Fishbowl Solutions, Inc. v. Hanover Insurance Company, The

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA

Fishbowl Solutions, Inc., Case No. 21-cv-00794 (SRN/BRT)

Plaintiff,

v. MEMORANDUM OPINION AND ORDER The Hanover Insurance Company,

Defendant.

Joseph A. Nilan, Daniel A. Ellerbrock, and Nicholas J. Sideras, Gregerson, Rosow, Johnson & Nilan, Ltd., 100 Washington Avenue South, Suite 1550, Minneapolis, MN 55401, for Plaintiff.

Scott G. Johnson and Rebecca Zadaka, Robins Kaplan LLP, 800 LaSalle Avenue, Suite 2800, Minneapolis, MN 55402; and Erica Ramsey, Robins Kaplan LLP, 140 North Philips Avenue, Sioux Falls, SD 57104, for Defendant.

SUSAN RICHARD NELSON, United States District Judge This matter is before the Court on the Objection [Doc. No. 47] filed by Plaintiff Fishbowl Solutions, Inc. (“Fishbowl”) to Magistrate Judge Becky R. Thorson’s April 6, 2022 Order (the “Order”) [Doc. No. 45], denying Plaintiff’s motion to amend. Based on a review of the files, submissions, and proceedings herein, and for the reasons below, the Court OVERRULES the Objection and AFFIRMS the Order. I. BACKGROUND A. The Parties Plaintiff Fishbowl is a Minnesota company with its principal place of business in Saint Louis Park, Minnesota. (Proposed First Am. Compl. [Doc. No. 26] (“Proposed Am. Compl.”) ¶ 5.) Defendant The Hanover Insurance Company (“Hanover”) is a New Hampshire insurance company with its principal place of business in Massachusetts. (Id.

¶ 6.) B. Factual Background 1. Fishbowl’s Business Fishbowl is a software company. (See id. ¶ 9.) It creates and customizes packaged software for its customers using the latest technologies. (Id.) This software helps customers innovate and access information. (Id.) Fishbowl’s Senior Staff Accountant is Wendy Williams. (Id. ¶ 10.) She uses her e-

mail account to send invoices to customers and to communicate with customers regarding payment of those invoices. (See id. ¶ 11.) 2. The Policy Hanover issued a Technology Professional Liability Policy to Fishbowl, for the policy period July 17, 2019, through July 17, 2020. (Id. ¶¶ 3, 27; Declaration of Scott G.

Johnson [Doc. No. 32] Ex. 1 (the “Policy”).) The Policy provides “Cyber Business Interruption and Extra Expense” coverage (the “Coverage”), as follows: We will pay actual loss of “business income” and additional “extra expense” incurred by you during the “period of restoration” directly resulting from a “data breach” which is first discovered during the “policy period” and which results in an actual impairment or denial of service of “business operations” during the “policy period.” (Policy § A.b.1.b.(5); Proposed Am. Compl. ¶ 30.) The term “[b]usiness income” includes net income “that would have been earned or incurred if there had been no impairment or denial of ‘business operations’ due to a covered ‘data breach.’ ” (Policy § F.4.a; Proposed Am. Compl. ¶ 31.) “Business operations” means Fishbowl’s “usual and regular business activities.” (Policy § F.5; Proposed Am. Compl. ¶ 35.) “Data breach” is defined in seven

different ways in the Policy. (Policy § F.9.) 3. The “man in the middle” attack1 In November of 2019, an unknown individual (“fraudster”) gained unauthorized access to Ms. Williams’ e-mail account. (Proposed Am. Compl. ¶ 10.) Once inside Ms. Williams’ e-mail account, the fraudster created certain “rules” to redirect certain e-mail communications within the e-mail system. (Id. ¶ 12.) One rule redirected e-mail

communications containing certain keywords to an e-mail account that is not associated with Fishbowl. (Id. ¶ 13.) Another rule marked e-mail communications sent from “fedins.com” as having already been “read,” and automatically stored them in the “RSS Subscriptions” folder. (Id. ¶ 14.) These rules prevented Ms. Williams from noticing certain e-mail communications, including e-mails from Federated Insurance regarding

invoice payments. (Id. ¶¶ 12–14, 22.) The purpose of the scheme was to trick Fishbowl’s customers into paying invoices to the fraudster without Fishbowl noticing. (See id. ¶¶ 16–26.) Pursuant to this scheme, the fraudster directed six of Fishbowl’s customers to change how and where to make their payments. (Id. ¶ 22.) By employing a variety of techniques to conceal the scheme, the

fraudster posed as Ms. Williams when communicating by e-mail with Federated Insurance.

1 The term “man in the middle” refers to when “a person invades a system and masquerades as one or more of the entities involved in a communication.” (Proposed Am. Compl. ¶ 2.) (Id. ¶¶ 16, 18, 21.) And the fraudster posed as Federated Insurance when communicating by e-mail with Ms. Williams. (Id. ¶¶ 16–18.) As a result of the scheme, Federated

Insurance made two payments to the fraudster, totaling $176,962. (Id. ¶ 24.) Fishbowl discovered the scheme on January 17, 2020. (Id. ¶ 22.) After informing the six customers about the scheme, five of them were able to recall or redirect their payments. (Id. ¶ 23.) However, Federated Insurance was unable to do so. (Id.) Although the United States Secret Service recovered $29,035.79 of the monies paid by Federated Insurance to the fraudster, Fishbowl suffered a loss of the difference, which totaled

$147,926.21. (Id. ¶¶ 25–26.) 4. The Insurance Claim In January of 2020, Hanover received Fishbowl’s insurance claim seeking reimbursement for business interruption and losses due to the fraudster’s conduct. (Id. ¶¶ 36–37.) Within a few weeks, Hanover denied the claim. (Id. ¶¶ 41, 43.) Fishbowl

challenged the denial, and consequently, the parties disputed coverage over the next several months. (See id. ¶¶ 40, 42, 45–72.) 5. Fishbowl’s Complaint to the Minnesota Department of Commerce After nine months of disputing coverage, Fishbowl filed a complaint with the Minnesota Department of Commerce. (Id. ¶ 73.) In response, Hanover’s Property Claims Director, Jason Cormier, reviewed the claim again. (Id. ¶¶ 74–75.) He concluded, for Hanover’s sixth time, that this fraudulent scheme was not covered by the Policy, memorializing his conclusion in a letter denying coverage on November 19, 2020. (Id. ¶¶ 74, 77.)

C. Procedural History 1. The Civil Suit On March 24, 2021, Fishbowl filed the Complaint, alleging breach of contract and seeking declaratory and monetary relief. (Compl. [Doc. No. 1] ¶¶ 71–81.) During discovery, Fishbowl deposed Cormier. (Proposed Am. Compl. ¶ 78.) Fishbowl alleges that Cormier testified that, as defined by the Policy, Fishbowl “sustained a data breach” and “had suffered an actual loss of business income.” (Id.)

2. Plaintiff’s Motion to Amend On December 1, 2021, Fishbowl timely moved to amend the Complaint [Doc. No. 26], seeking to add a claim for bad faith under Minn. Stat. § 604.18. (Pl.’s Mem. [Doc. No. 28] at 1.) Fishbowl contends that Hanover acted with bad faith by repeatedly ignoring, and by failing to properly investigate, its claim and by failing to cover its loss. (Id.)

Especially in light of Cormier’s alleged concession that this was a data breach covered by the Policy, Plaintiff contends that Hanover acted in bad faith. (Id.) 3. The Order The magistrate judge denied the motion to amend as futile. (Order at 13.) In reaching that decision, the court analyzed whether Plaintiff had plausibly plead a claim for bad faith under Minn. Stat. § 604.18 in the Proposed Amended Complaint. (See id. 5–12.)

Under the first prong of the two-prong test, the magistrate judge found that Fishbowl had plausibly plead that Hanover lacked a reasonable basis for denying the Policy’s benefits. (Id. at 7–9.) The court explained that Cormier’s alleged deposition testimony that Fishbowl suffered a data breach and business loss under the Policy suggests an “ ‘absence of a

reasonable basis’ for his earlier denial of coverage.” (Id. at 8–9.) But the magistrate judge found that Fishbowl failed to plausibly plead the second prong of the test. (See id. at 7, 9–12.) The court concluded that it is an unresolved legal question whether the Coverage applied to losses caused by a “man in the middle” cyber- attack. (Id. at 11–12.) Because the law is unresolved, the court found the issue “fairly debatable,” and therefore, cannot serve as a basis for a claim of bad faith. (Id. at 12.)

Accordingly, the magistrate judge denied the motion to amend as futile. (Id. at 13.) 4. The Objection Fishbowl objects to the Order, making two arguments. First, Fishbowl contends that it plausibly plead a claim for bad faith under Minn. Stat. § 604.18. (Obj. at 8.) Second, Fishbowl contends that the magistrate judge improperly relied on information outside of

the pleadings. (Id. at 9–13.) II. DISCUSSION A. Legal Standard A district court conducts a de novo review of a magistrate judge’s denial of a motion to amend based on futility. Magee v. Trustees of the Hamline Univ., Minn., 957 F. Supp. 2d 1047, 1062 (D. Minn. 2013). Rule 15(a) of the Federal Rules of Civil Procedure provides that “[t]he court should freely give leave [to amend a pleading] when justice so

requires.” Fed. R. Civ. P. 15(a)(2). But “[a] district court may appropriately deny leave to amend where there are compelling reasons such as . . . futility of the amendment.” Moses.com Secs., Inc. v. Comprehensive Software Sys., Inc., 406 F.3d 1052, 1065 (8th Cir. 2005) (internal quotation marks omitted). Amendment is futile where the proposed

amended claim would not withstand a motion to dismiss for failure to state a claim. See Lunsford v. RBC Dain Rauscher, Inc., 590 F. Supp. 2d 1153, 1158 (D. Minn. 2008). When considering a motion to dismiss under Rule 12(b)(6), the Court accepts the facts alleged in the complaint as true and views those allegations in the light most favorable to the plaintiff. Hager v. Arkansas Dep’t of Health, 735 F.3d 1009, 1013 (8th Cir. 2013). However, the Court need not accept as true wholly conclusory allegations or legal

conclusions couched as factual allegations. Id. In addition, the Court ordinarily does not consider matters outside the pleadings on a motion to dismiss. See Fed. R. Civ. P. 12(d). Matters outside the pleadings include “any written or oral evidence in support of or in opposition to the pleading that provides some substantiation for and does not merely reiterate what is said in the pleadings,” as well as statements of counsel at oral argument

that raise new facts not alleged in the pleadings. Hamm v. Rhone-Poulenc Rorer Pharm., Inc., 187 F.3d 941, 948 (8th Cir. 1999) (internal quotation marks and citation omitted). The Court may, however, “consider the pleadings themselves, materials embraced by the pleadings, exhibits attached to the pleadings, and matters of public record.”2 Illig v. Union Elec. Co., 652 F.3d 971, 976 (8th Cir. 2011) (internal quotation marks and citation

omitted).

2 For purposes of this motion, the Court has considered the Proposed Amended Complaint and the Policy. To survive a motion to dismiss, a complaint must contain “enough facts to state a claim to relief that is plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570

(2007). Although a complaint need not contain “detailed factual allegations,” it must allege facts with enough specificity “to raise a right to relief above the speculative level.” Id. at 555. “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements,” are insufficient. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 555).

B. Analysis The Minnesota Legislature has created a private cause of action to penalize bad faith denial of benefits by insurance providers. See Minn. Stat. § 604.18. Under the statute, a party, after commencing a civil suit, “may make a motion to amend the pleadings to claim recovery of taxable costs.” Id., subd. 4. The applicable legal basis for establishing a claim under the statute is a two-prong test, which is as follows:

The court may award as taxable costs to an insured . . . if the insured can show: (1) the absence of a reasonable basis for denying the benefits of the insurance policy; and (2) that the insurer knew of the lack of a reasonable basis for denying the benefits of the insurance policy or acted in reckless disregard of the lack of a reasonable basis for denying the benefits of the insurance policy. Id., subd. 2(a). At this stage of the proceedings, plaintiff needs to plausibly plead facts that demonstrate each prong of the test in accordance with Rule 15 of the Federal Rules of Civil Procedure. See Selective Ins. Co. of S.C. v. Sela, 353 F. Supp. 3d 847, 866 (D. Minn. 2018). Because the amendment was denied as futile, the Court conducts a de novo review of the magistrate judge’s order.

1. The First Prong The Minnesota Supreme Court has held that “the first prong of the section 604.18 standard is an objective test.” Peterson v. W. Nat’l Mut. Ins. Co., 946 N.W.2d 903, 910 (Minn. 2020). The pertinent question is “whether a reasonable insurer under the circumstances would not have denied the insured the benefits of the insurance policy.” Id. Here, Plaintiff alleges, in the Proposed Amended Complaint, that Hanover lacked a

reasonable basis for denying the Policy benefits. Simply put, Plaintiff alleges that Cormier testified that “Fishbowl sustained a data breach” and that “Fishbowl had suffered an actual loss of business income” as defined under the Policy. (Id.) Assuming this is true, Hanover lacked a reasonable basis to deny Plaintiff the Policy’s benefits. Put differently, a reasonable insurer would not have denied the benefits when there was a covered data breach. Accordingly, the Court finds that Plaintiff has plausibly plead the first prong.3

2. The Second Prong The second prong is a subjective test, requiring a certain mens rea on the part of the insurer. Peterson, 946 N.W.2d at 912. Specifically, it requires “an insured to prove that the insurer knew, or recklessly disregarded or remained indifferent to information that

3 The Court finds that Plaintiff has plausibly plead the first prong based on Cormier’s alleged testimony and, therefore, does not address Plaintiff’s alternative argument that Hanover’s investigation was objectively unreasonable. would have allowed it to know, that it lacked an objectively reasonable basis for denying the insured’s claim for benefits.” Id.

Here, Plaintiff contends that it has plausibly plead the second prong by alleging that Hanover’s investigation was unreasonable. (Proposed Am. Compl. ¶¶ 36–72, 79–82.) Plaintiff alleges that Hanover’s investigation “failed to: request supplemental documentation from Fishbowl; obtain police reports regarding the incident; contact any relevant third parties; secure a formal statement from Williams; obtain recorded statements from any relevant individuals; or retain an expert to examine Fishbowl’s system.” (Id.

¶ 40, 49.) Similarly, Plaintiff contends that Hanover failed to reasonably evaluate whether first-party coverage was available under the Policy. (Id. ¶ 43, 52.) Given these failures, Plaintiff contends that Hanover’s investigation was unreasonable and thus asserts that it has plausibly plead the second prong. (See Obj. at 7–8.) Even if Plaintiff is correct as to the failures of Hanover’s investigation, a district

court will not grant a motion to amend the pleadings to add a bad faith claim where it is “fairly debatable” whether coverage applies. See, e.g., Swanny of Hugo, Inc. v. Integrity Mut. Ins. Co., No. A15-0370, 2015 WL 9437571, at *7 (Minn. Ct. App. Dec. 28, 2015) (affirming the district court’s denial of the motion to amend to add a bad faith claim under Minn. Stat. § 604.18 based in part on a finding that the claim was “fairly debatable”);

Homestead Hills Homeowner Ass’n v. Am. Family Mut. Ins. Co., No. A12-0703, 2012 WL 5896829, at *4 (Minn. Ct. App. Nov. 26, 2012) (same); Friedberg v. Chubb & Son, Inc., 800 F. Supp. 2d 1020, 1029 (D. Minn. 2011) (holding that the insurer’s interpretation was “at a minimum, fairly debatable,” which “precludes a finding of bad faith”); The Nw. Mut. Life Ins. Co. v. Weiher, Civ. No. 12-1430 (SRN/JSM), 2016 WL 6917204, at *17 (D. Minn. July 11, 2016) (“[The insurer’s] decision to rescind the policy is ‘fairly debatable,’

rendering the bad faith claim futile.”); Borchardt v. State Farm Fire & Cas. Co., No. 16- cv-00055 (PJS/KMM), 2017 WL 8315883, at *7 (D. Minn. Apr. 26, 2017) (“[T]he prima facie evidence submitted in support of the motion to amend shows that the plaintiffs’ claim was fairly debatable, and State Farm was entitled to debate it.”). Here, Hanover argues that the Coverage does not apply. (Def.’s Opp’n at 7–11.) First, Hanover argues that the Coverage only applies to potential earnings. (Id. at 7–8.)

Because Fishbowl alleges that it continued to earn revenue, but did not receive those payments due to the cybercriminal, Hanover argues that there are no lost prospective earnings that trigger the Coverage. (Id. at 8.) Second, Hanover argues that Plaintiffs’ “business operations” were never interrupted. (Id.). For example, Hanover contends that there is no “period of restoration.” (Id. at 9.) A “period of restoration,” Hanover contends,

limits coverage to the time during which an actual impairment or denial to Fishbowl’s “business operations” is restored. (Id.) Because Fishbowl does not allege that it restored its business operations, Hanover argues that it had a reasonable basis to deny coverage. (Id.) Lastly, Hanover argues that, because it is an unresolved legal issue whether the Coverage applies to a “man in the middle” attack, it could not have acted in bad faith when

denying coverage. (Id. at 11–12.) The Court finds that it is fairly debatable whether coverage applies. For example, Plaintiff alleges that a data breach triggered the Coverage. (Proposed Am. Compl. ¶¶ 36, 46, 53, 70.) To support this claim, Plaintiff cites the following “data breach” definition from the Policy:

The failure or violation of the security of your “system” including the impairment or denial of access to your “system”, including a “Cyber Attack” or unauthorized acts or omissions by a “rogue employee” which damages or harms your “system” or the “system” of a third party for whom you provide “services” for a fee. (Id. ¶ 34.) But Plaintiff cites no authority establishing that a “man in the middle” cyber- attack meets that definition. In fact, Plaintiff concedes that this is an open legal issue. (Hr’g Tr. [Doc. No. 48] 23:8–10.) And insurers are permitted to dispute coverage on open legal issues. See Sela, 353 F. Supp. 3d at 865 (“[B]ad faith arises only when the insurer has no ‘reasonable basis’ for its construction of the policy.”); Borchardt, 2017 WL 8315883, at *7 (explaining that the insurer is “entitled to debate” an issue that is fairly debatable); see also Philadelphia Indem. Ins. Co. v. Youth Alive, Inc., 732 F.3d 645, 650 (6th Cir. 2013) (explaining that, under Kentucky law, an “unresolved legal issue” means that the claim is “fairly debatable as a matter of law and will not support a claim of bad faith.” (internal quotation marks omitted).) Even if Plaintiff’s legal interpretation of the Policy might prevail, the fact that the issue is legally debatable precludes a bad faith claim. Minnesota law only permits amendment to add a bad faith claim in “the absence of a reasonable basis.” Minn. Stat.

§ 604.18, subd. 2 (emphasis added). Put differently, the insurer’s interpretation must be more than merely incorrect—it must be unreasonable. See Sela, 353 F. Supp. 3d at 865 (D. Minn. 2018) (“Bad faith does not arise simply because the insurer’s construction of the policy was subsequently found to be legally incorrect.” (internal quotation marks omitted)). In the absence of any caselaw that controls whether a “man in the middle” attack constitutes a data breach on the Policy, the Court finds Hanover’s interpretation reasonable. See

Friedberg, 800 F. Supp. 2d at 1027 (“[The insurer’s] interpretation of the terms, is at the very least fairly debatable and thus not in bad faith.”). For these reasons, the Court finds that it is fairly debatable whether the Coverage applies and thus Plaintiff’s amendment is futile. III. CONCLUSION Based on the submissions and the entire file and proceedings herein, IT IS

HEREBY ORDERED that: 1. Plaintiff Fishbowl Solutions, Inc.’s Objection [Doc. No. 47] is OVERRULED; and 2. The Magistrate Judge’s April 6, 2022 Order [Doc. No. 45] is AFFIRMED.

Dated: May 9, 2022 s/ Susan Richard Nelson SUSAN RICHARD NELSON United States District Judge