustwave Corporation’s Motion for Summary Judgment [hereinafter “Insurer’s Opp’n to Trustwave”] at 1-2. (D.I. 170). 63 Trustwave’s Mot., Ex. 23 [hereinafter “PCI Security Audit Procedures 1.1”] at 39-40 (D.I. 164). 64 See Trustwave’s Mot., Ex. 1 [hereinafter “Leach Report”] ¶ 95 (D.I. 150). 65 Insurers’ Mot. at 10.

-12- argue these scans were performed under the 2005 Agreement,66 but Trustwave

Entities contend they were performed under the 2004 Agreement.67

An initial step in the scanning procedure—and one key to this dispute—is

setting the scope of the scan.68 In short, only the parts of the network that are

connected to the payment processing activities need to be part of the scan.69 Because

Payroll Manager and the rest of the corporate network was supposed to be

completely separate from the payment processing environment, it was not included

in the vulnerability scans.70 The failure to scan Payroll Manager and catch the SQL

vulnerability therein is the primary basis of Insurers’ summary judgment motion.

Regarding the obligation to correctly set the scope of the scan the PCI Security

Scanning Procedures state:

Merchants and service providers have the ultimate responsibility for defining the scope of their PCI Security Scan, though they may seek expertise from ASVs for help. If an account data compromise occurs via an IP address or component not included in the scan, the merchant or service provider is responsible.71

Nonetheless, Insurers’ expert, Andrew Valentine, opined that “[c]ompliance with

66 Id. at 7-8. 67 Trustwave Opp’n Br. at 2-3. 68 Trustwave Opp’n Br., Ex. 2 [hereinafter “PCI Security Scanning Procedures”] at 1-2 (D.I. 171). 69 PCI Security Scanning Procedures at 1-2; see also Leach Report ¶ 98. 70 Insurers’ Mot., Ex. 2-A [hereinafter “Valentine Report”] ¶ 78 (D.I. 147). 71 PCI Security Scanning Procedures at 2.

-13- PCI DSS standards required Trustwave to properly scope Heartland’s network,

identify the connection between the corporate environment and pay[ment]

processing environment, and scan in[-]scope systems.”72

Separately from the scope of the scans, the parties are also at odds on the effect

that including Payroll Manager in the scans would have had. Specifically,

Mr. Valentine opined that including Payroll Manager in the scans “would have

enabled Heartland to uncover the vulnerability in the Payroll [M]anager in August

or September 2007—prior to the exploitation of the vulnerability in December

2007.”73 Trustwave Entities, meanwhile, argue a scan of Payroll Manager still might

not have caught the vulnerability.74 They point to deposition testimony by a

Trustwave employee, Thomas Leavey, who said a vulnerability scan “may or may

not catch” an “SQL injection issue.”75 Further, according to a disclaimer in the

August 2007 scan report: “it is usually only possible to fully validate [SQL]

vulnerabilities in a test or QA environment.”76

72 Valentine Report ¶ 78. 73 Id. ¶ 79. 74 Trustwave Opp’n Br. at 15-16. 75 Trustwave Opp’n Br., Ex. 16 [hereinafter “Leavey Dep.”] at 109-11 (D.I. 171). His testimony explained that certain SQL vulnerabilities are the result of application-specific coding errors that the automated scanning tool is not designed to detect. 76 Trustwave Opp’n Br., Ex. 18 [hereinafter “Aug. 2007 Scan Report”] at 9 (D.I. 171).

-14- 2. 2008 Report on PCI DSS Compliance

The second Trustwave service Insurers challenge is the ROC issued in April

2008.77 In a rare instance of consensus between the parties, they both acknowledge

this work was done pursuant to the 2007 Agreement.78 The purpose of the ROC is

simple: document Heartland’s compliance with the twelve sets of PCI DSS

requirements.79 To do so, Trustwave conducted remote and on-site investigations

into Heartland’s systems, starting in January 2008.80 In the process, Trustwave

interviewed eighteen Heartland employees and reviewed seventeen Heartland

documents, such as Heartland’s applicable policies and procedures.81

An ROC is limited in terms of its goals. As explained by Insurers’ expert,

Mr. Valentine, the ROC is only meant to determine whether a company is complying

with the specific PCI DSS requirements.82 It is not meant to ensure that the

company’s network is actually secure.83 According to Mr. Valentine, “security is

not a thing you can validate.”84 This subtle but important distinction is reflected in

77 Insurers’ Mot. at 2. 78 Id. at 7-8; Trustwave’s Mot. at 19. 79 Trustwave’s Mot., Ex. 32 [hereinafter “2008 ROC”] at 1-2 (D.I. 164). 80 2008 ROC at 7. 81 Id. at 14-15. 82 Trustwave’s Mot. Ex. 13 [hereinafter “Valentine Dep.”] at 66-68 (D.I. 164). 83 Valentine Dep. at 66-68. 84 Id. at 68.

-15- industry documents. For example, each page of Visa’s “List of Compliant Service

Providers” comes with the disclaimer: “PCI DSS assessments represent only a

‘snapshot’ of security in place at the time of the review, and do not guarantee that

those security controls remain in place after the review is complete.”85 Relatedly,

the 2007 Agreement notes, “use of Trustwave’s services does not guarantee PCI

compliance or that [Heartland]’s systems are secure from unauthorized access.”86

Even the 2008 ROC itself states, “[Heartland] acknowledges that completion of the

PCI assessment and a finding of compliant will not prevent a compromise of

cardholder data on any of [Heartland]’s systems.”87

The ROC was initially completed in March 2008 but was updated the next

month.88 Notably, its preparation took place in the months between Heartland’s

discovery of the SQL injection and the malware’s first appearance on the network’s

payment processing side. Despite Heartland’s knowledge of malware having been

injected through Payroll Manager in December 2007, that event wasn’t fully

disclosed to Trustwave. Rather, according to an internal Trustwave email, Heartland

recounted the incident as Heartland having simply discovered a vulnerability—as

85 Trustwave’s Mot, Ex. 25 (D.I. 164). 86 2007 Agreement at 10. 87 2008 ROC at 2. 88 Id. at cover page, 3

-16- opposed to an exploitation thereof—on its own.89 This is relevant because Heartland

was contractually obligated to notify Trustwave of “any suspected breach of [its]

systems.”90 The parties dispute whether the unreported malware injection

constituted a “suspected breach.” According to both Mr. Valentine and a Trustwave

employee, evidence of a breach would have been treated with much more diligence

than evidence of a mere vulnerability.91

Additionally, there is the issue of the ROC’s purported recognition of a

connection between the corporate and payment processing realms of Heartland’s

network. In an appendix to the 2008 ROC, there are “Compensating Control”

worksheets.92 As described in the PCI DSS, a compensating control is an alternative

risk-mitigation strategy used “when an entity cannot meet a technical specification

of a [PCI DSS] requirement.”93 Three of the compensating control descriptions

reference access to the payment processing network using a VPN that required two-

factor authentication.94 Insurers rely on statements from their own expert,

Mr. Valentine, and Trustwave’s expert, Troy Leach, to establish that the referenced

89 Trustwave’s Mot., Ex. 33. 90 2007 Agreement at 10. 91 Trustwave’s Mot., Ex. 34 [hereinafter “Skipper Dep.”] at 305 (D.I. 164); Valentine Dep. at 254-59. 92 2008 ROC at 120-24. 93 PCI DSS 1.1 at 16. 94 2008 ROC at 121-23

-17- VPN connection brought Heartland’s malware-infected corporate network into the

scope of the ROC assessment.95 Mr. Valentine opined that Trustwave’s failure to

account for the VPN connection’s effect on the adequacy of Heartland’s network

segmentation meant the 2008 ROC fell below the standard warranted in the 2007

Agreement.96

A quasi-judicial decision by Visa assessing Heartland’s liability under

corporate regulations determined non-compliance with the PCI DSS requirements

led to the data theft.97 That conclusion was based upon the findings of the Cybertrust

Report that was prepared following Verizon Business’s investigation.98 Most

relevant to this litigation, Visa found Payroll Manager’s vulnerability to SQL

injections and the VPN connections between the corporate and payment processing

portions of Heartland’s network violated the PCI DSS.99 Visa rejected Heartland’s

contention that the 2008 ROC proved compliance, noting the Cybertrust Report

consisted of a more thorough investigation than the 2008 ROC.100 Mr. Valentine,

who was involved in the Cybertrust investigation, explained that a forensic

95 Valentine Report ¶¶ 43-44; Insurers’ Opp’n to Trustwave, Ex. 2 [hereinafter “Leach Dep.”] at 140-57 (D.I. 147). 96 Valentine Report ¶ 44. 97 Insurers’ Opp’n to Trustwave, Ex. 12 [hereinafter “Visa’s Appeal Response”] at 17-28 (D.I. 172). 98 Visa’s Appeal Response at 17. 99 Id. at 18. 100 Id. at 19.

-18- investigation is a “[c]ompletely different analysis” than an ROC assessment and

“[u]ses different tools to answer a different question.”101

Also of note, the workpapers used in the preparation of the 2008 ROC were

not preserved for use in this litigation.102 Trustwave kept the documents during the

predicate litigation against Heartland,103 but that resolved in March 2015.104 By the

time Insurers sent their demand letter in February 2018,105 Trustwave had discarded

the workpapers.106 Consequently, Insurers now seek a spoliation inference in their

favor.107

E. PROCEDURAL HISTORY

After receiving a letter from Insurers demanding indemnification, Trustwave

Holdings, Inc. filed its complaint seeking a declaratory judgment.108 It sought

declarations that: (1) the 2007 Agreement is the agreement applicable to this dispute;

(2) the statute of limitation bars counterclaims by Insurers; and, (3) it is not liable

101 Valentine Dep. at 286, 296. 102 Trustwave’s Mot. at 22. 103 Trustwave Holdings, Inc., and Trustwave Corporation’s Reply Brief in Support of their Motion for Summary Judgment [hereinafter “Trustwave’s Reply Br.”] at 24-25 (D.I. 180). 104 Answer to Compl. ¶ 15; Trustwave’s Reply Br. at 24. 105 Answer to Compl. ¶ 15. 106 Trustwave’s Mot. at 22. 107 Insurers’ Opp’n to Trustwave at 30-32. 108 Compl. ¶¶ 5, 19-34.

-19- for a breach of the 2007 Agreement.109

Insurers initially moved to dismiss the Complaint but withdrew that motion

and instead filed an Answer.110 Accompanying Insurers’ Answer were

counterclaims against Trustwave Holdings, Inc., and third-party claims against

Trustwave Corporation and AmbironTrustwave, Ltd.111 In all, Insurers level 18

counts against Trustwave Entities.112 Insurers’ claims were based on: (1) breach of

contract; (2) breach of express warranty; (3) breach of contractual indemnification;

(4) negligent misrepresentation; and (5) gross negligence.113 In an earlier opinion

the Court dismissed all of Insurers’ non-indemnification claims as barred by the

statute of limitations.114 Accordingly, the only remaining issue is whether Trustwave

Entities are liable for indemnification under either the 2005 or 2007 Agreement.115

Now, each party has moved for at least partial summary judgment. Trustwave

Holdings, Inc., and Trustwave Corporation moved for summary judgment on all

remaining counts.116 AmbironTrustwave Ltd. incorporated that larger motion by

109 Id. ¶¶ 19-34. 110 Insurers’ Notice of Withdrawal at 1 (D.I. 41); Answer to Compl. ¶¶ 1-34. 111 Countercl. ¶¶ 1-234. 112 Id. ¶¶ 60-234. 113 Id. ¶¶ 60-234. 114 Trustwave Hldgs., Inc. v. Beazley Ins. Co., 2019 WL 4785866 (Del. Super. Ct. Sept. 30, 2019). 115 Insurers did not seek indemnity under the 2004 Agreement, presumably because Ambiron did not agree to indemnify Heartland under that contract. 116 Trustwave’s Mot. at 1.

-20- reference and separately moved for partial summary judgment as to any claims

against it.117 Insurers moved for summary judgment on its indemnity claim under

the 2005 Agreement but not the 2007 Agreement.118

III. APPLICABLE LEGAL STANDARDS

Summary judgment is warranted “if the pleadings, depositions, answers to

interrogatories, and admission on file, together with the affidavits” show “there is

no genuine issue as to any material fact and that the moving party is entitled to

judgment as a matter of law.”119 The movant bears the initial burden of proving its

motion is supported by undisputed facts.120 If the movant meets its burden, the non-

movant must show there is a “genuine issue for trial.”121 To determine whether a

genuine issue exists, the Court construes the facts in the light most favorable to the

non-movant.122

117 AmbironTrustwave, Ltd.’s Motion for Summary Judgment Opening Brief [hereinafter “AmbironTrustwave’s Mot.”] at 1 (D.I. 141). Though not mentioned in its brief, it is explained below that all claims against AmbironTrustwave, Ltd., appear to have already been dismissed. The indemnification claim in Insurers’ Third-Party Complaint does not reference AmbironTrustwave, Ltd., and all the non-indemnification claims were dismissed. See Countercl. ¶¶ 185-94; Trustwave Hldgs, 2019 WL 4785866, at *11. 118 Insurers’ Mot. at 1. 119 Del. Super. Ct. Civ. R. 56(c); see also Options Clearing Corp. v. U.S. Specialty Ins. Co., 2021 WL 5577251, at *7 (Del. Super. Ct. Nov. 30, 2021). 120 Options Clearing Corp., 2021 WL 5577251, at *7 (citing Moore v. Sizemore, 405 A.2d 679, 680 (Del. 1979)). 121 Del. Super. Ct. Civ. R. 56(e); see also Brzoska v. Olson, 668 A.2d 1355, 1364 (Del. 1995) (“If the facts permit reasonable persons to draw but one inference, the question is ripe for summary judgment.”). 122 Judah v. Del. Tr. Co., 378 A.2d 624, 632 (Del. 1977).

-21- The “Court may not be able to grant summary judgment ‘if the factual record

has not been developed thoroughly enough to allow the Court to apply the law to the

factual record.’”123 Similarly, summary judgment will not be granted “where it

seems prudent to make a more thorough inquiry into the facts.”124 But “[i]f the Court

finds that no genuine issues of material fact exist, and the moving party has

demonstrated [its] entitlement to judgment as a matter of law, then summary

judgment is appropriate.”125

“These well-established standards and rules apply in full when the parties

have filed cross-motions for summary judgment.”126 If such cross-motions have

been filed “and neither party argues the existence of a genuine issue of material fact,

‘the Court shall deem the motions to be the equivalent of a stipulation for decision

on the merits based on the record submitted with the motions.’”127 But if genuine

123 Radulski v. Liberty Mut. Fire Ins. Co., 2020 WL 8676027, at *4 (Del. Super. Ct. Oct. 28, 2020) (quoting CNH Indus. Am. LLC v. Am. Cas. Co. of Reading, 2015 WL 3863225, at *1 (Del. Super. Ct. June 8, 2015)). 124 Zenith Energy Terminals Joliet Hldgs. LLC v. CenterPoint Props. Tr., 2023 WL 615997, at *8 (Del. Super. Ct. Jan. 23, 2023) (first citing Ebersole v. Lowengrub, 180 A.2d 467, 470-72 (Del. 1962); and then citing Pathmark Stores, Inc. v. 3821 Assocs., L.P., 663 A.2d 1189, 1191 (Del. Ch. 1995)). 125 Brooke v. Elihu-Evans, 1996 WL 659491, at *2 (Del. Aug. 23, 1996) (citing Oliver B. Cannon & Sons, Inc. v. Dorr-Oliver, Inc., 312 A.2d 322 (Del. Super. Ct. 1973)); see also Jeffries v. Kent Cty. Vocational Tech. Sch. Dist. Bd. of Educ., 743 A.2d 675, 677 (Del. Super. Ct. 1999) (“[A] matter should be disposed of by summary judgment whenever an issue of law is involved and a trial is unnecessary.” (citing State ex. rel. Mitchell v. Wolcott, 83 A.2d 759, 761 (Del. 1951))). 126 Radulski, 2020 WL 8676027, at *4 (collecting cases); see also Zenith Energy, 2023 WL 615997, at *8. 127 Zenith Energy, 2023 WL 615997, at *8 (quoting Del. Super. Ct. Civ. R. 56(h)).

-22- issues of material fact persist despite the cross-motions, “summary judgment is not

appropriate.”128 “To determine whether there is a genuine issue of material fact, the

Court evaluates each motion independently.”129

IV. PARTIES’ CONTENTIONS

Trustwave Entities wage a multi-fronted attack in their quest for summary

judgment. As an opening volley, they claim the 2007 vulnerability scans were

performed under the 2004 Agreement—which had no indemnity provision—and so

the 2005 Agreement is inapplicable to this litigation.130 As for the 2007 Agreement,

under which the 2008 ROC was performed, they make four main arguments: first,

that there is no contractual basis for indemnification because the 2007 Agreement

disclaimed any guarantee of security and limited liability for indirect damages;

second, there is no evidence that they breached a representation or warranty; third,

Heartland’s failure to remediate its vulnerabilities after learning of the SQL injection

in December 2007 broke the causal chain between Trustwave’s allegedly deficient

performance and Heartland’s losses; and fourth, Heartland materially breached the

2007 Agreement by withholding the details of the SQL injection, so Trustwave’s

128 Id. (collecting cases). 129 Id. (citing Motors Liquidation Co. DIP Lenders Tr. V. Allianz Ins. Co., 2017 WL 2495417, at *5 (Del. Super. Ct. June 19, 2017), aff’d sub nom., Motors Liquidation Co. DIP Lenders Tr. v. Allstate Ins. Co., 191 A.3d 1109 (Del. 2019)). 130 Trustwave’s Mot. at 13-14, 17-18.

-23- further performance was excused.131

In countering, Insurers basically take the opposite position on all of

Trustwave’s arguments. They say the 2007 Agreement’s limitation of liability is

belied by that contract’s indemnity provision and, alternatively, is unenforceable.132

They claim there is a triable question of fact as to the “professional and workmanlike

manner” of Trustwave’s preparation of the 2008 ROC and that any such deficiency

was a cause of the data theft because the ROC was completed prior to any data

exfiltration.133 They also maintain Heartland was not obligated to report the malware

injection because it did not qualify as a “suspected breach,” and even if Heartland

was obligated to do so, that contractual breach was immaterial.134 But above all,

they argue the 2007 scans occurred under the 2005 Agreement—whose limitation of

liability carved out indemnity obligations—and were deficient, entitling them to

indemnification under that contract and obviating all of Trustwave Entities’ other

arguments.135

Insurers moved for summary judgment on the two counts from their

counterclaims and third-party complaint related to the 2005 Agreement.136

131 Id. at 3-4. 132 Insurers’ Opp’n to Trustwave at 3. 133 Id. at 26-28 134 Id. at 33-40. 135 Id. at 2-3. 136 Insurers’ Mot. at 1.

-24- Unsurprisingly, their argument in support thereof is essentially the same as their

most vociferous argument in opposition to Trustwave Entities’ motion.137

Specifically, they claim Trustwave cannot demonstrate a material dispute of fact as

to the reasonableness of the 2007 vulnerability scans because Trustwave doesn’t

have expert testimony on that point.138 Their argument centers on the allegedly

improper scope of the scans—i.e., not scanning Payroll Manager.139 Insurers also

say that the 2005 Agreement doesn’t have a limitation of liability and that the 2007

Agreement’s limitation does not apply to the vulnerability scans.140

Trustwave Entities respond to Insurers’ motion in four ways. First, they

reiterate their argument that the vulnerability scans occurred under the 2004

Agreement, not the 2005 Agreement.141 Next, they cite the PCI DSS Security

Scanning Procedures to refute Insurers’ expert’s claim that Trustwave was

responsible for ensuring the proper scope of the scans.142 They also say there is no

evidence Payroll Manager needed to be within the scope of the scans at the time the

scans were performed.143 And lastly, they insist there is no causation between the

137 Id. at 2-4. 138 Id. at 3-4. 139 Id. at 11-12. 140 Id. at 22-24 141 Trustwave’s Opp’n at 2-3. 142 Id. at 3. 143 Id. at 4.

-25- allegedly deficient scans and the data theft because scanning Payroll Manager might

not have caught the vulnerability and, in any event, Heartland independently learned

of the vulnerability but still failed to fix the problem.144

Finally, there is AmbironTrustwave, Ltd.’s comparatively simple motion.

According to AmbironTrustwave, Ltd., it was named as a third-party defendant in

error “based on a case of mistaken identity.”145 That entity says it is a United

Kingdom corporation that works exclusively in Europe.146 It believes Insurers

confused it with a d/b/a registered to Trustwave Holdings, Inc.147 That registered

d/b/a is AmbironTrustWave—without “Ltd.”148 AmbironTrustwave, Ltd.,

maintains it has “never done business in the United States,” let alone with

Heartland.149

Undeterred, Insurers oppose AmbironTrustwave, Ltd.’s motion. But Insurers

do little—indeed, nothing—to counter AmbironTrustwave, Ltd.’s argument.

Insurers’ brief doesn’t reference the United Kingdom, doesn’t mention the “d/b/a”

issue, and wholly ignores any notion of a mistaken identity. Instead, Insurers point

to the repeated use of “AmbironTrustWave”—never with the distinguishing

144 Id. at 4-5. 145 AmbironTrustwave’s Mot. at 1. 146 Id. at 2. 147 Id. at 3. 148 Id. 149 Id.

-26- “Ltd.”—and claim that as proof of AmbironTrustwave, Ltd.’s involvement with the

Heartland services.150

V. DISCUSSION

A. THERE REMAINS A GENUINE DISPUTE OF MATERIAL FACT AS TO WHETHER THE 2005 AGREEMENT IS APPLICABLE.

A threshold issue in this litigation is determining whether the 2005 Agreement

governed the vulnerability scans done in August and September 2007. If it did,

Insurers’ central argument might be viable. If it didn’t, the 2007 vulnerability scans

become irrelevant because they would have been performed under the 2004

Agreement, which did not provide for indemnification. The parties differ as to

whether Heartland exercised an option it had under the 2005 Agreement to have

Trustwave perform its services under that contract. Insurers’ evidence is light on this

point, but it is not so insubstantial that summary judgment is appropriate.

1. The 2005 Agreement Provided Heartland With an Option to Engage Trustwave’s Services.

There are two requirements for an option: an underlying offer and a promise

to hold that offer open.151 Unless otherwise provided for in the agreement,

“acceptance [of an option] ‘may be made in words or by other symbols of assent, or

150 Insurers’ Brief in Opposition to AmbironTrustwave, Ltd.’s Motion for Summary Judgment [hereinafter “Insurer’s Opp’n to AmbironTrustwave”] at 1-3 (D.I. 169). 151 Walsh v. White House Post Prods., LLC, 2020 WL 1492543, at *5 (Del. Ch. Mar. 25, 2020) (citing 1 Williston on Contracts § 5:15 (4th ed. 1993)).

-27- it may be implied from conduct.’”152 In this instance, both requirements for an

option are contained in the 2005 Agreement, but evidence of subsequent acceptance

is missing.

The underlying offer contemplated in the 2005 Agreement is the provision of

the “TrustWave Services,” as defined in the Recitals, which includes “vulnerability

scans.”153 This offer and the promise to hold it open is evident in three provisions

of the 2005 Agreement. First, one of the “whereas” clauses in the Recitals states,

“TrustWave desires to provide, and [Heartland] may desire to receive for its own

internal use, the TrustWave Services.”154 Next, and most notably, Section 1(c) of

the 2005 Agreement provides, “[s]hould [Heartland] elect to utilize any of the

TrustWave Services for its own internal use as determined at [Heartland]’s sole

discretion, [Heartland] will pay the applicable fees and expenses set for in Exhibit

B.”155 In addition, with regard to the promise to hold the offer open, Section 1(a) of

the agreement states, “[s]ubject to the terms and conditions of this Agreement,

during the Term TrustWave will provide to [Heartland] the services (the ‘TrustWave

Services’).”156

152 Walsh, 2020 WL 1492543, at *6 (quoting Restatement (Second) of Contracts § 50 cmt. c.). 153 2005 Agreement at 1-2. 154 Id. at 2 (emphasis added). 155 Id. at 3. 156 Id. (emphasis added).

-28- In arguing that the 2005 Agreement governs the 2007 vulnerability scans,

Insurers emphasize the “will provide . . . the services” language.157 But reading that

provision to automatically require the rendering of Trustwave’s services to

Heartland ignores the language about Heartland “elect[ing] to utilize any of the

TrustWave Services . . . at [its] sole discretion.” Of course, contractual provisions

should neither be read in isolation nor be read to render other contractual language

meaningless.158 The only way to give meaning to the election language of Section

1(c) is to deem the offer of services an option.

Additionally, Insurers cite the 2005 Agreement’s integration clause to suggest

that the 2004 Agreement was repudiated—meaning, in their view, the scans could

only have been performed under the 2005 Agreement.159 But that argument is belied

by the relevant chronology. The 2004 Agreement was entered into with Ambiron,

LLC before it merged with Trustwave Corporation.160 The 2005 Agreement was

entered into with Trustwave Corporation in February 2005—approximately one

157 Insurers’ Mot. at 8. 158 Sunline Com. Carriers, Inc. v. CITGO Petrol. Corp., 206 A.3d 836, 846 (Del. 2019) (“The contract must . . . be read as a whole, giving meaning to each term and avoiding an interpretation that would render any term ‘mere surplusage.’” (quoting Osborn ex rel. Osborn v. Kemp, 991 A.2d 1153, 1159-60 (Del 2010)). 159 Insurers’ Mot. at 19 n.58. 160 2004 Agreement passim.

-29- month before Ambiron and Trustwave merged.161 So, as of the 2005 Agreement’s

effective date, Ambiron wasn’t a party thereto, and so the 2004 Agreement wasn’t

covered by the integration clause.

As for Trustwave Entities’ argument that the 2005 Agreement does not apply,

they focus on the overall gist of the contract and its failure to define payment terms

applicable to a “Level 1” service provider such as Heartland.162 Trustwave Entities

are correct that the 2005 Agreement is clearly more concerned with a

referrals-for-commissions arrangement than the provision of compliance validation

services. Nevertheless, Heartland’s ability to elect to receive the services for itself

under that contract cannot be ignored.163 Also, the fact that the fee schedule in

Exhibit B does not appear to cover entities like Heartland must yield to Section 1(c)’s

specific direction that “[Heartland] will pay the applicable fees and expenses set

forth in Exhibit B in consideration for TrustWave’s performance of such TrustWave

Services to [Heartland].”164 Perhaps recognizing the shortcomings of their principal

arguments, Trustwave Entities retreat to saying, “[a]t most, the language referenced

161 2005 Agreement at 1, 14; AmbironTrustwave’s Mot., Ex. A [hereinafter “Hannagan Aff.”] ¶ 3 (D.I. 142). 162 Trustwave’s Mot. at 18. 163 See Sunline Com. Carriers, 206 A.3d at 846. 164 2005 Agreement at 3; see also id. at 12 (“The terms of this Agreement will control in the event of any inconsistency with the terms of any Exhibit hereto.”). Any ambiguity about how Heartland’s potential payments would be calculated under the referenced fee schedule is not determinative of whether Heartland could elect to receive the services in the first place.

-30- by Insurers creates an option contract” and then argue there is no creditable evidence

Heartland exercised that option.165

2. There Remains a Material Dispute as to Whether Heartland Exercised Its Option.

At this point, Trustwave’s fallback position that Heartland did not exercise its

option under the 2005 Agreement is the central inquiry. What remains is to evaluate

the evidence that Heartland did. The contract doesn’t specify any required method

for Heartland’s election, so general principles of express or implied assent apply.166

To demonstrate Heartland’s use of Trustwave’s services under the 2005

Agreement, Insurers rely on the branding of the proprietary software used to conduct

the 2007 vulnerability scans.167 Specifically, the 2004 Agreement called for the use

of Ambiron’s “Vital Signs” software.168 The 2005 Agreement, in contrast, referred

to Trustwave’s “TrustKeeper” technology.169 The cover pages of the August and

September 2007 vulnerability scans indicate TrustKeeper was used.170 On its face,

that suggests Heartland exercised its option under the 2005 Agreement. While

Ambiron and Trustwave had merged well before those scans were run. And it is

165 Trustwave’s Opp’n Br. at 23. 166 Walsh, 2020 WL 1492543, at *6 (quoting Restatement (Second) of Contracts § 50 cmt. c.). 167 Insurers’ Reply Br. at 14-16. 168 2004 Agreement at 6. 169 2005 Agreement at 1-2. 170 Insurers’ Mot., Exs. 5, 6.

-31- possible the combined entity simply unified its branding while leaving its contractual

relationship with Heartland unchanged. That possibility cannot be resolved as fact

here.

It may be in the end that Trustwave Entities’ competing evidence is more

persuasive. First, as a matter of simple timing, the 2004 Agreement was presented

on October 11, 2004, and had a three-year term.171 Correspondingly, the 2007

Agreement was presented on October 10, 2007.172 Though not definitive, that seems

to suggest the 2004 Agreement remained in effect until it was replaced by the 2007

Agreement. Also, Trustwave Entities cite to the testimony of former Trustwave

employees, Allen Hannagan and Phillip Smith.173 Both testified that, to their

knowledge, Trustwave did not provide compliance validation services under the

2005 Agreement.174 Although that evidence may have a bit more heft than the

Insurers’, summary judgment is not typically the proper place for weighing such

competing evidence.175

171 2004 Agreement at 1, 10 172 2007 Agreement at 1. 173 Trustwave’s Opp’n Br. at 22. 174 Trustwave’s Opp’n Br., Ex. 5 at 251-54, Ex. 6 ¶ 9 (D.I. 171). Insurers argue Mr. Smith’s affidavit should be disregarded because he was not previously disclosed as a witness; but the case they cite is inapposite and Rule 56(e) and (f) evince a preference for entertaining all relevant affidavits at this stage in the interest of justice. See Insurers’ Reply Br. at 17. 175 Bobcat N. Am., LLC v. Inland Waste Hldgs., LLC, 2020 WL 5587683, at *7 n.64 (Del. Super. Ct. Sept. 18, 2020) (“‘If a trial court must weigh the evidence to a greater degree than to determine that it is hopelessly inadequate ultimately to sustain the substantive burden, summary judgment is -32- No doubt, an opponent “cannot defeat a motion for summary judgment by

asking the Court to draw inferences ‘based on surmise, speculation, conjecture, or

guess, or on imagination or supposition.’”176 And certainly, “[n]ot all disputes of fact

will defeat a motion for summary judgment.”177 But at this point, whether the use of

TrustKeeper is attributable to intra-entity conformity or to Heartland’s election to

receive services under the 2005 Agreement remains an issue of material dispute.

3. The Parties’ Alternative Arguments With Regard to the 2005 Agreement Do Not Change the Analysis.

Insurers, for the first time in their reply brief,178 suggest that even if the 2007

scans weren’t performed under the 2005 Agreement, that contract’s warranties and

indemnity provision would still apply to those scans. This argument—though

laudably creative—fails.

Insurers first rely on the warranty in the 2005 Agreement that Trustwave “will

perform the TrustWave Services . . . using reasonable care and skill.”179 They then

inappropriate.’”) (quoting Cerebus Int’l, Ltd. v. Apollo Mgmt., L.P., 794 A.2d 1141, 1150 (Del. 2002)). 176 Ogus v. SportTechie, Inc., 2023 WL 2746333, at *9 (Del. Ch. Apr. 3, 2023) (quoting In re Asbestos Litig., 2017 WL 510463, at *1 n.2 (Del. 2017)). 177 In re Asbestos Litig., 2012 WL 1413673, at *2 (Del. Super. Ct. Feb. 2, 2012). 178 See Ethica Corp. Fin. S.r.L v. Dana Inc., 2018 WL 3954205, at *3 (Del. Super. Ct. Aug. 16, 2018) (“Courts may disregard or deem waived any arguments made in a reply brief which w[ere] not raised in the opening brief.” (citing In re Asbestos Litig., 2014 WL 7150472, at *1 n.5 (Del. Super. Ct. Dec. 5, 2014))). 179 Insurers’ Reply Br. at 17; 2005 Agreement § 5(e).

-33- point out that the “TrustWave Services” include “vulnerability scans.”180

Connecting those clauses, they suggest that any and all vulnerability scans

performed by Trustwave under any contract would be covered by the 2005

Agreement’s warranty and, thus, its indemnity clause. While textually plausible,

such an expansive interpretation would be antithetical to well-settled principles of

contract interpretation.

“Delaware adheres to the ‘objective’ theory of contracts, i.e., a contract’s

construction should be that which would be understood by an objective, reasonable

third party.”181 “An unreasonable interpretation produces an absurd result or one

that no reasonable person would have accepted when entering the contract.”182

Insurers’ suggested interpretation would be just that. Moreover, such a sweeping

interpretation would function as a judicial rewriting of the 2004 Agreement to

include an unnegotiated-for indemnity provision. That’s not the Court’s role.183

Accordingly, “TrustWave Services” as used in the 2005 Agreement should be

interpreted to only encompass services provided by Trustwave with some connection

180 Id. at 17. 181 Osborn, 991 A.2d at 1159 (quoting NBC Universal v. Paxson Commc’ns, 2005 WL 1038997, at *5 (Del. Ch. Apr. 29, 2005)). 182 Id. (collecting cases). 183 Intermec IP Corp. v. TransCore, LP, 2023 WL 5661585, at *9 n.94 (Del. Super. Ct. Aug. 23, 2023) (“Delaware courts will ‘not rewrite [a] contract to appease a party who later wishes to rewrite a contract he now believes to have been a bad deal.’” (alteration in original) quoting Nemec v. Shrader, 991 A.2d 1120, 1126 (Del. 2010)).

-34- to that contract.

Not to be outdone, Trustwave Entities put forth an alternative argument of

their own. They argue in a footnote of their Opposition Brief that even if the 2007

scans were performed under the 2005 Agreement, that contract’s indemnity

provision would still be inapplicable in light of its “prompt notice” requirement.184

Possibly due to its unassuming placement, Insurers do not respond to this argument.

Under the 2005 Agreement’s indemnity procedure clause, a lack of notice only

forecloses indemnification if the putative indemnitor “has been materially damaged

or prejudiced as a result of such delay.”185 Trustwave Entities raise their failure to

“obtain and preserve additional relevant evidence close-in-time to the underlying

events” as their material prejudice.186

Though this argument invites a laches-like inquiry into prejudicial delay, that

is largely unnecessary here. The indemnitee’s prompt-notice requirement only

pertains to “the existence of a Third Party Claim.”187 Unquestionably, Trustwave

became aware of then-extant claims against Heartland years ago when this

historically large data breach became public information. So, in practical effect, the

violation of the indemnity procedures was not an actual lack of notice but the lack

184 Trustwave’s Opp’n Br. at 24 n.8; 2005 Agreement § 13(c)(i). 185 2005 Agreement § 13(c)(i). 186 Trustwave’s Opp’n Br. at 24 n.8. 187 2005 Agreement § 13(c)(i).

-35- of a written document separately providing that notice. Accordingly, Trustwave

Entities are hard pressed to argue they would have kept additional evidence if they

had known third parties had claims against Heartland.

To sum up, although Insurers’ position on the applicability of the 2005

Agreement is tenuous, it meets the threshold to withstand summary judgment. The

software-name discrepancy adduced by Insurers appears to carry their evidentiary

burden, even if just barely. Because of that, Insurers should be able to pursue the

issue of Heartland’s exercise of the 2005 Agreement’s option at trial. Since there is

a genuine dispute as to that material fact, both parties’ summary judgment motions

on the claims under the 2005 Agreement must be denied.

B. THE 2007188 AGREEMENT’S LIMITATION OF LIABILITY’S EFFECT ON THE INDEMNITY PROVISION IS AMBIGUOUS.

Another central issue, made even more important by the dubious applicability

of the 2005 Agreement, is the application of the 2007 Agreement’s limitation of

liability. The issue is complicated by that provision’s facial inconsistency with the

2007 Agreement’s indemnity provision. Expectedly, Insurers say the indemnity

188 The 2005 Agreement has an analogous limitation of liability that purports to broadly limit consequential damages and does not carve out indemnity obligations. 2005 Agreement § 14(b). Insurers nevertheless state that clause doesn’t exist. Insurers’ Mot. at 4. Even Trustwave Entities, in their roughly 130 pages of briefing—which include alternate defenses should the Court find the 2005 Agreement applies—never once mention it. Accordingly, to the extent that provision may have benefitted Trustwave, they have waived the argument. See Wescott v. Moon, 2022 WL 10788238, at *1 (Del. Super. Ct. Oct. 18, 2022) (“[I]ssues not briefed are deemed waived.” (quoting Emerald Partners v. Berlin, 726 A.2d 1215, 1224 (Del. 1999))).

-36- provision controls, while Trustwave Entities argue for application of the limitation.

For the reasons that follow, the all-encompassing language used by the two contrary

terms creates a seemingly irreconcilable conflict. Resolution of the question, then,

will depend on a fact-sensitive consideration of the parties’ intent, which is a task

ill-suited for summary judgment. In addition to that primary issue, Insurers raise the

question of whether the limitation is enforceable under Delaware law; but neither of

their two arguments on that point are persuasive.

The applicable terms as they appear in the contract provide:

LIMITATION OF LIABILITY AND DISCLAIMER OF WARRANTY.

a. TRUSTWAVE SHALL NOT BE LIABLE TO [HEARTLAND] FOR (1) ANY ACTS OR OMMISSIONS WHICH ARE NOT THE RESULT OF TRUSTWAVE’S GROSS NEGLIGENCE, RECKLESSNESS OR WILLFUL MISCONDUCT, (2) ANY AMOUNTS IN EXCESS OF ANY FEES PAID TO TRUSTWAVE BY [HEARTLAND] HEREUNDER, (3) ANY OUTAGES OR SLOW DOWNS OF [HEARTLAND]’S COMPUTER SYSTEMS RESULTING FROM THE PERFORMANCE OF ANY SERVICES, UNLESS SUCH OUTAGES OR SLOW DOWNS ARE THE RESULT OF TRUSTWAVE’S GROSS NEGLIGENCE, RECKLESSNESS OR WILLFUL MISCONDUCT, OR (4) ANY LOSSES, COSTS, DAMAGES OR EXPENSES INCURRED BY [HEARTLAND] RESULTING FROM THE PERFORMANCE OF ANY TEST, UNLESS SUCH ARE THE RESULT OF TRUSTWAVE’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.

b. THIS AGREEMENT IS A SERVICE AGREEMENT, -37- AND EXCEPT AS EXPRESSLY PROVIDED IN THIS AGREEMENT, TRUSTWAVE DISCLAIMS ALL OTHER REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES REGARDING QUALITY, SUITABILITY, MERCHANTABILITY, OR FITNESS FOR A PARTICULAR PURPOSE (IRRESPECTIVE OF ANY COURSE OF DEALING, CUSTOM OR USAGE OF TRADE) OF ANY SERVICES OR ANY GOODS OR SERVICES PROVIDED INCIDENTAL TO THE SERVICES PROVIDED UNDER THIS AGREEMENT.

c. IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY SPECIAL, INDIRECT, EXEMPLARY, INCIDENTAL OR CONSEQUENTIAL LOSSES OR DAMAGES, INCLUDING LOST PROFITS WHETHER FORESEEABLE OR NOT, WHETHER OCCASIONED BY ANY FAILURE TO PERFORM OR THE BREACH OF ANY REPRESENTATION, WARRANTY, COVENANT OR OTHER OBLIGATION FOR ANY CAUSE WHATSOEVER.

Indemnification. Each party shall indemnify and hold harmless the other party and its Affiliates and their respective officers, directors, employees, partners, agents, successors and assigns from, and shall defend the other against, any costs, liabilities, damages or expenses (including reasonable attorneys’ fees) arising out of or relating to (i) any third party claim that the services, software, or any work performed by either party, or their agents, consultants or contractors under this Agreement infringes the proprietary rights of any third party; (ii) an act or omission by either party and/or their employees and agents relating to any laws or regulations for a protected class or category of persons, and sexual discrimination or harassment; (iii) claims for personal injuries, death or damage to tangible personal or real property to the extent caused by acts or omissions as a result of gross negligence, recklessness or willful misconduct of the party or its -38- Affiliates, contractors or agents; and (iv) claims or suits attributable to breaches of the other party’s express representations and warranties contained in the Agreement.189

1. The Conflict Between the Indemnity and Limitation of Liability Provisions Renders Them Ambiguous.

As can be readily gleaned from the above language, there is discord between

those portions of the contract. Both clauses use broad language to describe

functionally opposite rights and obligations. Faced with that tension, the Court must

endeavor to find “an interpretation that harmonizes the provisions,” if possible.190

But, “where a contract contains two conflicting provisions, the document is rendered

ambiguous.”191 “In that case, extrinsic evidence is an appropriate resource for the

court to use in determining the parties’ reasonable intentions at the time of the

contract.”192 “Sources of such evidence include ‘overt statements and acts of the

parties, the business context [of the contract], prior dealings between the parties,

business custom, and usage in the industry.’”193 That need to weigh evidence

189 2007 Agreement at 9-10. 190 Coronado Coal II, LLC v. Blackhawk Land and Res. LLC, 2022 WL 1772246, at *4 (Del. Super. Ct. May 31, 2022) (quoting GRT Inc. v. Marathon GTF Tech., Ltd., 2012 WL 2356489, at *4 (Del. Ch. June 12, 2012)). 191 Erving v. ABG Intermediate Hldgs. 2, LLC, 2022 WL 17246320, at *2 (Del. Ch. Nov. 28, 2022) (quoting Duff v. Innovative Discovery LLC, 2012 WL 6096586, at *12 (Del. Ch. Dec. 7, 2012)). 192 Dittrick v. Chalfant, 948 A.2d 400, 406 (Del. Ch. 2007) (citing The Liquor Exch., Inc. v. Tsaganos, 2004 WL 2694912, at *2 (Del Ch. Nov. 16, 2004)). 193 Id. (alteration in original) (quoting The Liquor Exch., 2004 WL 2694912, at *2).

-39- militates against granting summary judgment.194

The parties conflicting interpretations are unsurprising. Insurers cite the

phrase “any cost, liabilities, damages or expenses” within the indemnity provision

to suggest that recovery under that clause is “without any limitation whatsoever.”195

Trustwave Entities retort that the “limitation of liability doesn’t carve out

indemnification” and counter with the phrases “any amounts in excess of any fees

paid” and “any special, indirect, exemplary, incidental, or consequential losses or

damages” within the limitation of liability.196 They conclude, “Insurers’ argument

regarding the prominence of the indemnification provision [based on the use of the

word “any”] is applicable with equal weight to the limitation of liability.”197 That

being so, neither parties’ baseline interpretation is significantly more or less

reasonable than the others’.

Recognizing this conflict, Insurers scry for accord. They do so by claiming,

“Delaware courts have generally held that indemnification provisions apply to third-

party claims, whereas the limitation of liability applies to direct first-party loss.”198

That predicate, Insurers say, means the Court can harmonize the provisions by

194 GMG Cap. Invs., LLC v. Athenian Venture Partners I, L.P., 36 A.3d 776, 783-84 (Del. 2012). 195 Insurers’ Mot. at 25. 196 Trustwave’s Opp’n Br. at 38-39. 197 Id. at 39. 198 Insurers’ Mot. at 28 (citing Column Form Tech., Inc. Caraustar Indus., Inc., 2014 WL 2895507, at *5-8 (Del. Super. Ct. June 10, 2014)).

-40- applying the limitation only to Heartland’s first-party losses and leaving recovery of

third-party liability unchecked. Though one plausible interpretation, it doesn’t settle

the issue.

Insurers’ assertion that indemnification provisions typically only apply to

third-party claims is well-taken. Often, applying an indemnity provision to first-

party losses could lead to the absurd result of a party being obligated to defend

against itself.199 Insurers’ second postulate—that limitations on liability are

generally unique to first-party costs—is less convincing. Without question, in the

case Insurers cite for this point, Column Form Technology, Inc. v. Caraustar

Industries, Inc., the limit on liability did not apply to the indemnity provision.200 But

that is because the limitation of liability clause in that case began: “except for the

parties, [sic] indemnification obligations hereunder.”201 A similar exception can be

found in the 2005 Agreement’s limitation of liability, but not so in the 2007

Agreement.202

Without further support, the notion that indemnity is typically limitless

founders. Be they caps, baskets, temporal or conduct-based restrictions, limitations

199 See Column Form Tech., 2014 WL 2895507, at *8; CIGNEX Datamatics, Inc. v. Lam Rsch. Corp., 2020 WL 2063924, at *14 n.14 (D. Del. Apr. 29, 2020). 200 2014 WL 2895507, at *3. 201 Column Form Tech., 2014 WL 2895507, at *3 (alteration in original) (all capitals in original). 202 2005 Agreement §14(a); 2007 Agreement at 9.

-41- on indemnity come in many of forms.203 Though unartfully drafted, it is entirely

conceivable that the limitation of liability in this case was intended to cap

Trustwave’s indemnity obligations to the sum certain of fees received. Moreover,

interpretively adding “except for a third-party claim” seems too great an alteration

to “in no event”204 for this to be considered a truly harmonious reading. It follows

that there is no solitary reasonable interpretation of the interaction between the

indemnity and limitation of liability provisions, and so the contract is ambiguous.

And resolving that ambiguity requires evaluating evidence to a greater extent than

summary judgment typically allows.205

2. To the Extent It Applies, The Limitation of Liability is Enforceable.

Insurers separately argue the limitation of liability is unenforceable as applied

to indemnity claims. They suggest the amount of damages was readily ascertainable

at the time of contracting based on a formula Visa uses to calculate certain damages

following a data breach.206 They also claim the fees-paid limitation is grossly

inadequate.207 Neither of those contentions is persuasive.

203 See, e.g., Aveanna Healthcare, LLC v. Epic/Freedom, LLC, 2021 WL 3235739, at *1 (Del. Super. Ct. July 29, 2021); EMSI Acquisition, Inc. v. Contrarian Funds, LLC, 2017 WL 1732369, at *4-5 (Del. Ch. May 3, 2017); ABRY Pr’s V, L.P. v. F&W Acq. LLC, 891 A.2d 1032, 1035 (Del. Ch. 2006). 204 2007 Agreement at 9. 205 GMG Cap. Invs., 36 A.3d at 783-84 (Del. 2012). 206 Insurers’ Mot. at 31-35. 207 Insurers’ Mot. at 35-37

-42- Regarding the effect of the Visa’s Account Data Compromise Recovery

program (“ADCR”) damages formula, it does not provide the certainty Insurers

suggest. Putting aside the variability of the necessary inputs to that formula, the

formula only pertains to a specific set of damages owed to a single third party. The

litigation against Heartland continued after a settlement with Visa and included

claims brought by government agencies, non-Visa card brands, financial institutions,

and consumers.208 Also, the ADCR calculation was not an inviolable determination

of damages even with regard to Visa. Instead of strictly complying with Visa’s

ADCR calculation—which, together with a separate “Operating Expense

Recovery,” totaled $138 million—Heartland settled with Visa for $60 million.209 It

follows that the ADCR formula set neither a ceiling nor floor to Heartland’s

exposure. It does little, then, to demonstrate Heartland’s third-party liability was

“easily ascertainable” at the time of contracting.210

Insurers’ contention as to the gross inadequacy of the fees-paid limitation is

also unavailing. To be sure, the fees paid by Heartland—Insurers estimate them at

$80,000—were far less than Heartland’s eventual liability. But the question of a

limitation’s reasonableness is not strictly about the percentage of liability the

208 See Trustwave Hldgs, Inc., 2019 WL 4785866, at *2. 209 Insurers’ Mot. at 15-16. 210 See D’Aguiar v. Heisler, 2011 WL 6951847, at *12 (Del. Com. Pl. Dec. 15, 2011).

-43- limitation covers. Instead, the inquiry looks at the rationality of the limitation in the

greater context of the contractual relationship. In the analogous arena of home

inspection and fire monitoring contracts, Delaware courts have upheld limitations of

liability in the hundreds of dollars despite damages in the hundreds of thousands of

dollars.211 The reasoning in those cases is applicable here. An entity that provides

security services—be it building integrity, fire safety, or as here, digital security—

does not necessarily become a de facto insurer for its clients. Were it otherwise,

such service providers would be forced to dramatically increase their prices lest they

go bankrupt after a single mistake.

The lone case Insurers cite as an example of an invalid damages provision

does little to undermine that rationale. In Unifirst Corporation v. Borris, the Court

of Common Pleas invalidated a liquidated damages clause as punitive.212 There, a

garment laundering contract called for weekly charges of roughly thirty dollars.213

The contract had a five-year term and a liquidated damages provision valued at 50%

of the remaining charges.214 Based on that clause, despite the modest weekly charges

211 See, e.g., D’Aguiar, 2011 WL 6951847, at *13; Iavarone v. Eagle Eye Home Inspections, LLC, 2019 WL 5692265, at *1-2 (Del. Super. Ct. Nov. 4, 2019); Donegal Mut. Ins. Co. v. Tri-Plex Sec. Alarm Sys., 622 A.2d 1086, 1087, 1090 (Del. Super. Ct. 1992); White v. Mood, 2020 WL 996736, at *5 (Del. Super. Ct. Mar. 2. 2020). 212 1999 WL 1847348, at *5 (Del. Com. Pl. May 11, 1999). 213 Unifirst, 1999 WL 1847348, at *1. 214 Id.

-44- and the lack of upfront expenditures by the launderer, the launderer sought over

$3,000 following a breach by the client.215 That was held to be an invalid penalty,

and damages were instead fixed at lost profits plus interest.216 To the extent that

decision has any bearing on this case, it serves as another example of courts looking

to the fairness of a damages provision in light of the parties’ actual relationship.

Here, Insurers seek to convert the 2007 Agreement into an implied insurance

policy. That does not appear to be the benefit Heartland bargained for. Heartland’s

contractual acknowledgment that “use of Trustwave’s services do not guarantee PCI

compliance or that its systems are secure from unauthorized access” supports the

limited nature of Trustwave’s assurances and related responsibility.217 Though the

fees-paid limitation falls well short of the eventual liability, it is not detached from

reason as Insurers suggest. Instead, it served as a mechanism that motivated

Trustwave Entities’ reasonable efforts by putting their profits on the line without

requiring Trustwave to charge fees commensurate with an insurance provider. So,

assuming the 2007 Agreements limitation of liability applies to the indemnity

provision, it is enforceable.

215 Id. 216 Id. at *5. 217 Trustwave attempts to use this clause as an absolute disclaimer of liability for the damages at issue here. That argument is unpersuasive. Trustwave may not be strictly liable for imperfections in their service, but the interpretation Trustwave suggests ignores its express warranty regarding performing in a “professional and workmanlike manner.”

-45- C. WHETHER HEARTLAND BREACHED THE 2007 AGREEMENT BY FAILING TO REPORT THE SQL INJECTION DEPENDS ON RESOLUTION OF AN AMBIGUITY, AND THE MATERIALITY OF ANY SUCH BREACH IS A DISPUTED FACT.

Trustwave Entities seek to excuse any alleged breach of the 2007 Agreement

by charging Heartland had itself materially breached the contract. There are two

questions implicated by this argument--neither of which is well-suited to summary

judgment. The first issue is whether Heartland’s failure to inform Trustwave of the

December 2007 SQL injection breached its requirement to notify Trustwave of “any

suspected breach of [its] systems.”218 The second is: if that was a breach, was it

sufficiently material to excuse Trustwave’s continued performance.

The issue of whether Heartland breached the contract is not ripe for summary

judgment because it rests on an ambiguity. Specifically, the definition of “suspected

breach” as used in the 2007 Agreement is susceptible to two reasonable but different

meanings, according to the parties. Trustwave contends that a “breach” means the

unauthorized infiltration of Heartland’s network—a definition that would

encompass the SQL injection. Insurers counter that a “breach” does not occur until

data is exfiltrated from the network—a definition that does not include the injection.

Each side cites discovery evidence supporting their desired interpretation. As

explained above, the resolution of contractual ambiguities generally requires

weighing evidence in a way that is incompatible with summary judgment.

218 2007 Agreement at 10.

-46- Additionally, assuming Heartland’s failure to disclose the SQL injection

breached its notice requirement, whether that was a material failure sufficient to

excuse Trustwave’s performance is a question better left for trial. “Materiality is

predominantly a question of fact.”219 “Whether a breach is material . . . cannot be

readily resolved under the summary judgment standard. The central issues—which

party breached the [contract] and whether said breach is material—are best suited

for [a factfinder’s] determination”220 on a full trial record. As indicated, weighing

the five Restatement factors adopted by this Court to determine materiality221 is not

a task suited for this stage. Thus, resolution of this question should await trial.

As a final note, Insurers suggest Trustwave waived this argument by not

raising “prior material breach” as an affirmative defense. Not so.

Trustwave Entities’ sixth affirmative defense in their answer to Insurers’

counter/third-party complaint is titled “Breach of Contract” and states, “Insured and

Insurer are not entitled to indemnification because Insured breached the applicable

contract or contracts.”222 Insurers cite no authority to suggest that “prior” or

“material” are indispensable words that must be included to validly state this

219 Grottenthaler v. SVN Med, LLC, 2022 WL 17249642, at *5 (Del. Super. Ct. Nov. 28, 2022) (collecting cases). 220 Grottenthaler, 2022 WL 17249642, at *5 n.55. 221 See Foraker v. Voshell, 2022 WL 2452396, at *8 (Del. Super. Ct. July 1, 2022). 222 Trustwave’s Answer at 37.

-47- defense. Accordingly, there is no reason to hold Trustwave waived this defense.

D. THE ADEQUACY OF TRUSTWAVE’S PERFORMANCE UNDER THE CONTRACTS IS A MATERIAL FACT IN DISPUTE. *

Though there are numerous ancillary issues, the heart of this litigation is

whether Trustwave Entities breached their warranties by not performing their duties

with the requisite care and skill. Simply put, this is a quintessential material fact that

is very much in dispute. Regarding both categories of challenged performance—the

2007 vulnerability scans and the 2008 ROC—the applicable standard of care and

Trustwave’s adherence to it remain contested. For that reason, summary judgment

on this issue is not warranted.

1. The 2007 Vulnerability Scans

As explained earlier, this performance issue will only be relevant if Insurers

can demonstrate the 2007 scans were done under the 2005 Agreement. If not, the

2004 Agreement, which did not provide for indemnity, would apply. Assuming the

2005 Agreement applies, there is still a material dispute of fact regarding

Trustwave’s performance. Specifically, it must be determined whether Trustwave

or Heartland was responsible for setting the scope of the scans and, if Trustwave

bore that burden, whether not including Payroll Manager in that scope fell below

“reasonable care and skill.”223

223 2005 Agreement § 5(e).

-48- Insurers seek summary judgment on this issue insisting their expert’s opinion

is uncontroverted. They say that because Mr. Valentine opined Trustwave was

obligated to set the scope of the scans, Trustwave needed to offer a competing expert

to refute that point. They argue Trustwave’s purportedly belated submission of

Mr. Leach’s expertise on this point is tantamount to a sham affidavit. Even putting

aside the extent to which the pursuit of truth should yield to procedural concerns,

Mr. Valentine’s opinion is not as unimpeachable as Insurers suggest.

Relying on Mr. Valentine’s opinion, Insurers claim Trustwave was obligated

to “properly identify the Payroll Manager as an in-scope system.”224 Trustwave’s

failure to do so is the primary basis of Insurers’ motion. Mr. Valentine’s opinion,

though, is in direct contrast to the actual PCI “Security Scanning Procedures” that

governed the vulnerability scans. Those procedures explicitly state:

Merchants and service providers [here, Heartland] have the ultimate responsibility for defining the scope of their PCI Security Scan, though they may seek expertise from ASVs [here, Trustwave] for help. If an account data compromise occurs via an IP address or component not included in the scan, the merchant or service provider is responsible.225

Insurers suggest the Court should disregard that plain language as an

224 Insurers’ Mot. at 20. 225 PCI Security Scanning Procedures at 2 (emphasis added).

-49- “unverified reference[] to secondary sources.”226 Understanding that language

requires “unique educational requirements and a professional certification,” Insurers

say.227 But, in refuting Trustwave’s argument that Mr. Valentine’s qualifications do

not extend to the scanning procedures, Insurers recite, “[t]he usual concerns of the

Daubert rule—keeping unreliable expert testimony from the jury—do not apply . . .

when the matter is before the Court on a motion for summary judgment, because the

Court acts as fact-finder.”228 Insurers can’t have it both ways. If the Court is

qualified to examine expert opinions without first considering the expert’s

credentials, surely it can compare an opinion to unequivocal language in controlling

industry documents. At the very least, the Court can determine there is a dispute

worthy of further exploration at trial. Insurers’ comparison of the discrete PCI DSS

Security Scanning Procedures to broad EPA standards on air quality in the context

of a landlord’s obligation to mitigate mold is unpersuasive.229

Furthermore, another dispute relating to Mr. Valentine’s opinion is whether

Payroll Manager needed to be included in the scans, regardless of which entity was

required to set the scope. Basically, there is no direct evidence that Payroll Manager

226 Insurers’ Reply at 6. 227 Id. at 7. 228 Id. at 8 (omission in original) (quoting In re Zurn Pex Plumbing Prods. Liab. Litig., 644 F.3d 604, 613 (8th Cir. 2011)). 229 See id. at 7 (discussing Brandt v. Rokeby Realty Co., 2004 WL 2050519, at *5 (Del. Super. Ct. Sept. 8, 2004)).

-50- was connected to the payment processing environment at the time of the 2007

vulnerability scans, so there is no direct evidence it was “in-scope” at that time.

Mr. Valentine explained the reasons he believed that it was connected to the payment

environment in his deposition but confirmed he had no direct evidence of it.

Trustwave Entities cite that lack of certainty as a reason to doubt Mr. Valentine’s

opinion that they violated their warranty of reasonable care by not scanning Payroll

Manager. This, too, seems to be a factual determination better left to trial. So,

summary judgment is yet again uncalled for.

2. The 2008 Report on Compliance

As for the 2008 ROC, Trustwave Entities insist there is no dispute that the

ROC was performed in a “professional and workmanlike manner.”230 They

primarily rely on the limited nature of an ROC—validating compliance with

standards, not actual security—to claim they had no obligation to catch the ongoing

infiltration of Heartland’s systems. Insurers do not attempt to argue the opposite

conclusion is undisputed; instead, they claim resolution of this issue depends on a

battle of the experts. Similarly to the vulnerability scans issue, Insurers point to the

purportedly recognized connection between the payment processing and corporate

components of Heartland’s network, and Trustwave’s failure to properly address

that, as their basis for claiming substandard performance. Insurers also claim

230 2007 Agreement at 9.

-51- Trustwave’s failure to maintain the relevant workpapers generated during the ROC

assessment is a basis for a spoliation inference. Though the spoliation inference

seems unwarranted, there are material facts in dispute precluding summary

judgment.

As with the vulnerability scans, known junctures between the two sides of

Heartland’s network should have expanded the scope of the ROC to include all

systems connected to the sensitive data. The compensating control worksheets

affixed to the 2008 ROC suggest Trustwave was—or at least should have been—

aware of such connections. In arguing for summary judgment, Trustwave relies

heavily on the fact that “workmanlike” does not contemplate perfection. Insurers

adduce the assignment of Todd Skipper, an inexperienced and they say unqualified

assessor, to this project as evidence of Trustwave’s unprofessionalism. Despite

Trustwave’s protestations, it is clear that there is a genuine dispute as to whether

Trustwave’s performance met the standard they warranted in the 2007 Agreement.

But in resolving that dispute, Insurers isn’t entitled to a spoliation inference

in their favor. Insurers cite Trustwave’s acknowledgement of anticipated litigation

in 2011 and the subsequent failure to preserve the relevant workpapers as the basis

for spoliation. Plausible as that argument seems, it ignores a critical fact. Trustwave

was not preserving the documents because they anticipated this litigation; instead, it

was preserving the papers for potential use in the underlying Heartland litigation.

-52- The litigation against Heartland concluded in 2015 and Insurers didn’t send their

demand to Trustwave until almost three years later. For context, in the absence of

litigation, Trustwave would have only been required to maintain the work papers for

three years.

Even assuming the conclusion of the Heartland litigation restarted the clock

on Trustwave’s duty to preserve the workpapers—meaning Insurers’ demand

arrived with one month remaining in Trustwave’s obligatory maintenance period—

the sanction of an adverse inference is discretionary.231 It doesn’t appear Trustwave

engaged in anything approaching bad faith by not keeping the papers after the

conclusion of the Heartland litigation, so a spoliation inference here would result in

a windfall to Insurers with no corresponding deterrent effect. So, any evaluation of

Trustwave’s performance starts from a level playing field.

E. CONTRACTUAL LANGUAGE GOVERNS THE APPLICABLE STANDARD OF CAUSATION, AND CAUSATION REMAINS A MATERIAL FACT IN DISPUTE.

Trustwave Entities contend there can be no dispute that any alleged

misconduct by them was not a proximate cause of Heartland’s losses, entitling them

to summary judgment. Not so. First of all, the 2005 Agreement’s indemnity

provision is triggered by an agreed-upon standard of causation that is less than

231 See Charter Commc’ns Operating, LLC v. Optymyze, LLC, 2021 WL 1811627 (Del. Ch. Jan. 4, 2021) (“Whether and to what extent to impose sanctions is a matter entrusted to the discretion of the trial court.”)

-53- proximate cause. Second, even if the 2007 Agreement’s “attributable to” standard

is considered to be coextensive with proximate cause, evaluating causation under

that standard isn’t ripe for summary judgment.

1. The 2005 Agreement’s Indemnity Provision Doesn’t Require Proximate Cause.

When Trustwave entered the 2005 Agreement—an agreement they seemingly

drafted—it agreed to indemnify Heartland for losses “arising out of or connected

with any third party claim relating to” its breach of an express warranty.232 Now

Trustwave Entities argue that the breach of warranty must be the proximate cause of

the loss for indemnity to apply. But that’s not the protection they bargained for.

In Charney v. American Apparel, Inc., the Court of Chancery interpreted the

analogous phrase “related to the fact” as “equivalent to the meaning of ‘by reason of

the fact.’”233 Our Supreme Court has interpreted “by reason of the fact” to mean

“there is a nexus or causal connection.”234 That “nexus” requirement is not as broad

as but-for causation,235 but implicitly, it must be less than a “causal connection” to

avoid rendering it redundant. So, it follows that “relating to” is not as demanding as

proximate cause. Even if it were, Trustwave is not entitled to summary judgment

232 2005 Agreement § 13(a). 233 2015 WL 5313769, at *14 (Del. Ch. Sept. 15, 2015). 234 Homestore, Inc. v. Tafeen, 888 A.2d 204 (Del. 2005). 235 Charney, 2015 WL 5313769, at *13.

-54- on the issue of proximate causation.

2. Even Under a Proximate Cause Standard, Trustwave Entities Aren’t Entitled to Summary Judgment on Causation.

It seems no Delaware court has had to interpret the term “attributable to”—

which is used in the 2007 Agreement’s indemnity provision—in an analogous

context. Without delving into a detailed interpretation of that term, it does at least

facially appear to be closer to proximate causation than “relating to.” Even assuming

it is equivalent to proximate cause, though, Trustwave’s argument is unconvincing.

Notably, “proximate cause is ‘almost always’ a jury issue. Indeed, proximate

cause is ‘fact driven’ and so ‘is to be determined, on the facts, upon mixed

considerations of logic, common sense, justice, policy and precedent.’”236 For that

reason, it can preclude summary judgment where in doubt.237 Here, it is in doubt.

Basically, Trustwave Entities make a contributory-fault argument and say

Heartland knew or should have known of the malware on their systems and failed to

respond appropriately. According to Trustwave, that failure to effectively remediate

the situation absolved Trustwave of any fault in not alerting Heartland. But that

argument is flawed and certainly does not render the issue undisputed.

First, Trustwave underplays its role by suggesting it would have been

236 Torrent Pharma, Inc. v. Priority Healthcare Distrib., Inc., 2022 WL 3272421, at *18 (Del. Super. Ct. Aug. 11, 2022) (first quoting Mazda Motor Corp. v. Lindahl, 706 A.2d 526, 533 (Del. 1998); and then quoting Duphily v. Del. Elec. Coop., Inc., 662 A.2d 821, 830 (Del. 1995)). 237 Torrent Pharma, 2022 WL 3272421, at *18.

-55- powerless to make Heartland engage in more comprehensive remediation.

Heartland was required to have approvals issued by Trustwave or another approved

compliance validation service to stay in business. The notion that Heartland would

have ignored Trustwave’s guidance on how to bring its systems into compliance is,

therefore, untenable.

Moreover, one of the components of Trustwave’s services was to assist in

necessary remediation. As stated in the 2007 Agreement regarding vulnerability

scans: “The reports will . . . provide detailed results and remediation action for

technicians. Remediation instructions include CVE-linked vulnerability checks and

best practices defined by Trustwave consultants.”238 As for the ROC aspect of

Trustwave’s services, the 2007 Agreement reads, “any areas of non-compliance will

be identified, documented and reported to [Heartland] for appropriate action,” and

continues, “the ROC will include . . . recommendations for addressing areas of

non-compliance.”239 Similar assurances are provided in 2005 Agreement.240

Perhaps, if Heartland had been given those recommendations, its response would not

have been as woefully inadequate as Trustwave now describes.

Because Trustwave was in a position to compel more conscientiousness from

238 2007 Agreement at 3. 239 Id. at 3, 5. 240 2005 Agreement at 1-2.

-56- Heartland than Heartland may have volunteered, and because Trustwave was

contractually obligated to assist Heartland in its remediation efforts, Trustwave

cannot claim that Heartland’s deficient remediation spares it from liability. At the

very least, the extent to which the blame lies with Trustwave is a material question

of fact in dispute.

F. THERE IS NO EVIDENCE AMBIRONTRUSTWAVE, LTD. TOOK PART IN THE RELEVANT CONDUCT, SO ITS MOTION MUST BE GRANTED.

Finally, there is AmbironTrustwave, Ltd.’s narrow motion seeking summary

judgment only as to itself. Insurers present no evidence that AmbironTrustwave,

Ltd.—as opposed to Trustwave Holdings using the d/b/a AmbironTrustWave—took

any part in the disputed conduct. Instead, Insurers simply ignore that issue and

proceed in their opposition brief as if the two “AmbironTrustwave” entities are one

and the same. But, in a footnote of their Reply Brief, Insurers admit that

AmbironTrustWave as used in the vulnerability scans “is a d/b/a of Trustwave.” As

a result, Insurers have not created a genuine dispute as to whether

AmbironTrustwave, Ltd. rendered services to Heartland. Additionally, Insurers’

only counts that survived this Court’s September 2019 decision are against

Trustwave Holdings and Trustwave Corporation.

This motion centers on testimony from a Trustwave representative, Allen

Hannagan, explaining AmbironTrustwave, Ltd., didn’t perform work in the United

-57- States, didn’t contract with Heartland, and performed no work for Heartland.241

When asked why the name “AmbironTrustWave” appeared on documents related to

Heartland, Mr. Hannagan explained, “that was a d/b/a of Trustwave Holdings.”242

That moniker for Trustwave Holdings is fitting, considering Trustwave Holdings is

the combination of Ambiron, LLC and Trustwave Corporation.243 Mr. Hannagan’s

affidavit expresses the same information and adds that AmbironTrustwave, Ltd.—a

subsidiary of Trustwave Holdings—is based in the United Kingdom and “exists for

the purpose of conducting business in the European Union.”244

Insurers don’t address any of that information. Seemingly unconcerned with

the “Ltd.” versus “d/b/a” distinction, Insurers expressly omit the “Ltd.” when

referring to AmbironTrustwave, Ltd. throughout their papers.245 Insurers then

proceed to point out the several places where the name “AmbironTrustWave”

appears on documents related to Heartland.246 Conspicuously missing from those

references is the distinguishing “Ltd.” Insurers’ lone contention that is responsive

to AmbironTrustWave, Ltd.’s argument is that Mr. Hannagan’s testimony is “self-

241 AmbironTrustwave’s Mot., Ex. D [hereinafter “Hannagan Dep.”] at 5, 245-46 (D.I. 144). 242 Hannagan Dep. at 245-46. 243 Id. at 245. 244 Hannagan Aff. ¶ 5. 245 Insurers’ Opp’n to AmbironTrustwave at 1. 246 Id. at 2, 6-8, 11.

-58- serving” and thus insufficient to support summary judgment.247

Insurers rely on three cases to argue self-serving affidavits alone cannot

support summary judgment: Wilson v. Metzger,248 Abacus Sports Installations, Ltd.

v. Casale Const., LLC,249 and Fomby v. Frank E. Basil, Inc.250 In Wilson, this Court

stated in a succinct order, “[a]bsent further supporting evidence, a self-serving,

conclusory affidavit alone is insufficient to justify summary judgment.”251 That

comment was made in the context of denying a plaintiff-inmate’s motion for

summary judgment after he submitted a “conclusory” affidavit that “merely mirrored

[the allegations] in the complaint.”252 This Court made similar statements in Abacus

Sports Installations en route to denying a defendant’s pre-discovery motion for

summary judgment based on “self-serving” affidavits that were “little more than

vague recollections.”253 Lastly, in Fomby, this Court rejected a defendant-doctor’s

motion for summary judgment based on the doctor’s own affidavit saying the

treatment be rendered was “appropriate” and “proper.”254

247 Id. at 11-12. 248 2021 WL 2355230, at *1 (Del. Super. Ct. June 9, 2021). 249 2011 WL 5288866, at *2 (Del. Super. Ct. July 21, 2011). 250 1986 WL 9021, at *1-2 (Del. Super. Ct. Aug. 18, 1986). 251 2021 WL 2355230, at *1 (citing Abacus Sports Installations, 2011 WL 5288866, at *2). 252 Wilson, 2021 WL 2355230, at *1. 253 2011 WL 5288866, at * 2. 254 1986 WL 9021, at *1-2.

-59- There are meaningful differences between those cases and

AmbironTrustwave, Ltd.’s motion here. Most critical is the level to which the

affidavits in the other cases are “conclusory” and the Insurers’ evidence is absent.

In Wilson and Fomby, the affidavits were simply renewed contentions bereft of

specific factual support.255 In Abacus Sports Installations, not only were the

affidavits limited to “vague recollections,” but they were also submitted before any

discovery had taken place.256 By contrast, in this instance, expansive discovery has

already occurred, and Mr. Hannagan’s testimony provides a well-reasoned and

uncontroverted explanation as to AmbironTrustwave, Ltd.’s conclusion that it was

not involved in the disputed conduct. In fact, the most conclusory allegation in this

portion of the briefing is Insurers’ implied claim that Mr. Hannagan is lying. As

Insurers recognize, “[t]he mere suggestion that [a witness’s] credibility may be in

question does not suffice to create an[] issue of fact.”257

Further, and even more importantly, apparently losing track of their web of

contentions, Insurers actually admit in their reply brief that AmbironTrustwave as

used in the vulnerability scan documents “is a d/b/a of Trustwave.”258 Conveniently,

255 Wilson, 2021 WL 2355230, at *1; Fomby, 1986 WL 9021, at *1-2. 256 2011 WL 5288866, at * 2. 257 Insurers’ Reply Brief in Support of their Motion for Summary Judgment [hereinafter “Insurers’ Reply Br.”] at 8 (second alteration in original) (quoting Khan v. Del. State Univ., 2016 WL 3575524, at *12 (Del. Super. Ct. June 24, 2016)). 258 Insurers’ Reply Br. at 14 n.29.

-60- they even provide the notarized form registering “AmbironTrustwave” as a trade

name for Trustwave Holdings.259 Not only does that admission quell their argument

that the trade name’s usage implicates the European entity, but the provided form

means Mr. Hannagan’s testimony is not the sole support for AmbironTrustwave,

Ltd.’s motion. For those reasons, there is no genuine dispute as to

AmbironTrustwave, Ltd.’s involvement in providing services to Heartland and its

prayer for summary judgment is granted.260

VI. CONCLUSION

For the foregoing reasons, Trustwave Entities’ Motion for Summary

Judgment be DENIED; Insurers’ Motion for Partial Summary Judgment is

DENIED; and AmbironTrustwave, Ltd.’s Motion for Partial Summary Judgment is

GRANTED.

IT IS SO ORDERED.

259 Insurers’ Reply Br., Ex. 5 (D.I. 179). 260 What’s more, though undiscussed by the parties, a simple fact renders this analysis superfluous: there are presently no claims against AmbironTrustwave, Ltd. Its motion seeks summary judgment on Insurers’ Counterclaim Counts IV and V, as well as Count III of Insurers’ third-party complaint. AmbironTrustwave’s Mot. at 1. But Counterclaim Counts IV and V are “against Trustwave Holdings.” Countercl. at 47, 50. And Count III of the Insurers’ third-party complaint is “against Trustwave Corporation.” Countercl. at 67. Only two Counts were ever brought against AmbironTrustwave, Ltd.—Counts IV and VI of the third-party complaint. Countercl. at 69, 72. Those Counts pleaded negligent misrepresentation and gross negligence. Countercl. at 67, 71. As such, they were dismissed by this Court’s earlier ruling on Trustwave Entities’ Motion to Dismiss. Trustwave Hldgs, Inc., 2019 WL 4785866, at *11 (dismissing “Insurers’ Counterclaims and Third-Party Claims for . . . (iii) negligent misrepresentation, and (iv) gross negligence”). With no claims against AmbironTrustwave, Ltd. left to be decided, no factual dispute could be material with regard to that entity, so for that reason too it is due summary judgment. -61-