Delaware Supreme Court - Breach of Contract and Negligence
Summary
The Delaware Supreme Court reversed and remanded a lower court's dismissal of breach of contract claims filed by insurers against Blackbaud, Inc. The insurers, as subrogees and assignees, alleged Blackbaud failed to protect client data after a ransomware attack. The court found the amended complaints adequately pled a breach of contract claim.
What changed
The Delaware Supreme Court has reversed a Superior Court decision that dismissed breach of contract claims filed by Travelers Casualty and Surety Company of America and other insurers against Blackbaud, Inc. The insurers, acting as subrogees and assignees of Blackbaud's clients, alleged that Blackbaud's failure to adequately address a major ransomware attack and protect sensitive client data constituted a breach of contract. The Supreme Court found that the insurers' amended complaints met the minimum pleading requirements and adequately stated a claim for breach of contract, overturning the lower court's dismissal with prejudice.
This decision has significant implications for Blackbaud and potentially other technology service providers, particularly those handling sensitive data for non-profit and educational clients. While the case is remanded for further proceedings, the ruling clarifies that such insurers, under subrogation or assignment, can pursue breach of contract claims if a data breach results in losses. Regulated entities and their legal counsel should review their contractual obligations and data security protocols in light of this ruling, especially concerning potential liabilities arising from cyber incidents and the ability of insurers to recover damages through contractual claims.
What to do next
- Review contractual obligations related to data security and breach notification.
- Assess current data protection measures against potential liabilities arising from cyber incidents.
- Consult legal counsel regarding potential exposure and contractual remedies in light of this ruling.
Source document (simplified)
IN THE SUPREME COURT OF THE STATE OF DELAWARE TRAVELERS C ASUALTY AND SURETY COMPA NY OF AMERICA, and P HILADELPHIA INDEMNITY INS URANCE COMPANY, AC ADIA INSURANCE COMPANY, and U NION INSURANCE COM PANY, Plaintiffs Below, Appellants, v. BLACKBAUD, I NC., Defendant Below, Appellee. § § § § § § § § § § § § § § § § § C.A. No. 19 3, 2025 C.A. No. 198, 202 5 Court Below: S uperior Court of the Stat e of Delaw are C.A. No. N22C- 12 -1 30 C.A. No. N22C- 12 -141 Submitted: Novembe r 19, 2025 Decided: February 13, 202 6 Before SEITZ, Chief Justice; VALIH URA, TRAYNOR, LEGROW, and GRIFFITHS, Ju stices, constituting the Court en Banc. Upon appeal from the Superior Cour t. REVERSED AND REMANDED. Kurt M. He yman, Esquire, (arg ued), HEYMAN EN ERIO GATTUSO & HIRZEL LLP, Wilmington, Delaware, for Travelers and Surety Company of America, Plaintiff Below/A ppellant. Lisa C. McLaughli n, Esquire, PHILLIPS, McLAUGHLIN & HALL, P.A., Wilmington, Delaware; Ken neth T. Levine, Esquire, (argued), de LUCA L EVINE LLC, East Norr iton, Pennsylva nia, for Philadelp hia Indemn ity Insurance Company, Acadia Insurance Comp any, and Union Insurance Company, Plainti ffs Below/Appella nts.
2 John P. DiTom o, Esquire, Jialu Zou, E squire, MORRIS, NICHOLS, ARS HT & TUNNELL LLP, W ilmington, Delaware; Sarah Fulton H utchins, Esquire, (argue d), Corri A. Hop kins, Esquire, PARKER POE ADAMS & BERNSTEIN LLP, Charlotte, North C arolina, for Blackbaud, Inc., Defenda nt Below /Appellee.
3 SEITZ, Chief Jus tice: Blackbaud, Inc., a software application and data hosting provider for non- profits, suffered a major ransomware a ttack. The hacker infiltrated Blackbaud’ s servers and stole sensitive client data. Blackbaud’ s clients lost faith that t he company would ad dress the h arm and reimburs e them for their l osses. The client s conducted their own investigations and took remedial steps t o mitigate th eir losses. Their insurers cove red some of the losses and then sued Black baud as subrogees/assign ees to recover their paym ents to the in sureds. The Superior Co urt dismissed the original complain ts for failing to state a claim. In response, t he insurers file d amen ded complaints. The Superior Court dismissed the amended complaints, this time with p rejudice. It held that the insurer s fail ed to allege factual support for each Blackbau d client’ s cl aims and, as a legal matter, failed to plead prox imate cause. On appeal, the insurers ar gue that the court should not have dismissed the amended complai nts b ecause they met the Superior Court’ s minimum pleading requirements. They also contend that t he court should not have dismissed the amended complaints with prejudice. For the rea sons explained below, we reverse because the i nsuranc e carriers, as s ubroge es /assignees, adequately pled a breac h of contract claim in their amended complaints. Given our ruling, we need not address the second issue on appeal.
4 I. A. According to the amended c omplaints, Blackbau d is a software company that provides donor relationship manageme nt software and information technology services to their educational and non -profit client s. 1 T ravelers Casualty and Surety Company of America (“T ravelers”), Philade lphia Indem nity Insura nce Com pany, Acadia Insurance Company, and Union Insurance Company (“Philadelphia Indemnity”) (toge ther with T ravelers the “I nsurers”) provided insu rance coverage to 97 of Black baud’ s educational and non-pro fit clients for cyber and crim inal incidents like data breaches. 2 The Ins urers wrote policies that cover ed losses in excess of re tentions f or damages caused by data breaches. 3 T he poli cies allow ed the Insurers to subrogate, or stand in the shoe s of the insureds, to recoup p ayments for certain l osses arising from da ta breach es. 4 The Insurers also obtained contrac t assignments from Blackbaud clien ts. 5 W e will refer to the Blackbaud clients as the “In sureds.” 1 App. to Philadelphia Opening Br. at A66-67 [hereinafter A]; App. to T ravelers Opening Br. at AA70-71 [hereinafter AA]. 2 A63-65, A67; AA69-71, AA189. 3 A62, A65-66; AA6 8 -70. 4 A6 5-66; AA70. 5 A180; AA195.
5 B. Blackbaud and t he Insureds signe d Blackbaud Solutions Agreements (the “Agreements”). 6 The Agreements were id entical for all the Insureds and are governed by New Y ork law. 7 Blackbaud hosted the Insured s’ sensiti ve donor data on its servers. 8 The In sureds used Black baud’ s software applications to collect payments and transac t with donors. 9 In the Agreements, Blackba ud agreed to protect the Insureds’ sensitive data as fo llows: • maintain administr ative, physical, and technical safeguards; • protect against anticipated threats or hazards to the security of confide ntial information; • protect against unauthori zed access to or use of confidential informat ion that could materially harm the Insureds; • maintain comme rcially reasona ble information security procedures an d standards; • implement commercially reasonable, written p olicies and procedures ad dressing potential sec urity breaches; • have a breach re sponse plan in p lace; and 6 A67, A176-180; AA71 -72, AA191-95. 7 A176-180; AA191-95. 8 A6 7-69, A71; AA71-73, AA76. 9 A67; AA71.
6 • use commercially reasonab le ef forts to mitigate any negative consequences resulting directly from a breach and provide 72-hour notice of any breac h. 10 C. In 2020, a cy ber attacker access ed Blac kbaud’ s system for several mont hs and exfiltrated confidential customer data from its servers. 11 T he attacker threatened to publish the d ata unless Blackbaud paid a ransom. 12 On J uly 16, 2020, Blackbau d revealed t he breach on its w ebsite. 13 T he w ebsite notice sta ted that “ [n]o action i s requi red on your end because no per sonal inform ation about your constituent s was accessed.” 14 Blackbaud filed a Form 10- Q on August 4, 2020, dis closing the breach but characterizing the e xfiltration of sensitive donor i nformation as hypothet ical. 15 In a later Se ptember 29, 2020 Form 8-K filing, Blackbaud s tat ed that “the cybercr iminal may ha ve accessed some u nencrypted fie lds intended for bank a ccount inf ormation, 10 A177; AA192. 11 A72-76; AA78-80. 12 A75; AA80. This data included full names, age, date of birth, social security numbers, home addresses, phone number s, email addresses, finan cial information, medical information, gender, religious beliefs, marital status, spouse names, spouses’ donation history, employment information, educational information, and account credentials. A75; AA81. 13 A76; AA82-83. 14 A76; AA83 (emphasis in original). 15 A77; AA83.
7 social securi ty numbers, user names and/or passwo rds.” 16 In 2023, Blackbaud agreed to pay a $3 mi llion fine to t he Securities and Exchange Comm ission to resolve charges that the company made mislea ding disclosures about t he cyber security at tacks. 17 Blackbaud also pa id $49 million to resolve state law claims brought by the a ttorneys general of a ll 50 states. 18 D. The Insureds claimed that, instead of addressing t he cyberattack and protecting the Insureds, Bl ackbaud failed to conduct an adequate investigation of the breach. 19 T hey also contended tha t, even though se nsitive customer da ta resided o n Blackbaud’ s servers, Blackbaud shifted the i nvestigati ve burd en and remediatio n effor ts onto the Insureds. 20 For instance, Blackbaud provided the Insured s a “T ool kit” with instructions to complete their own investiga tions. 21 The T oolkit listed “next steps,” such as inve stigating the data involved in the br each, c onsulting w ith legal counse l, and notifying com promised don ors. 22 16 A77; AA84. 17 A78; AA84. 18 A78-80; AA84-87. 19 A91-94; AA9 8-101. 20 A94-98; AA101-105. 21 A94-96, A181-91; AA102-05, AA196-206. 22 Id.
8 Dissatisfied with Blackbaud’ s response to the cyberattack, the Insureds conducted their own inve stigations and remediation and made claims agai nst their insurance policies for those expen ses. 23 Philadelphia Indemnity paid over $600,00 0 to its Ins ureds. 24 T ravelers paid over $1. 5 million. 25 E. The Insurers filed suit agai nst Blackbaud in Superi or Court as subrogees/assi gnees of their Insureds. They alleg ed b reach of contract and negligence claims against Blackbaud and s ought to recover payments the Insurers made to their Insure ds for inv estigation and remediation expenses. 26 Blackbau d responded w ith a motion to dismiss and for judgment o n the p leadings. The court granted Blackbaud’ s motion. It held that t he original complaints fail ed to state a claim for breac h of contract, neglige nce, or gross negli gence. 27 After the court denied their motion for rear gument, the Insurers filed amended complaints. 28 The court dismissed the amended complaints, t his time with 23 A91-94; AA95-101. 24 A62, A94. 25 AA68, AA101. 26 A14-27; AA20-33. 27 T ravelers Cas. & Sur ety C o. of Am. v. Blackbaud, Inc., 2024 WL 1298762, at *13 (Del. S uper. Mar. 27, 2024). 28 A61-1 1 1; AA67-124.
9 prejudice. 29 It found that “a complaint m ust include specif ic alle gations suppor ted by facts,” and by pleading t he Insure ds’ claims in the aggregate, the Insurers “fail[ed] to prov ide t he required factual support for any insured’ s claim and d [id ] not adequately allege a subrogation cla im.” 30 T he court also held that, even if pleading in the aggregate was su ff icient, “the amended complaints fail to adequate ly plead proximate cause because they fa il t o link the a lleged damages to any contrac t term.” 31 T o plead proximate cause, the court held, the Insurers could no t rely on a contract term “that required Blackbaud to mitigate negative consequence s of a data breach.” 32 Finally, the court held that the Insured s could not rely on “conclusory allegations of m isrepresentation s” to plead proxima te cause. 33 II. On appeal, the Insurers ar gue that the Su perior Cou rt erred when it found that the Insurers could not, as a mat ter of law, plead their breach of contract claims in the aggregate. According to the Insurers, nothing in Delaware law prohibits ag gregate d pleading of subrogation claims, and any other rule would be contrary to Superior 29 T ravelers Cas. & Sur ety C o. of Am. v. Blackbaud, Inc., 2025 WL 1009551, at *15 (Del. S uper. Apr. 3, 2025) [hereinafter T ravelers II ]. 30 Id. at *1. 31 Id. 32 Id. 33 Id. at *2.
10 Court Civil Rule 8(a)’ s notice pleading requirements. And s e cond, they argue that, at the motion to dis miss stage, they w ere no t required to link the alleged damages to any specific contract term. W e review de novo the court’ s decision to dismiss for failure to state a claim. 34 A. Blackbaud does not dispute tha t the Insurers sta nd in the s hoes of the Insureds and, as subr ogees/assignees, have s tanding to pursue their I nsureds’ breach of contract claims against Blackbaud. Blackbau d also does not conte st that the contracts are governed by the substantive law of New Y ork and that the pleading requirements are gov erned by Delaware law – specifically, Superior Court Civil Rule 8 (a). T hus, the iss ue before us de novo is w hether the I nsurers ha ve met Rule 8(a) ’ s ple adi ng requirements for a breach of contract ac tion governed by New Y ork law. Under New Y ork law, a breach of contract claim has four elements: “the existence of a contract, the plaintiff ’ s performance und er the contract, the defendant’ s b reach, and resulting damages.” 35 Under Superior Court Civil Rule 8(a), the plaintif f must pr ovide “(1) a short an d plain statement of t he claim showing tha t 34 Thompson St. Cap. Partners IV, L.P. v. Sonova U.S. Hearing Instruments, LL C, 340 A.3d 1 151, 1 164-65 (D el. 2025); City of Fort M yers Ge n. Emp s. ’ Pe nsion Fund v. Haley, 235 A.3d 702, 716 (Del. 2020). The Insurers have not appealed dismissal of their negligence claims. 35 Detringo v. S. Island Fam. Me d., LLC, 71 N.Y.S.3d 525, 527 (N.Y. App. Div. 2018) (citations omitted).
11 the plea der is entitled to relief and (2) a demand for judgment for the relief t o which the party deems itself entitled.” In Central Mortgage Company v. Mor gan Stanley Mortgage Capital Holdings LLC, we held that: [A] court sh ould accept all well-pleaded factual all egations in the Complaint as true, accept even v ague allegations in the Complaint as “well-pleaded” if they provide the defendant notice of t he c laim, d raw all reasonable inferences in fav or o f the p laintif f, and deny the motion unless the p laintif f could not recover under any reasonably conceivable set of circum stances susceptible o f proof. 36 Here, the In surers—standing in the shoes of the Insur eds —met the Su perior Court’ s pleading requireme nts to state a breach of contract claim under New Y o rk law. First, th e Insurers alle ged “the existence of a co ntract.” According to the Superior Court, “[e]ach Insured entered into a separate ‘S olutions Agreem ent’ w ith Blackbaud[.]” 37 Second, the Insurers alleged the Insureds p erformed und er the contract. 38 T hird, t he Insurers alleged that “the contract was breached.” As set forth in detail above, the Insurers identifie d each of Blackbaud’ s contractual dutie s specific to s ensitive data manageme nt and data breach res ponse, and how Blackbaud 36 27 A.3d 531, 536 (Del. 201 1). In Central Mortgage, we decided not to foll ow the federal court pleading standards. Id. at 537. 37 T ravelers II, 2025 WL 1009551, at *2. 38 A1 10 (“ The Insureds have complied with any and all conditions precedent to recovery under their agreements with Blackbaud.”); AA123 (same).
12 breached thos e contractual pr ovisions. In the words of the Supe rior Court: Plaintif fs allege that prior to the d ata breach, Blackbau d ignored warning signs that its cyb ersecur ity measures exposed it to an attack. For example, Blac kbaud maintained some unencry pted customer data on obsolete servers, which B lackbaud inte nded to migrate onto its new servers. The older servers were not on a routine ma intenance sche dule, so se curity u pdates were n ot implem ented. Fa ilure t o run s ecurity patches on th ese older servers concer ned Blackbaud em ployees. Additionally, a former information security analyst warned Blackbaud about process vulnerabilities in its systems. The analyst suggested that Blackbaud en crypt the obsolete servers, b ut “because the servers were so old, ‘the exact nature o f the data [on these servers] wa s unknown.’” Plain tiff s allege that Blackbaud should have discontinue d storing informat ion on t he obsolete servers given the p otential for unauthorized acces s. Blackbaud also failed to take heed of the analyst’ s warnings about remote desktop access vulnerab ilities. Blackbaud knew the risk was so high t hat employ ees w ould “simply shut down certain machines at times.” Failures in Blac kbaud’ s systems were further re vealed in the Kudelski Report. It identified st eps that Blackbaud c ould have ta ken to prevent an attack, including requir ing customers to use m ultifactor authentication. Beca use Blackbau d had n ot implemented this security measure, the cybercriminal was abl e to use a customer ’ s password to access the sy stem a nd the n “free ly move across multiple Blac kbaud hosted environments by leveragin g existing vulnerabilitie s....” Blackbaud also failed to require customers to encrypt social security numbers and bank account i nformation stored in certain fi elds on the system. Finally, Blackbaud retained s ome current and former customer s’ data for years longer than needed, unnecessarily exposing this data to a cyber breach. 39 39 T ravelers II, 2025 WL 1009551, at *5-6 (citations omitted).
13 And fourth, t he Insurers al leged “damage s [the Insured s] suffer ed as a res ult of the breach.” Agai n, in the words of the Superior Court: Collectively, the expenses included: (i) retaining compu ter forensics firm s to identify the type of informat ion the Insured s tored in the Blackbaud software, t he identity of the Insured’ s donors, and the date o f the breach; (ii) outside counsel fees incurre d in determining which state/federal data bre ach law s a pplied, whether n otifications were required and if so, drafting the notification, and generally providing legal advic e; (iii) retaining printing and mailing firms to send notifications; (iv) communicating w ith Blackbaud regarding the scope of t he b reach and remedial steps; and (v) credit monitoring “required under various state laws and expected by federal regulators” (the “Expenses”). These Expenses were paid by the applicable Plaintiff, except to the e xtent that the pol icy contained a ded uctible. T rav elers’ amen ded complaint includes a lis t of its Insureds, identifying the name and principal location of the Insured, the applicable deductible paid by the Insured, and the amount T ravelers paid to each Insured. T ravelers seeks recovery of $1,558,086.39 that it paid to its Insureds and $550,000 in d educ tibles incurred b y certain o f its Insureds. 40 Even though the Insurers touched each base for a breach o f contract claim under New Y ork law, the Superior Co urt dismissed their claim s. According to the court, the Insure rs came up sho rt on t wo grounds—the Insurers could not, as a pleading matter, aggrega te the Insureds’ claims in a subrogation complaint, and the Insurers failed to plead proximate cause. W e address each ground in turn. 40 Id. at *6-7 (citations omitted).
14 B. The Su perior Cou rt held that the amended complaints d id not state a subrogation claim under Super ior Court Civil Rule 1 2(b)(6). According t o the c ourt, by pleading th e Insureds’ c laims in the aggregate, the Insurers failed to provide the required factual support for each Insured’ s claim. Specifica lly, the court held that the Insurers were required to plead data breach-related information specific to each Insured, specify the privacy law requirements each Insured h ad to satisfy, and list the types of expense s each Insured allegedly inc urred responding to t he breach. Otherwise, the co urt held, B lackbaud could not defend again st the claims. W e are not persuaded that Blackbaud was at a disadvantage in defendi ng against the allegations of the amended complaints. Black baud controlled its information technology systems and kn ew what sensitive information was ac cessed. After discovery aimed at each Insured, Black baud c an amend its answer an d assert new defenses specific to each Insured. 41 And if the Insurers claimed damages for losses that are ca pped by, or not covered b y, the Agreements, Blac kbaud could mo ve for summary j udgment on those lo sses. The court rec ognized that n o Delaware precedent required plea ding individualize d claims in subrogatio n actions. 42 Nonetheless, i t t urned to a few New 41 Super. Ct. Civ. R. 15. 42 T ravelers II, 2025 WL 1009551, at * 9.
15 Y ork decisions addressing equitable subrogation pleading requirements when healthcare providers attempt to recover t heir cost of care in mass tort cases. 43 In those cases, the New Y ork courts d ismissed equitable subrogation claims because the healthcare entities failed to identify each harmed patient. An d, according to the New Y ork courts, the claims were so unique to the individuals harmed that the defendants cou ld not be expecte d to addres s them in the aggre gate. 44 Here, ho wever, the Insurers did not seek equitable subrogation to recover costs paid to an amorphous group o f individuals with unique harms. 45 Instead, they 43 Id. at *10 n.79; Blue Cross & Blue Shield of N.J., Inc. v. Philip Morris USA Inc., 344 F.3d 21 1, 218 (2d Cir. 2003) (finding the insurer was required to identify the subrogors and their claims so defendants could assert defenses against those claims); A.O. Fox M em’l Ho sp. v. Am. T oba cco Co., Inc., 754 N.Y.S.2d 368, 369 (N.Y. App. Div. 2003) (finding plainti f fs failed to identify individual patients and their specific injuries and specify facts to establish liability); E. States Health & W elfar e Fund v. Philip Morris, Inc., 729 N.Y.S.2d 240, 252 (N.Y. Sup. Ct. 2000) (finding defendants could not “fairly defend” ag ainst claims without knowing what the specific injuries were for each person). 44 In Lawyers’ Fund For Client Pr ot. of State of N.Y. v. JP Mor gan Chase Bank, N.A., 915 N.Y.S.2d 741, 743 (N.Y. App. Div. 201 1), the court recognized that othe r New Y ork decisions dismissed complaints with aggregated claims that “involved such a high degree of individualized inquiry” that failing to identify them would not establish a subrogation claim. But in Lawyers’ Fund, the court af firmed the denial of a motion to dismiss notwithstanding aggrega ted damages because the subrogors were a small, clearly defined, and r eadily identifiable group who each sustained identical injuries from the same acts and omissions by a defendant with prior knowledge of the claimants. 45 Equita ble subrogation arises in equity a nd prevents unjust enrichment. It allows a party (like an insurer) who has paid a d ebt that should have been paid by another to “step into the shoes ” of the creditor to recover that payment. C ontractual subrogation, on the oth er hand, is grounded in a contract, typically an insurance contract, and the parties’ relationship is governed by the contractual terms. See Rodriguez v. Gr eat A m. Ins. C o., 2022 WL 591762, at *7-8 (Del. Super. Feb. 23, 2022) (citing E. Sav. Bank, FSB v. C ach, LLC, 124 A.3d 585, 590 (D el. 2015)) (distinguishing equitable and contractual subrogation); see also N.Y. M un. Ins. Recipr ocal v. Stewart’ s Shop Corp., 212 N.Y.S.3d 859, 860 (N.Y. App. Div. 2024) (same).
16 identified each of the Insureds, 46 the Blackbaud contract they had in common, 47 the shared bas es for the breaches, 48 and the same or similar investigation and remediation damages incurred responding to the d ata br each. 49 Under Central Mortgage, nothing more was required to s tate a breach of co ntract cla im under New Y ork law. At bottom, Blackbaud objected to claim aggregati on because it want ed more detail in the amended complai nts abou t how each I nsured responded to the data breach and the expenses they incurred. Those details were not needed to state a claim. They can be expl ored in discovery. C. Next, the Superior Court held that the Insurer s failed to state a claim because they did not p lead f acts establishing proximate cause. The court confine d th e Insurers’ proximate cause argumen t to two g rounds—“Blac kbaud’ s contractual promise to mitigate the i mpact of a data breach” and its “misrepre sentations of the scope of the data b reach.” 50 As to the former, the court held that it would be unreasonable to int erpre t the mitigat ion provision to i mpose “strict liability” on 46 A63-65; AA189. 47 A176-180; AA191-95. 48 A98-104; AA106-1 13. 49 A104-1 10; AA1 13-123. 50 T ravelers II, 2025 WL 1009551, at *1 1, *13.
17 Blackbaud for every data breach. 51 As to the latter, t he court held that there was no “reasonable reliance” t erm in the Agreeme nts and the Ins urers did not allege when the Insureds decided to conduc t their own investigatio ns. 52 T herefore, the court held, the proximate c ause allegations were conclusor y and should be dism issed. Under New Y ork law, the defendant’ s breach must be a “substantial factor in producing the damag e.” 53 Delaware and New Y ork l aw are consistent that proxima te cause is ordinarily determined by the t rier of fact. 54 Here, the Insurers did not limit their causation argumen ts to one contractual provision or representation. 55 The Insurers pled that Bla ckbaud breached multiple information security pr omises in the Agreements and then shifted the in vestigation and reme diation responsibi lities onto 51 Id. at *12. 52 Id. at *14. 53 Fe d. Hous. Fin. Agency v. Mor gan Stanley ABS Cap. I Inc., 73 N.Y.S.3d 374, 397 (N.Y. Sup. Ct. 2018) (citations omitted). 54 Duphily v. Del. Elec. Co -op., Inc., 662 A.2d 821, 830 (Del. 1995) (“This Court has consistently held that the issue of proximate cause is ordinarily a qu estion of fact to be determined by the trier of fact,” a principle estab lished in this Court’ s cases dating back to 1934.); see also V oss v. Neth. Ins. Co., 22 N.Y.3d 728, 737 (N.Y. 2014) (“[Q]uestions of proximate cause and foreseeability should generally be resolved by the factfinder[.]”). 55 See, e.g., A233-41; AA249-57 (Insurers argue d that remediation expenses were proximately caused by Blackbaud’ s breaches of Sections 5(b), 6(a), and 6(b) of the Agreements, which included failing to protect the Insureds’ confidential information and failing to have a response plan in place. Blackbaud also gave false assurances to the Insureds through its T oolkit, which was provided more than 72 hours after the data breach, in violation of Section 6(c).); A241; AA256 (The Insureds had no choice but “to fill the void and handle the fallout from Blackbaud’ s failures.”).
18 the Insureds. 56 As a result of the data breach, the Insureds had to retain computer forensics firms to inves tigate a nd mitigate t he breach; incur counsel fees to determine their responsibilitie s under federal and state l aw; notify customers; conduct credit monitori ng and more. Once the plaint iff has al leged facts raising a reasonable inference t hat damages were cause d by the def endant, d amages may b e pled genera lly. 57 After di scovery, Blac kbaud c an attempt to limit its dama ges through appl icable contractual d amage limitation s. Under Delaware notice pleading standards, the amended complaints alleged facts from w hich—drawing a ll inferences in the I nsurers’ favor—a reasona ble factfinder could find that Blackbaud’ s contractual breach es were the proximate cause of the Insured s’ investigation and remedial expen ses. I II. The Insurers h ave stated a claim for breach of c ontract under New Y ork law. The Superior C ourt’ s judgment is re versed and the case re manded for pr oceedings consistent w ith this opinion. Jurisdictio n is not retained. 56 A83-98; AA89-105. 57 Lebanon Cnty. Emp. Ret. Fund v. Collis, 287 A.3d 1 160, 1208 (Del. C h. 2 022) (“ A court do es not typically parse the scope of damages at the pleading stage. A plaintiff can plead the existence of damages g enerally as long as the complaint supports a reasonable inference of harm. ”) (citations omitted).
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get State Courts alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when Delaware Court Opinions publishes new changes.