TodayLegal News

Delaware Supreme Court Reverses Decision in Blackbaud Ransomware Case

The Delaware Supreme Court reversed a lower court decision in a major insurance coverage dispute stemming from a ransomware attack on software provider Blackbaud, Inc. Four insurance companies successfully appealed the Superior Court's ruling in the consolidated case.

AI-generated Summary
4 min readcourtlistener
Seal of the Delaware Supreme Court

Case Information

Case No.:
C.A. No. 193, 2025

Key Takeaways

  • Delaware Supreme Court unanimously reversed Superior Court in insurance coverage dispute involving Blackbaud ransomware attack
  • Four major insurance companies successfully challenged the lower court's ruling against software provider Blackbaud
  • Case stems from major cyberattack where hackers stole sensitive client data from Blackbaud's servers
  • Blackbaud's clients lost confidence and conducted independent investigations and remedial measures
  • Insurance carriers covered some client losses, leading to coverage dispute with Blackbaud

The Delaware Supreme Court reversed a Superior Court decision Thursday in a closely watched insurance coverage dispute arising from a major ransomware attack on software provider Blackbaud, Inc. The unanimous decision by the state's highest court marks a victory for four insurance companies that challenged the lower court's ruling.

The case involves Travelers Casualty and Surety Company of America, Philadelphia Indemnity Insurance Company, Acadia Insurance Company, and Union Insurance Company as appellants against Blackbaud, Inc. The consolidated appeals were heard under case numbers 193 and 198 from 2025, stemming from Superior Court proceedings that began in 2022.

According to the court documents, Blackbaud operates as a software application and data hosting provider primarily serving nonprofit organizations. The company suffered what the court described as a "major ransomware attack" that resulted in hackers infiltrating Blackbaud's servers and stealing sensitive client data.

The cyberattack had cascading effects beyond the initial data breach. Chief Justice Collins Seitz, writing for the court, noted that "Blackbaud's clients lost faith that the company would address the harm and reimburse them for their losses." This loss of confidence prompted the affected clients to take independent action to protect themselves and mitigate potential damages.

The clients conducted their own investigations into the scope and impact of the data breach, rather than relying on Blackbaud's response efforts. They also implemented remedial measures designed to minimize their exposure to further harm from the compromised data. These client-initiated responses created additional costs that became central to the insurance coverage dispute.

The court documents indicate that the clients' insurance carriers covered some of the losses incurred during these self-directed mitigation efforts. However, the exact nature of the coverage dispute between the insurance companies and Blackbaud was not detailed in the available court documents.

The case was submitted to the Delaware Supreme Court on Nov. 19, 2025, and decided on Feb. 13, 2026, indicating a relatively expedited review process for the appeal. The court sat en banc, meaning all five justices participated in the decision: Chief Justice Seitz and Justices Valihura, Traynor, LeGrow, and Griffiths.

Representing the insurance companies were several law firms. Kurt M. Heyman from Heyman Enerio Gattuso & Hirzel LLP argued for Travelers Casualty and Surety Company of America. The other three insurance companies were represented by Lisa C. McLaughlin from Phillips, McLaughlin & Hall, P.A., and Kenneth T. Levine from deLuca Levine LLC, with Levine presenting oral arguments.

Blackbaud's legal team included attorneys from Morris, Nichols, Arsht & Tunnell LLP in Delaware and Parker Poe Adams & Bernstein LLP in North Carolina. Sarah Fulton Hutchins from the North Carolina firm presented oral arguments on behalf of the software company.

The Delaware Supreme Court's decision to reverse and remand the case sends it back to the Superior Court for further proceedings consistent with the high court's ruling. While the specific legal reasoning behind the reversal was not included in the available documents, the unanimous nature of the decision suggests the justices found clear error in the lower court's analysis.

This case reflects the complex insurance coverage issues that can arise from major cybersecurity incidents. As companies increasingly face sophisticated ransomware attacks, disputes over which parties bear responsibility for resulting costs have become more common in litigation.

The Blackbaud case also highlights how data breaches can create ripple effects beyond the immediate technical incident. When clients lose confidence in a service provider's response to a cyberattack, their independent remediation efforts can generate substantial additional costs that become subjects of insurance coverage disputes.

Delaware's courts frequently handle significant commercial litigation due to the state's business-friendly laws and the large number of corporations incorporated there. The Delaware Supreme Court's expertise in complex commercial matters makes its decisions particularly influential in shaping how similar disputes are resolved nationwide.

The remand to the Superior Court means the case will continue at the trial level, where proceedings will need to align with whatever legal standards or interpretations the Supreme Court established in its reversal decision. The insurance companies' success at the appellate level positions them favorably for the continued litigation, though the ultimate resolution of their coverage dispute with Blackbaud remains to be determined in the lower court proceedings.

Topics

ransomware attackdata breachinsurance subrogationproximate causemotion to dismisscybersecurity

Original Source: courtlistener

This AI-generated summary is based on publicly available legal news, court documents, legislation, regulatory filings, and legal developments. For informational purposes only; not legal advice. Read full disclosure →