Maritz Holdings, Inc. v. Certain Underwriters at Lloyd's London Subscribing to Policies Numbered B122FI0115 and FI0115116

• Court: District Court, E.D. Missouri
• Decided: November 10, 2020
• Docket: 4:18-cv-00825
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MISSOURI EASTERN DIVISION

MARITZ HOLDINGS INC., ) ) Plaintiff, ) ) ) vs. ) Case No. 4:18-CV-00825 SEP ) CERTAIN UNDERWRITERS AT ) LLOYD’S LONDON SUBSCRIBING TO ) POLICIES NUMBERED B122F10115115 ) AND F10115116, et al., ) ) Defendants. )

MEMORANDUM AND ORDER

This matter is before the Court on Defendant Certain Underwriters at Lloyd’s London Subscribing to Policies Numbered B122F10115115 and F10115116’s (“Underwriters”) Motion to Compel pursuant to Federal Rules of Civil Procedure 34 and 45. Doc. [111]. The Motion to Compel is directed to Plaintiff Maritz Holdings Inc. (“Maritz” or “Plaintiff”) and non-party Intersec Worldwide, Inc. (“Intersec”). Underwriters requests that this Court: (1) order Maritz to produce all documents in its possession, custody or control which are responsive to Request Nos. 11-13, 16-18, and 29 in the Requests for Production (“RFP”) submitted by Underwriters to Maritz; (2) order Intersec to produce all documents in its possession, custody or control which are responsive to Request Nos. 3-12, 14, 28-30, 31, 34, and 35 in Schedule A of Underwriters’s subpoena duces tecum to Intersec; (3) order Intersec to produce complete, accessible and coherent copies of all documents that have been previously produced by Intersec in a format that is incomplete, inaccessible and/or incoherent; and (4) order Maritz to produce all communications with and records of its privacy counsel and its coverage counsel at Thompson Coburn LLC (“Thompson Coburn”) that are responsive to the RFPs to Maritz. The parties appeared at a hearing in the courtroom of the undersigned on October

21, 2020, to discuss this Motion to Compel, as well as Defendant Arthur J. Gallagher Risk Management Services, Inc.’s (“Gallagher”) Motion to Compel directed against Underwriters and Clyde & Co. US LLP (“Clyde”). See Doc. [66]. After that hearing, the Court granted Gallagher’s Motion to Compel. See Doc. [161]. Due to time constraints, the instant Motion was not resolved at the hearing but was instead taken under consideration by the Court. I. Factual and Procedural Background This case involves a dispute over insurance coverage for alleged losses arising out of cyber-security breaches experienced by Plaintiff, through which certain electronically stored gift card information was stolen. Underwriters issued breach-response insurance coverage to Maritz for 2015 through 2017 under two separate policies (“Policies”). Those policies

provided coverage for, among other things, certain fees and costs Maritz might incur in responding to such a security breach. Maritz experienced two cyber-security breaches: one in March 2016, and another in February 2017. Following the first security breach, Maritz retained forensic firm Charles River Associates (“CRA”) to investigate and terminate the perpetrators’ access to Maritz’s systems. For the second breach, Maritz retained a different forensic firm, Intersec, to investigate and terminate the breach. Maritz submitted claims to Underwriters for expenses it alleges are covered under the Policies. Maritz seeks coverage under Section I.D, the “Breach Response Costs Insuring Agreement”1 and Section I.G, the “Restoration Costs Insuring Agreement”2 of the Policies. Those sections of the Policies do not cover betterment or improvement work of Maritz’s digital systems, but instead cover work performed by CRA and Intersec that was necessary to investigating and terminating the breaches, and to replacing, restoring, or recreating Maritz’s

digital assets to their pre-breach condition. The Policies also include Exclusion Clause IV.R, which applies to the Restoration Costs Insuring Agreement, and which expressly bars coverage for “updating” or “upgrading” Maritz’s digital assets and systems. Underwriters denied coverage on Maritz’s claims, after which Maritz filed the instant action, asserting claims for breach of contract and vexatious refusal against Underwriters, and seeking damages of between approximately $4.5 and 5.5 million. During the course of discovery, Underwriters served RFPs on Maritz and Intersec, each of which declined to produce certain documents and information responsive to the RFPs. More specifically, Maritz withheld certain information regarding the work and costs related to its systems repair or upgrades, which would have been responsive to RFP Nos. 11-13, 16-18, and 29, on grounds

that the RFPs at issue were overbroad and unduly burdensome. Maritz also withheld its communications with its attorneys at Thompson Coburn in that firm’s capacity as both privacy counsel and coverage counsel, on the basis of attorney-client privilege. Additionally, although Intersec produced documents and information in response to RFP Nos. 3-12, 14, 28-30, 31, 34, and 35, Underwriters alleges that certain of those documents were inaccessible (due to, for example, being password protected) or were produced in an incoherent format. After the

1 The Breach Response Costs Insuring Agreement covers “forensic professional fees and expenses to determine the cause and extent of such security breach and terminate the security breach (however, betterment of the computer system is not covered).” 2 The Restoration Costs Insuring Agreement covers the “actual, reasonable and necessary costs [Maritz] incur[s] to replace, restore, or recreate [Maritz’s] Digital Assets to the level or condition at which they existed prior to sustaining any Loss . . ..” parties were unable to come to an agreement regarding the discovery requests, Underwriters filed the instant Motion to Compel to enforce compliance with the RFPs. As further discussed below, Underwriters’ Motion to Compel will be granted in part and denied in part. II. Discussion

i. Legal Standard Federal Rule of Civil Procedure 26(b)(1) states that “[p]arties may obtain discovery regarding any nonprivileged matter that is relevant to any party’s claim or defense and proportional to the needs of the case, considering the importance of the issues at stake in the action . . . the parties’ relative access to relevant information, the parties’ resources, the importance of the discovery in resolving the issues, and whether the burden or expense of the proposed discovery outweighs the likely benefit.” Fed. R. Civ. P. 26(b)(1). Courts construe Rule 26(b)(1) broadly. See Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340, 351 (1978). “Given that the [FRCP] allow[s] for broad discovery, the burden is typically on the party resisting discovery to explain why discovery should be limited.” Cincinnati Ins. Co. v. Fine

Home Managers, Inc., 4:09CV234-DJS, 2010 WL 2990118, at *1 (E.D. Mo. July 27, 2010). However, courts should be mindful that the scope of discovery is intended to focus on the actual claims or defenses that are at issue in the litigation. See, e.g., Mallak v. Aitkin County, No. 13- cv-2119 (DWF/LIB), 2016 WL 8607391, *6, (D. Minn. June 30, 2016). This standard applies to requests for production between litigants pursuant to Federal Rule of Civil Procedure 34, as well as to subpoenas duces tecum under Federal Rule of Civil Procedure 45. See Fed. R. Civ. P. 34; Prime Aid Pharmacy Corp. v. Express Scripts, Inc., No. 4:16-CV-1237, 2017 WL 3129807, *1 (E.D. Mo. July 24, 2017) (applying Rule 26(b) to subpoena duces tecum). A party responding to a request for production under Federal Rule of Civil Procedure 34 or to a document subpoena under Federal Rule of Civil Procedure 45 must produce material in its possession, custody, or control, to the extent such material is otherwise relevant and discoverable. See Fed. R. Civ. P. 34(a)(1); 45(a)(1)(iii). Electronic documents are to be produced in the same

manner as they are kept in the normal course of business or otherwise in a manner organized to correspond to the categories of the relevant document request. See Fed. R. Civ. P. 34(b)(2)(E)(i); 45(e)(1)(A). ii. Parties’ Agreement on Certain Discovery Matters The parties have represented to the Court that, since this Motion to Compel was fully briefed, they have reached an agreement with respect to certain information requested by Underwriters. The parties state that they have agreed to provide to Underwriters by no later than November 12, 2020, the following items: (a) Any and all internal memoranda or report(s) prepared by Maritz discussing: (i) the security of data or information stored in any of Maritz’s electronic systems from January 1, 2014, to January 1, 2018; (ii) the state of Maritz’s data security software, hardware, protocols, procedures, or systems from January 1, 2014, to January 1, 2018; and/or (iii) any change, alteration, or improvement to any of the Maritz’s electronic systems considered, proposed, contemplated, executed, or implemented by Maritz from January 1, 2014, to January 1, 2018. (b) Any and all memoranda or report(s) prepared for Maritz by any other Person (or entity) discussing (a) through (c) above. (c) Any and all board minutes from Maritz or any subsidiary of Maritz discussing (a) through (c) above. (d) All communications to or from any person at Maritz with decision making authority as respects the security of Maritz’s electronic systems discussing (a) through (c) above. (e) All communications between Maritz and Intersec relating to the RFP [the “Request for Proposals”] that Maritz was corresponding with Intersec about prior to the 2017 breach and/or any services, system changes and/or system improvements contemplated in connection with that RFP. Additionally, Maritz has agreed to produce its privacy counsel’s files, including all communications between Melissa Ventrone at Thompson Coburn and Maritz by no later than November 12, 2020. Finally, Maritz and Intersec have provided a password that they assert will permit access to all Intersec documents already produced that Underwriters has been unable to access due to their password-protected state. The Court acknowledges the agreement reached by the parties as described above and will order Maritz and Intersec to produce all documents and information encompassed by the agreement by no later than November 12, 2020. iii. RFP Nos. 11-13, 16-18, and 29 to Maritz and RFP Nos. 3-12, 14, 28-30, 34, and 35 in Schedule A of Subpoena to Intersec CRA’s and Intersec’s fees make up a majority of the costs for which Maritz seeks coverage in this lawsuit. Underwriters asserts that some evidence suggests that Maritz may have included in the costs submitted to Underwriters for coverage under the Policies certain Intersec fees related to improvements to Maritz’s digital systems, which are not covered. For example, another of Maritz’s insurers, Defendant Affiliated FM, retained a forensic investigator, Envista Forensics, LLC (“Envista”) to review the Intersec invoices submitted by Maritz when making its claim under the Policies. Underwriters asserts that Envista concluded

that the invoices reflected significant improvement work. Additionally, Underwriters asserts that Maritz has admitted that some portion of the work reflected in the Intersec invoices was for uncovered improvements. Furthermore, Intersec’s fees related to the second breach were significantly higher than the fees charged by CRA for work performed in connection with the first breach, and Underwriters argues that this suggests that Intersec’s invoices may have included fees for uncovered improvements. On October 30, 2018, Underwriters submitted certain RFPs to Maritz, which were intended to gain information about the state of Maritz’s digital systems before and after each breach, in order to more fully understand whether any portion of the fees submitted by Maritz to Underwriters may be associated with uncovered improvements to Maritz’s digital assets.

RFP No. 13 requested communication with any vendor retained in connection with the breaches, including CRA and Intersec, as well as documents related to such communication. RFP Nos. 11 and 12 sought production of documents related generally to the costs Maritz claims are covered by the Policies. RFP Nos. 16-18 and 29 sought production of documents related to the pre-breach state of Maritz’s systems, and any change or improvement to those systems that was contemplated by Maritz before either of the breaches. Underwriters asserts that it cannot fully and independently assess which, if any, Intersec fees were for improvements, and were thus uncovered, unless they have a more complete picture of the state of Maritz’s digital systems before and after each of the breaches. Underwriters also submitted to Intersec, in a subpoena duces tecum, similar RFPs

seeking information about Maritz’s digital systems, the work performed by Intersec, and related communications between Maritz and Intersec. Intersec produced certain documents responsive to the RFPs, but according to Underwriters, “Intersec has failed to produce essentially any documents relating to the upgrades to Maritz’s systems that Maritz contemplated before the second breach.” Doc. [113] at 12. Additionally, Underwriters alleges that many of the documents produced by Intersec were incomplete or inaccessible for various reasons. For example, certain of the documents were password protected, and the necessary passwords were not provided, while some documents were allegedly missing attachments or were produced in an incoherent format. Maritz objected to these requests, asserting that they were vague, ambiguous, overbroad, and unduly burdensome, or do not seek relevant documents. Maritz agreed to produce only “reports” provided by CRA and Intersec. Underwriters and Maritz subsequently met and conferred regarding their disagreement about these requests in April and September of

2019. Pursuant to those discussions, in October 2019, Underwriters reached an agreement with Maritz and Intersec to narrow the scope of requested materials to certain subsets of documents,3 and Maritz and Intersec agreed to produce the information sought. Underwriters also requested that Intersec cure the deficiencies identified in certain documents produced, including providing a valid password for the protected documents, but Intersec never responded to that request. As of February 2020, none of the agreed-upon documents or information had been provided by Maritz or Intersec. Underwriters then filed the instant Motion to Compel, asking this Court to compel Maritz to produce materials responsive to RFP Nos. 11-13, 16-18, and 29, and ordering Intersec to turn over all remaining materials responsive to RFP Nos. 3-12, 14, 28-30, 31, 34,

and 35 in Schedule A of the Subpoena duces tecum to Intersec. Underwriters also asks the Court to order Intersec to produce complete, accessible and coherent copies of all documents that have been previously produced by Intersec in a format that is incomplete, inaccessible and/or incoherent. Underwriters argues that the material requested in the disputed RFPs and subpoena is plainly relevant to the claims and defenses at issue in this case. The Court agrees. The requested information pertains to work performed by Intersec for which Maritz seeks reimbursement from Underwriters in its claim on the Policies. Documentation and

3 Underwriters made this concession without prejudice to its rights to seek further information in the future. See Doc. [113] at 13. communications discussing the status of Maritz’s digital systems before and after each of the breaches clearly bears on the question of whether the Intersec fees for which Maritz seeks reimbursement were related to covered work or to uncovered improvements. Further, Underwriters has demonstrated that the material sought is proportional to the

needs of the case. Maritz seeks to recover approximately $5.2 million in Intersec fees and costs. This represents the vast majority of the damages sought by Maritz in this litigation. Accordingly, information and documentation that sheds light on the nature of Intersec’s work for Maritz seems neither overreaching nor unduly burdensome. Because the material sought by Underwriters is both relevant to the claims and defenses in this action and proportional to the needs of the case, the Court concludes that Maritz and Intersec must produce the material in question. Based on the parties’ representations to the Court about their recent agreement regarding these discovery disputes, as discussed supra, it appears that Maritz and Intersec have agreed to produce much of the disputed material. Additionally, it seems that Intersec has

agreed to correct its deficient production with respect to password protected and otherwise inaccessible information. The Court expects that Maritz and Intersec will comply with the agreement among the parties as represented to the Court and provide the material in question by no later than November 12, 2020. To the extent that the parties’ agreement did not resolve all issues with respect to the disputed RFPs and the subpoena, the Court will order production of all material that is responsive to RFP Nos. 11-13, 16-18, and 29 directed to Maritz, and RFP Nos. 3-12, 14, 28-30, 31, 34, and 35 in Schedule A of the subpoena duces tecum to Intersec. iv. Communications Between Maritz and Thompson Coburn Maritz retained Melissa Ventrone of Thompson Coburn to address the legal privacy concerns that were expected to arise in connection with the breaches. During the course of discovery, Underwriters requested that Maritz produce all communications with and records of Thompson Coburn in its capacity as privacy counsel. Underwriters argues that the information is relevant to the claims in this case because Maritz, in its claim submitted on the Policies, included

invoices relating to the work performed by privacy counsel. Maritz objected to these requests on the basis of attorney-client privilege. Underwriters argues that because Maritz and Underwriters shared a common interest with respect to the privacy work performed by Thompson Coburn, the attorney-client privilege does not shield its production. See Coregis Ins. Co. v. Lewis, Johs, Avallone, Aviles, and Kaufman, LLP, 01-CV-3844 (SJ), 2006 WL 2135782, at *15 (E.D.N.Y. July 28, 2006) (the common interest rule “allows” an insurer aligned in interest with the insured to have access to privileged communication between the insured and its counsel, without breach of the attorney-client privilege.”). As discussed supra, the parties have come to an agreement with respect to the request for production of communications between Maritz and its privacy counsel. Maritz has conceded that

the requested communications are not privilege-protected and has agreed to produce its privacy counsel’s files, including all communications between Melissa Ventrone at Thompson Coburn and Maritz, by no later than November 12, 2020. The Court expects that Maritz will comply with the terms of the agreement reached between the parties and will order such compliance to the extent the relevant production has not been completed by November 12, 2020. Maritz also retained Thompson Coburn to represent it in connection with this matter as coverage counsel, in which capacity it assisted Maritz with the claims processes and Maritz’s efforts to recover insurance proceeds for Maritz’s incurred losses. Underwriters requested that Maritz produce all communications with and records of Thompson Coburn in its capacity as coverage counsel with respect to the breaches. Maritz objects to the request, arguing that these communications are absolutely protected by the attorney-client privilege. Underwriters argues that these communications “must be produced to the extent that any such production [of communications between Underwriters and its coverage counsel, Clyde & Co.] is ordered” by

the Court. See Doc. [113] at 18. Some background is necessary to understand Underwriters’s argument with respect to this matter. The parties have been embroiled in a related discovery dispute, during which Defendant Arthur J. Gallagher Risk Management Services (“Gallagher”)4 filed a Motion to Compel production by Underwriters of communications with its coverage counsel, Clyde & Co. US LLP (“Clyde”), including Clyde’s claims file prepared in connection with the breaches. See Doc. [66]. After Gallagher filed its Motion to Compel, Maritz filed a memorandum in support of Gallagher’s motion. See Doc. [90]. Underwriters and Clyde objected, maintaining that communications between Underwriters and Clyde were protected by the attorney-client privilege because Clyde’s involvement was solely that of coverage counsel in advising Underwriters as to

whether coverage existed under the law with respect to Maritz’s Policies. However, Gallagher and Maritz argued that Clyde was deeply involved in the adjustment of the claim and participated in Underwriters’ factual investigation and determination of coverage. They further asserted that to the extent Clyde’s actions with respect to Maritz’s claims were akin to that of an insurance company adjusting a claim, the attorney-client privilege did not apply and could not protect the contents of Clyde’s claims file. Generally speaking, communications between an insurer and its outside coverage counsel are privileged, so long as coverage counsel is providing an insurer with advice as to whether or

4 Gallagher is an Illinois based insurance brokerage service that acted as Maritz’s broker with respect to the Policies. not coverage exists under the law. Conversely, to the extent that outside coverage counsel engaged in processing and adjusting the claim, the privilege does not apply. See Workman v. The Cincinnati Ins. Co., No. 2:17-cv-00036 PLC, 2017 WL 6025999, at *3 (E.D. Mo. Dec. 5, 2017) (“[T]o the extent that an attorney acts as a claims adjuster, claims process supervisor, or

claims investigation monitor, and not as a legal advisor, the attorney/client privilege does not apply.”); Bertalo’s Restaurant Inc. v. Exchange Ins. Co., 240 A.D.2d 452, 454-55 (N.Y. 1997) (“The payment or rejection of claims is a part of the regular business of an insurance company. Consequently, reports which aid it in the process of deciding which of the two indicated actions to pursue are made in the regular course of its business. Merely because such an investigation was undertaken by attorneys will not cloak the reports and communications with privilege because the reports, although prepared by attorneys, are prepared as part of the regular business of the insurance company.”). After considering the briefing on the motion, together with the parties’ arguments at the discovery hearing held before the undersigned on October 21, 2020, the Court concluded that to

the extent Clyde had been acting in the nature of a claims adjustor, the attorney-client privilege would not serve to protect the factual results of Clyde’s investigation of the breaches. Consequently, the Court granted Gallagher’s Motion to Compel, and ordered Underwriters and Clyde to produce unredacted versions of all non-privileged documents and information that were responsive to Gallagher’s requests for production. See Doc. [161]. Turning now to the instant Motion to Compel, Underwriters does not adequately explain the significance or relevance of communications between Maritz and its coverage counsel to the disputes in this case, and it has not provided the Court with any principled rebuttal to Maritz’s assertion that the communications are protected by the attorney-client privilege. Indeed, the reasons proffered by Underwriters can best be boiled down to an argument that it is only fair that if they have to produce their communications with Clyde, then Maritz should have to produce their communications with coverage counsel at Thompson Coburn. In its reply to Maritz’s memorandum in opposition to the Motion to Compel, Underwriters states that “[i]f Underwriters

are ordered to produce their lawyers’ communications, Maritz needs to produce its lawyers’ communications too.” See Doc. [145] at 14. In other words, if Clyde’s files are not protected by the attorney-client privilege, then Thompson Coburn’s coverage-related communications with Maritz also lose their privilege. Maritz argues that Underwriters’s position is fundamentally misguided, because Clyde was not acting as coverage counsel with respect to the breaches, but rather, was investigating or adjusting the losses associated with the breaches. The Court agrees. The undersigned has already determined that Clyde’s files in connection with the breaches and its communications with Underwriters are not protected by the attorney-client privilege to the extent that Clyde was acting as an adjustor of the claim and not as legal counsel. The documents created by Clyde

during its investigation of the breaches are discoverable because such documents would be discoverable if Underwriters were to perform the same function in-house rather than outsourcing that function to Clyde. Meanwhile, Thompson Coburn did not similarly perform the role of an insurer in its work as coverage counsel. Rather, Thompson Coburn advised its client, the insured—Maritz—in connection with Maritz’s efforts to recover insurance proceeds under the Policies. Clyde and Thompson Coburn do not stand in the same shoes with respect to the work they performed in connection to the breaches, and Underwriters has not shown why the communications between Maritz and Thompson Coburn should be produced. Underwriters’s arguments to the contrary seem little more than gamesmanship, which is strongly disfavored by this Court. As all parties to this litigation surely know, discovery is not conducted on a “tit-for- tat” basis; rather, each litigant is expected to act with the utmost good faith at all times. Accordingly, IT IS HEREBY ORDERED that Defendant Underwriters’s Motion to Compel (Doc. [111]) is GRANTED in part and DENIED in part. Maritz must produce all documents in its possession, custody, or control that are responsive to Request Nos. 11-13, 16-18, and 29 in the RFP issued by Underwriters to Maritz. Intersec must produce all documents in its possession, custody, or control that are responsive to Request Nos. 3-12, 14, 28-30, 31, 34, and 35 in Schedule A of the Subpoena duces tecum to Intersec, and Intersec must further produce complete, accessible and coherent copies of all documents that it previously produced in incomplete, inaccessible and/or incoherent format. And finally, Maritz must produce all communications with and records of its privacy counsel at Thompson Coburn that are responsive to the RFPs. Underwriters’s request that this Court order Maritz to produce communications with and records of its coverage counsel at Thompson Coburn is denied.

IT IS FURTHER ORDERED that, as agreed by the parties, Maritz and Intersec shall produce all responsive materials by no later than November 12, 2020.

Dated this 10th day of November, 2020. bok C be SARAHE.PITLYK ————™