DELAWARE Supreme Court Reverses, Holds Cyber Insurers Sufficiently Pled Collective Subrogation Claim Resulting from Blackbaud Data Breach confirms that a group of cyber liability insurers can plead a subrogation claim in the aggregate after the Blackbaud incident. The decision, as described by Lydia Mills of Wiley Rein, held that insurers may plead subrogation claims in the aggregate and that the complaint sufficiently pled facts raising a reasonable inference of proximate cause.
The insurers provided cyber insurance to several education and non-profit insureds that used the defendant software company’s data hosting services; after the ransomware attack, the provider initially claimed that none of the clients’ personal information was accessed, later disclosing that information such as bank account data and Social Security numbers may have been accessed.
As a result of the defendant’s alleged failure to address the attack and conduct an adequate investigation, the insureds incurred response costs, including legal counsel, computer forensics, and notice obligations, prompting the insurers to file a collective subrogation action. The Delaware Supreme Court reversed the Superior Court’s dismissal and signalled that proximate-cause inference and aggregate pleading can sustain such claims, in the ruling tied to Travelors Cas. & Sur. Co. of Am. v. Blackbaud, Inc. (2026 WL 410048). Read more at JDSupra.