Delaware Supreme Court Reverses Breach of Contract Dismissal
Summary
The Delaware Supreme Court reversed a lower court's dismissal of breach of contract claims filed by insurers against Blackbaud, Inc. The insurers, acting as subrogees and assignees, alleged Blackbaud failed to protect client data after a ransomware attack. The court found the amended complaints adequately pled a breach of contract claim.
What changed
The Delaware Supreme Court has reversed the Superior Court's dismissal of breach of contract claims brought by Travelers Casualty and Surety Company of America, Philadelphia Indemnity Insurance Company, Acadia Insurance Company, and Union Insurance Company (the "Insurers") against Blackbaud, Inc. The insurers, who provided coverage to Blackbaud's non-profit and educational clients, sued Blackbaud as subrogees and assignees after a significant ransomware attack led to the theft of sensitive client data. The Superior Court had dismissed the amended complaints with prejudice, finding that the insurers failed to plead proximate cause and adequately support their claims. The Supreme Court disagreed, holding that the insurers' amended complaints sufficiently alleged a breach of contract claim.
This ruling means that the insurers' case against Blackbaud can proceed, potentially impacting how companies are held liable for data breaches and the adequacy of pleading requirements in such cases. Regulated entities, particularly those in the technology and insurance sectors, should review their contract terms and data security obligations. While this is a specific state court ruling, it highlights the importance of robust data protection measures and clear contractual language regarding liability and reimbursement following cybersecurity incidents. No specific compliance deadline or penalty information is provided in this decision, as it pertains to the reversal of a dismissal and remand for further proceedings.
What to do next
- Review data breach response and notification protocols.
- Assess contractual clauses related to liability and indemnification for cybersecurity incidents.
- Ensure adequate pleading of causation and damages in breach of contract claims.
Source document (simplified)
IN THE SUPREME COURT OF THE STATE OF DELAWARE TRAVELERS C ASUALTY AND SURETY COMPA NY OF AMERICA, and P HILADELPHIA INDEMNITY INS URANCE COMPANY, AC ADIA INSURANCE COMPANY, and U NION INSURANCE COM PANY, Plaintiffs Below, Appellants, v. BLACKBAUD, I NC., Defendant Below, Appellee. § § § § § § § § § § § § § § § § § C.A. No. 19 3, 2025 C.A. No. 198, 202 5 Court Below: S uperior Court of the Stat e of Delaw are C.A. No. N22C- 12 -1 30 C.A. No. N22C- 12 -141 Submitted: Novembe r 19, 2025 Decided: February 13, 202 6 Before SEITZ, Chief Justice; VALIH URA, TRAYNOR, LEGROW, and GRIFFITHS, Ju stices, constituting the Court en Banc. Upon appeal from the Superior Cour t. REVERSED AND REMANDED. Kurt M. Heyman, Esquire, (argued), Gillian L. Andre ws, Esquire, HEYMAN ENERIO GATTUSO & HIRZEL LLP, Wilmi ngton, Delaware, for Travelers Casualty and Sure ty Company of America, Plain tiff Below/Appellant. Lisa C. McLaughli n, Esquire, PHILLIPS, McLAUGHLIN & HALL, P.A., Wilmington, Delaware; Kenneth T. Levine, Esquire, (argued), de LUCA LEVINE LLC, East Norr iton, Pennsylva nia, for Philadelp hia Indemn ity Insurance Company, Acadia Insurance Comp any, and Union Insurance Company, Plainti ffs Below/Appella nts.
John P. DiTom o, Esquire, Jialu Zou, E squire, MORRIS, NICHOLS, ARS HT & TUNNELL LLP, W ilmington, Delaware; Sarah Fulton H utchins, Esquire, (argue d), Corri A. Hop kins, Esquire, PARKER POE ADAMS & BERNSTEIN LLP, Charlotte, North C arolina, for Blackbaud, Inc., Defenda nt Below /Appellee.
SEITZ, Chief Jus tice: Blackbaud, Inc., a software application and data hosting provider for non- profits, suffered a major ransomware a ttack. The hacker infiltrated Blackbaud’ s servers and stole sensitive client data. Blackbaud’ s clients lost faith that t he company would address the h arm and reimburse them for their losses. The client s conducted their own investigations and took remedial steps to mitigate t heir losses. Their insurers cove red some of the losses and then sued Black baud as subrogees/assign ees to recover their pa yments to t he insureds. The Superior Co urt dismissed the original complain ts for failing to state a claim. In response, t he insurers file d amen ded complaints. The Superior Court dismissed the amended complaints, this time with p rejudice. It held that the insurer s fail ed to allege factual support for each Blackbau d client’ s cl aims and, as a legal matter, failed to plead prox imate cause. On appeal, the insurers ar gue that the court should not have dismissed the amended complai nts b ecause they met the Superior Court’ s minimum pleading requirements. They also contend that t he court should not have dismissed the amended complaints with pre judice. For the rea sons explained below, we reverse because the i nsuranc e carriers, as subrogees/assignees, adequately pled a breach of contract claim in their amended complaints. Given our ruling, we need not address the second issue on appeal.
I. A. According to the amended c omplaints, Blackbau d is a software company that provides donor relationship manageme nt software and information technology services to their educational and non -profit client s. 1 T ravelers Casualty and Surety Company of Amer ica (“T ravelers”), Philadelphia Indemnity Insurance C ompany, Acadia Insurance Company, and Union Insurance Company (“Philadelphia Indemnity”) (toge ther with T ravelers the “I nsurers”) provided insu rance coverage to 97 of Black baud’ s educational and non-pro fit clients for cyber and crim inal incidents like data breaches. 2 The Ins urers wrote policies that cover ed losses in excess of re tentions f or damages caused by data breaches. 3 T he poli cies allow ed the Insurers to subrogate, or stand in the shoes of t he insureds, to re coup p ayments for certain losses arising from da ta breach es. 4 The Insurers also obtained contract as signments from Blackbaud clien ts. 5 W e will refer to the Blackbaud clients as the “In sureds.” 1 App. to Philadelphia Opening Br. at A66-67 [hereinafter A]; App. to T ravelers Opening Br. at AA70-71 [hereinafter AA]. 2 A63-65, A67; AA69-71, AA189. 3 A62, A65-66; AA6 8 -70. 4 A6 5-66; AA70. 5 A180; AA195.
B. Blackbaud and t he Insureds signe d Blackbaud Solutions Agreements (the “Agreements”). 6 The Agreements were id entical for all the Insureds and are governed by New Y ork law. 7 Blackbaud hosted the Insureds’ sensitive d onor data on its servers. 8 The In sureds used Black baud’ s software applications to collect payments and transac t with donors. 9 In the Agreements, Blackba ud agreed to protect the Insureds’ sensitive data as fo llows: • maintain administr ative, physical, and technical safeguards; • protect against anticipated threats or hazards to the security of confide ntial information; • protect against unauthori zed access to or use of confidential informat ion that could materially harm the Insureds; • maintain comme rcially reasona ble information security procedures an d standards; • implement commercially reasonable, written p olicies and procedures ad dressing potential sec urity breaches; • have a breach re sponse plan in p lace; and 6 A67, A176-180; AA71 -72, AA191-95. 7 A176-180; AA191-95. 8 A6 7-69, A71; AA71-73, AA76. 9 A67; AA71.
• use commercially reasonab le ef forts to mitigate any negative consequences resulting directly from a breach and provide 72-hour notice of any breac h. 10 C. In 2020, a cy ber attacker access ed Blac kbaud’ s system for several mont hs and exfiltrated confidential customer data from its servers. 11 T he attacker threatened to publish t he data unless Blackbaud paid a ransom. 12 On J uly 16, 2020, Blac kbaud revealed t he breach on its website. 13 T he website notice stated that “ [n]o a ction is requi red on your end because no per sonal inform ation about your constituent s was accessed.” 14 Blackbaud filed a Form 10 - Q on August 4, 2020, disclosing the breach but characterizing the e xfiltration of sensitive donor i nformation as hypothet ical. 15 In a later Se ptember 29, 2020 Form 8-K filing, Blackbaud s tat ed that “the cybercr iminal may ha ve accessed some u nencrypted fie lds intended for bank a ccount inf ormation, 10 A177; AA192. 11 A72-76; AA78-80. 12 A75; AA80. This data included full names, age, date of birth, social security numbers, home addresses, phone numbers, email addresses, financial information, medical information, gender, religious beliefs, marital status, spouse names, spouses’ donation history, employment information, educational information, and account credentials. A75; AA81. 13 A76; AA82-83. 14 A76; AA83 (emphasis in original). 15 A77; AA83.
social securi ty numbers, user names and/or passwo rds.” 16 In 2023, Blackbaud agreed to pay a $3 mi llion fine to t he Securities and Exchange Comm ission to resolve charges that the company made mislea ding disclosures about the cyber security attacks. 17 Blackbaud also paid $ 49 million to resolve state law claims brought by the a ttorneys general of a ll 50 states. 18 D. The Insureds claimed that, instead of addressing t he cyberattack and protecting the Insureds, Bl ackbaud failed to conduct an adequate investigation of the breach. 19 T hey also contended tha t, even though se nsitive customer da ta resided o n Blackbaud’ s servers, Blackbaud shifted the i nvestigati ve burd en and remediatio n effor ts onto the Insureds. 20 For instance, Blackbaud provided the Insured s a “T ool kit” with instructions to complete their own investiga tions. 21 The T oolkit listed “next steps,” such as investigating the data involved in the breach, consulting with legal counse l, and notifying com promised don ors. 22 16 A77; AA84. 17 A78; AA84. 18 A78-80; AA84-87. 19 A91-94; AA9 8-101. 20 A94-98; AA101-105. 21 A94-96, A181-91; AA102-05, AA196-206. 22 Id.
Dissatisfied with Blackbaud’ s response t o the cyberattack, the Insureds conducted their own investi gations and remediation and made claims against their insurance policies for those expen ses. 23 Philadelphia Indemnity paid over $600,00 0 to its Ins ureds. 24 T ravelers paid over $1. 5 million. 25 E. The Insurers filed suit agai nst Blackbaud in Superi or Court as subrogees/assi gnees of their Insureds. They alleg ed b reach of contract and negligence cl aims agains t Blackbaud and sought to recover payments the Insurers made to their Insure ds for inv estigation and remediation expenses. 26 Blackbau d responded with a motion to dismiss and for judgment on the pleadings. The cour t granted Blackbaud’ s motion. It held that the o riginal complaints fail ed to state a claim for breac h of contract, neglige nce, or gross negli gence. 27 After the court denied their motion for rear gument, the Insurers filed amended complaints. 28 The court dismissed the amended complaints, t his time with 23 A91-94; AA95-101. 24 A62, A94. 25 AA68, AA101. 26 A14-27; AA20-33. 27 T ravelers Cas. & Sur ety Co. of Am. v. Blackbaud, Inc., 2024 WL 1298762, at *13 (Del. Super. Mar. 27, 2024). 28 A61-1 1 1; AA67-124.
prejudice. 29 It found that “a complaint mus t include s pecific allegations supported by facts,” and by pleading t he Insure ds’ claims in the aggregate, the Insurers “fail[ed] to prov ide t he required factual support for any insured’ s claim and d [id ] not adequately allege a subrogation cla im.” 30 T he court also held that, even if pleading in the aggregate was suffic ient, “the amended complaints fail to ade quately plead proximate cause because they fa il t o link the a lleged damages to any contrac t term.” 31 T o plead proximate cause, the court held, the Insurers could not rely on a contract term “that required Blackbaud to mitigate negative consequence s of a data breach.” 32 Finally, the court held that the Insureds could not rely on “conclusory allegations of m isrepresentation s” to plead proxima te cause. 33 II. On appeal, the Insurers ar gue that the Su perior Cou rt erred when it found that the Insurers could not, as a mat ter of law, plead their breach of contract claims in the aggregate. According to the Insurers, nothing in Delaware law prohibits ag gregate d pleading of subrogat ion claims, and any other rule would be contrary to Su perior 29 T ravelers Cas. & Sur ety Co. of Am. v. Blackbaud, Inc., 2025 WL 1009551, at *1 5 (Del. Super. Apr. 3, 2025) [hereinafter T ravelers II ]. 30 Id. at *1. 31 Id. 32 Id. 33 Id. at *2.
Court Civil Rule 8(a)’ s notice pleading requirements. And s econd, they ar gue t hat, at the motion to dis miss stage, they w ere no t required to link the alleged damages to any specific contract term. W e review de novo t he court’ s decision to dismiss for failure to state a claim. 34 A. Blackbaud does not dispute tha t the Insurers sta nd in the s hoes of the Insureds and, as subr ogees/assignees, have s tanding to pursue their I nsureds’ breach of contract claims against Blackbaud. Blackbau d also does not conte st that the contracts are governed by the substa ntive l aw of New Y ork and that the pleading requirements are gov erned by Delaware law – specifically, Superior Court Civil Rule 8 (a). T hus, the iss ue before us de novo is w hether the I nsurers ha ve met Rule 8(a) ’ s ple adi ng requirements for a breach of contract ac tion governed by New Y ork law. Under New Y ork law, a breach of c ontract claim has four elements: “the existence of a contract, the plaintiff ’ s p erformance under the contract, the defendant’ s b reach, and resulting damages.” 35 Under Superior Court Civil Rule 8(a), the plaintif f must pr ovide “(1) a short an d plain statement of t he claim showing tha t 34 Thompson St. Cap. Partners IV, L.P. v. Sonova U.S. Hearing Instruments, LL C, 340 A.3d 1 151, 1 164-65 (D el. 2025); City of Fort Myers Ge n. Emp s. ’ Pension Fund v. Haley, 235 A.3d 702, 716 (Del. 2020). The Insurers have not appealed dismissal of their negligence claims. 35 Detringo v. S. Island Fam. Med., LLC, 71 N.Y.S.3d 525, 527 (N.Y. App. Div. 2018) (citations omitted).
the plea der is entitled to relief and (2) a demand for judgment for the relief t o which the party deems itself entitled.” In Central Mortgage Company v. Mor gan Stanley Mortgage Capital Holdings LLC, we held that: [A] court sh ould accept all well-pleaded factual all egations in the Complaint as true, accept ev en vag ue allegations in the Complaint as “well-pleaded” if they provide the defendant notice of t he claim, draw all reasonable inferences in favor of the plaintif f, and deny the motion unless the p laintif f could not recover under any reasonably conceivable set of circum stances susceptible o f proof. 36 Here, the Insurers—standing in the shoes of the Insured s —met the Super ior Court’ s pleading requir ements to s tate a breach of contract claim under New Y ork law. First, th e Insurers alle ged “the existence of a co ntract.” According to the Superior Court, “[e]ach Insured entered into a separate ‘Solutions Agreement’ with Blackbaud[.]” 37 Second, the Insurers alleged the Insureds p erformed und er the contract. 38 T hird, t he Insurers alleged that “the contract was breached.” As set forth in detail above, the Insurers identifie d each of Blackbaud’ s contractual dutie s specific to s ensitive data manageme nt and data breach res ponse, and how Blackbaud 36 27 A.3d 531, 536 (Del. 201 1). In Central Mortgage, we decided not to foll ow the federal court pleading standards. Id. at 537. 37 T ravelers II, 2025 WL 1009551, at *2. 38 A1 10 (“ The Insureds have complied with any and all conditions prece de nt to recovery und er their agreements with Blackbaud.”); AA123 (same).
breached thos e contractual pr ovisions. In the words of the Supe rior Court: Plaintif fs allege that prior to the d ata breach, Blackbau d ignored warning signs that its cybersecurit y measures expos ed it to an attack. For exam ple, Blackbaud maintained some u nencrypted customer data on obsolete servers, which B lackbaud inte nded to migrate onto its new servers. The older servers were not on a routine ma intenance sche dule, so se curity u pdates were n ot implem ented. Fa ilure t o run s ecurity patches on th ese older servers concer ned Blackbaud em ployees. Additionally, a former information security analyst warned Blackbaud about process vulnerabilities in its systems. The analyst suggested that Blackbaud en crypt the obsolete servers, b ut “because the servers were so old, ‘the exact nature o f the data [on these servers] wa s unknown.’” Plain tiff s allege that Blackbaud should have discontinue d storing informat ion on t he obsolete servers given the p otential for unauthorized acces s. Blackbaud also failed to take heed of the analyst’ s warnings about remote desktop access vulnerabilities. Blackbaud knew the risk was so high t hat employ ees w ould “simply shut down certain machines at times.” Failures in Blac kbaud’ s systems were further re vealed in the Kudelski Report. It identified st eps that Blackbaud c ould have ta ken to prevent an attack, including requir ing customers to use m ultifactor authentication. Because Blackbaud had not implemen ted this security measure, the cybercr iminal was able to use a customer ’ s password to access the sy stem a nd the n “free ly move across multiple Blac kbaud hosted environments by leveragin g existing vulnerabilitie s....” Blackbaud also failed to require custome rs to encrypt social security numbers and bank account information stored in certain fields on the system. Finally, Blackbaud retained s ome current and former customer s’ data for years longer than needed, unnecessarily exposing this data to a cyber breach. 39 39 T ravelers II, 2025 WL 1009551, at *5-6 (citations omitted).
And fourth, t he Insurers al leged “damage s [the Insured s] suffer ed as a res ult of the breach.” Agai n, in the words of the Superior Court: Collectively, the expenses included: (i) retaining computer forensics firm s to identify the type of informat ion the Insured s tored in the Blac kbaud softw are, the identity of the Insured’ s donors, and the date o f the breach; (ii) outside counsel fees incurre d in determining which state/federal data bre ach law s a pplied, whether n otifications were required and if so, drafting the notification, and generally providing legal advic e; (iii) retaining printing and mailing firms to send notifications; (iv) communicating with Blackbaud regarding the s cope of the breach and remed ial steps; and (v) credit moni toring “required under various state laws and expected by federal regulators” (the “Expenses”). These Expenses were paid by the applicable Plaintiff, except to the e xtent that the pol icy contained a ded uctible. T rav elers’ amen ded complaint includes a lis t of its Insureds, identifying the name and principal location of the Insured, the applicable deductible paid by the Insured, and the amount T ravelers paid to each Insured. T ravelers seeks recovery of $1,558,086.39 that it paid to its Insureds and $550,000 in d educ tibles incurred b y certain of its Insureds. 40 Even though the Insurers touched each base for a breach of contract claim under New Y ork law, the Superi or Court dismissed their claim s. Acco rding to the court, the Insure rs came up sho rt on t wo grounds—the Insurers could not, as a pleading matter, aggrega te the Insureds’ claims in a subrogation complaint, and the Insurers failed to plead proximate cause. W e address each ground in turn. 40 Id. at *6-7 (citations omitted).
B. The Superior Court h eld that the amended complaints did n ot st ate a subrogation claim under Super ior Court Civil Rule 1 2(b)(6). According t o the c ourt, by pleading th e Insureds’ claims in the aggregate, the Insurers failed to provide the required factual support for each Insured’ s claim. Specif ically, th e court held that the Insurers were required to plead data breach-related information specific to each Insured, specify the p rivacy law req uirements each Insured had to satisfy, and list the types of expense s each Insured allegedly inc urred responding to t he breach. Otherwise, the co urt held, B lackbaud could not defend again st the claims. W e are not persuaded that Blackbaud was at a disadvantage in defendi ng against the allegations of the amended complaints. Blackbaud controlled its information technology systems and kn ew what sensitive information was ac cessed. After discovery aimed at each Insured, Blackbaud c an amend its answer and assert new defenses sp ecific to each Insured. 41 And if the Insurers claimed damages for losses that are ca pped by, or not covered b y, the Agreements, Blac kbaud could mo ve for summary j udgment on those lo sses. The court rec ognized that n o Delaware precedent required plea ding individualize d claims in subrogatio n actions. 42 Nonetheless, i t t urned to a few New 41 Super. Ct. Civ. R. 15. 42 T ravelers II, 2025 WL 1009551, at * 9.
Y ork decisions addressing equitable subrogation pleading requirements when healthcare p rovider s attempt to recover t heir cost of care in mass tort cases. 43 In those cases, the New Y ork courts dismissed equitable subrogation claims b ecause the healthcare entities failed to identify each harmed patient. An d, according to the New Y ork courts, the claims were so unique to the individuals harmed that the defendants cou ld not be expecte d to addres s them in the aggre gate. 44 Here, ho wever, the Insurers did not seek equitable subrogation to recover costs paid to an amorphous group o f individuals with unique harms. 45 Instead, they 43 Id. at *10 n.79; Blue Cross & Blue Shield of N.J., Inc. v. Philip Morris USA Inc., 344 F.3d 21 1, 218 (2d Cir. 2003) (finding the insurer was required to identify the subrogors and their claims so defendants could assert defenses against those claims); A.O. Fox M em’l Ho sp. v. Am. T oba cco Co., Inc., 754 N.Y.S.2d 368, 369 (N.Y. App. Div. 2003) (finding plaintiffs failed to identify individual patients and their specific injuries and specify facts to establish liability); E. States Health & W elfar e Fund v. Philip Morris, Inc., 729 N.Y.S.2d 240, 252 (N.Y. Sup. Ct. 2000) (finding defendants could not “fairly defend” against clai ms without knowing what the spe cific injuries were for each person). 44 In Lawyers’ Fund For Client Pr ot. of State of N.Y. v. JP Mor gan Chase Bank, N.A., 915 N.Y.S.2d 741, 743 (N.Y. App. Div. 201 1), the court recognized that other New Y ork decisions dismissed complaints with aggregated claims that “involved such a high degre e of individualized inquiry” that failing to identify them would not establish a subrogation claim. But in Lawyers’ Fund, the court af firmed the denial of a motion to dismiss notwithstanding aggrega ted damages because the subrogors were a small, clearly defined, and r eadily identifiable group who each sustained identical injuries from the same acts and omissions by a defendant with prior knowledge of the claimants. 45 Equita ble subrogation arises in equity a nd prevents unjust enrichment. It allows a party (like an insurer) who has paid a d ebt that should have been paid by another to “step into the shoes” of the creditor to recover that payment. Contractual subrogation, on the other hand, is grounded in a contract, typically an insurance contract, and the parties’ relationship is governed by the contractual terms. See Rodriguez v. Gr eat Am. Ins. Co., 2022 WL 591762, at *7-8 (Del. Super. Feb. 23, 2022) (citing E. Sav. Bank, FSB v. C ach, LLC, 124 A.3d 585, 590 (D el. 2015)) (distinguishing equitable and contractual subrogation); see also N.Y. M un. Ins. Recipr ocal v. Stewart’ s Shop Corp., 212 N.Y.S.3d 859, 860 (N.Y. App. Div. 2024) (s ame).
identified each of the Insureds, 46 the Blackbaud contract they had in common, 47 the shared bas es for the breaches, 48 and the same or similar investigation and remediation damages incurred responding to the d ata br each. 49 Under Central Mortgage, nothing more was required to s tate a breach of co ntract cla im under New Y ork law. At bottom, Bl ackbaud obj ected to claim aggregati on because it wa nt ed more detail in the amended complai nts abou t how each I nsured responded to the data breach and the expenses they incurred. Those details were not needed to state a claim. They can be expl ored in discovery. C. Next, the Superior Court held that the Insurer s failed to state a claim because they did not p lead f acts establishing proximate cause. The court confine d th e Insurers’ proximate cause argumen t to two g rounds—“Blac kbaud’ s contractual promise to mitigate the impact o f a data breach” and its “misrepresentations of the scope of the data b reach.” 50 As to the former, the court held that it would be unreasonable to int erpre t the mitigat ion provision to i mpose “strict liability” on 46 A63-65; AA189. 47 A176-180; AA191-95. 48 A98-104; AA106-1 13. 49 A104-1 10; AA1 13-123. 50 T ravelers II, 2025 WL 1009551, at *1 1, *13.
Blackbaud for every data breach. 51 As to the latter, t he court held that there was no “reasonable reliance” t erm in the Agreeme nts and the Insurers did not allege whe n the Insureds decided to conduc t their own investigatio ns. 52 T herefore, the court held, the proximate c ause allegations were conclusor y and should be dism issed. Under New Y ork law, the defendant’ s breach must b e a “substantial factor in producing the damag e.” 53 Delaware and New Y ork l aw are consistent that proxima te cause is ordinarily determined by the t rier of fact. 54 Here, the Insurers did not limit their causation argumen ts to one contractual provision or representation. 55 The Insurers pled that Bla ckbaud breached multiple information security pr omises in the Agreements and then shifted the in vestigation and reme diation responsibi lities onto 51 Id. at *12. 52 Id. at *14. 53 Fe d. Hous. Fin. Agency v. Mor gan Stanley ABS Cap. I Inc., 73 N.Y.S.3d 374, 397 (N.Y. Sup. Ct. 2018) (citations omitted). 54 Duphily v. Del. Elec. Co -op., Inc., 662 A.2d 821, 830 (Del. 1995) (“This Court has consistently held that the issue of proximate cause is ordinarily a qu estion of fact to be determined by the trier of fact,” a principle estab lished in this Court’ s cases dating back to 1934.); see also V oss v. Neth. Ins. Co., 22 N.Y.3d 728, 737 (N.Y. 2014) (“[Q]uestions of proximate cause and foreseeability should generally be resolved by the factfinder[.]”). 55 See, e.g., A233-41; AA249-57 (Insurers argued that remediation expens es were proximately caused by Blackbaud’ s breaches of Sections 5(b), 6(a), and 6(b) of the Agreements, which included failing to protect the Insureds’ confidential information and failing to have a response plan in place. Blackbaud also gave false assurances to the Insureds through its T oolkit, which was provided more than 72 hours after the data breach, in violation of Section 6(c).); A241; AA256 (The Insureds had no choice but “to fill the void and handle the fallout from Blackbaud’ s failures.”).
the Insure ds. 56 As a result of the data breach, the Insured s had to retain computer forensics firms to investigate and mitigate the breach; incur counsel fees to determine their responsibilitie s under federal and state l aw; notify customers; conduct credit monitoring and more. Onc e the plaintif f has allege d facts raising a reasonable inference t hat damages were caused by the defendan t, damages may be pled genera lly. 57 After di scovery, Blac kbaud c an attempt to limit its dama ges through appl icable contractual d amage limitation s. Under Delaw are notice pleading sta ndards, th e amended complaints al leged facts from w hich—drawing a ll inferences in the I nsurers’ favor—a reasona ble factfinder could find that Blackbaud’ s contractual breach es were the proximate cause of the Insured s’ investigation and remedial expen ses. I II. The Insurers h ave stated a claim for breach of contract under New Y ork law. The Superior Court’ s judgment is reversed and the case remanded for proceedings consistent w ith this opinion. Jurisdictio n is not retained. 56 A83-98; AA89-105. 57 Lebanon Cnty. Emp. Ret. Fund v. Coll is, 287 A.3d 1 160, 1208 (Del. Ch. 2 022) (“ A court does not typically parse the scope of damages at the pleading stage. A plaintiff can plead the existence of damages g enerally as long as the complaint supports a reasonable inference of harm. ”) (citations omitted).
Related changes
Source
Classification
Who this affects
Taxonomy
Browse Categories
Get State Courts alerts
Weekly digest. AI-summarized, no noise.
Free. Unsubscribe anytime.
Get alerts for this source
We'll email you when Delaware Court Opinions publishes new changes.