Maritz Holdings, Inc. v. Certain Underwriters at Lloyd's London Subscribing to Policies Numbered B122FI0115 and FI0115116 et al

Filing 164

MEMORANDUM AND ORDER: IT IS HEREBY ORDERED that Defendant Underwriters's Motion to Compel (Doc. 111 ) is GRANTED in part and DENIED in part.... SEE ORDER FOR FULL DETAILS. IT IS FURTHER ORDERED that, as agreed by the parties, Maritz and Intersec shall produce all responsive materials by no later than November 12, 2020. Signed by District Judge Sarah E. Pitlyk on 11/10/2020. (ANP)

UNITED STATES DISTRICT COURT
EASTERN DISTRICT OF MISSOURI
EASTERN DIVISION

MARITZ HOLDINGS INC.,
Plaintiff,

vs.
CERTAIN UNDERWRITERS AT
LLOYD’S LONDON SUBSCRIBING TO
POLICIES NUMBERED B122F10115115
AND F10115116, et al.,
Defendants.

)
)
)
)
)
)
)
)
)
)
)
)
)

Case No. 4:18-CV-00825 SEP

MEMORANDUM AND ORDER
This matter is before the Court on Defendant Certain Underwriters at Lloyd’s London
Subscribing to Policies Numbered B122F10115115 and F10115116’s (“Underwriters”)
Motion to Compel pursuant to Federal Rules of Civil Procedure 34 and 45. Doc. [111]. The
Motion to Compel is directed to Plaintiff Maritz Holdings Inc. (“Maritz” or “Plaintiff”) and
non-party Intersec Worldwide, Inc. (“Intersec”). Underwriters requests that this Court: (1)
order Maritz to produce all documents in its possession, custody or control which are
responsive to Request Nos. 11-13, 16-18, and 29 in the Requests for Production (“RFP”)
submitted by Underwriters to Maritz; (2) order Intersec to produce all documents in its
possession, custody or control which are responsive to Request Nos. 3-12, 14, 28-30, 31, 34,
and 35 in Schedule A of Underwriters’s subpoena duces tecum to Intersec; (3) order Intersec to
produce complete, accessible and coherent copies of all documents that have been previously
produced by Intersec in a format that is incomplete, inaccessible and/or incoherent; and (4)

order Maritz to produce all communications with and records of its privacy counsel and its
coverage counsel at Thompson Coburn LLC (“Thompson Coburn”) that are responsive to the
RFPs to Maritz.
The parties appeared at a hearing in the courtroom of the undersigned on October
21, 2020, to discuss this Motion to Compel, as well as Defendant Arthur J. Gallagher Risk
Management Services, Inc.’s (“Gallagher”) Motion to Compel directed against Underwriters
and Clyde & Co. US LLP (“Clyde”). See Doc. [66]. After that hearing, the Court granted
Gallagher’s Motion to Compel. See Doc. [161]. Due to time constraints, the instant Motion
was not resolved at the hearing but was instead taken under consideration by the Court.
I.

Factual and Procedural Background

This case involves a dispute over insurance coverage for alleged losses arising out of
cyber-security breaches experienced by Plaintiff, through which certain electronically stored
gift card information was stolen. Underwriters issued breach-response insurance coverage to
Maritz for 2015 through 2017 under two separate policies (“Policies”). Those policies
provided coverage for, among other things, certain fees and costs Maritz might incur in
responding to such a security breach. Maritz experienced two cyber-security breaches: one in
March 2016, and another in February 2017. Following the first security breach, Maritz
retained forensic firm Charles River Associates (“CRA”) to investigate and terminate the
perpetrators’ access to Maritz’s systems. For the second breach, Maritz retained a different
forensic firm, Intersec, to investigate and terminate the breach.
Maritz submitted claims to Underwriters for expenses it alleges are covered under the
Policies. Maritz seeks coverage under Section I.D, the “Breach Response Costs Insuring

2

Agreement” 1 and Section I.G, the “Restoration Costs Insuring Agreement” 2 of the Policies.
Those sections of the Policies do not cover betterment or improvement work of Maritz’s
digital systems, but instead cover work performed by CRA and Intersec that was necessary to
investigating and terminating the breaches, and to replacing, restoring, or recreating Maritz’s
digital assets to their pre-breach condition. The Policies also include Exclusion Clause IV.R,
which applies to the Restoration Costs Insuring Agreement, and which expressly bars coverage
for “updating” or “upgrading” Maritz’s digital assets and systems.
Underwriters denied coverage on Maritz’s claims, after which Maritz filed the instant
action, asserting claims for breach of contract and vexatious refusal against Underwriters, and
seeking damages of between approximately $4.5 and 5.5 million. During the course of
discovery, Underwriters served RFPs on Maritz and Intersec, each of which declined to
produce certain documents and information responsive to the RFPs. More specifically, Maritz
withheld certain information regarding the work and costs related to its systems repair or
upgrades, which would have been responsive to RFP Nos. 11-13, 16-18, and 29, on grounds
that the RFPs at issue were overbroad and unduly burdensome. Maritz also withheld its
communications with its attorneys at Thompson Coburn in that firm’s capacity as both privacy
counsel and coverage counsel, on the basis of attorney-client privilege. Additionally, although
Intersec produced documents and information in response to RFP Nos. 3-12, 14, 28-30, 31, 34,
and 35, Underwriters alleges that certain of those documents were inaccessible (due to, for
example, being password protected) or were produced in an incoherent format. After the
1

The Breach Response Costs Insuring Agreement covers “forensic professional fees and expenses to
determine the cause and extent of such security breach and terminate the security breach (however,
betterment of the computer system is not covered).”

2

The Restoration Costs Insuring Agreement covers the “actual, reasonable and necessary costs [Maritz]
incur[s] to replace, restore, or recreate [Maritz’s] Digital Assets to the level or condition at which they
existed prior to sustaining any Loss . . ..”

3

parties were unable to come to an agreement regarding the discovery requests, Underwriters
filed the instant Motion to Compel to enforce compliance with the RFPs. As further discussed
below, Underwriters’ Motion to Compel will be granted in part and denied in part.
II.

Discussion
i. Legal Standard

Federal Rule of Civil Procedure 26(b)(1) states that “[p]arties may obtain discovery
regarding any nonprivileged matter that is relevant to any party’s claim or defense and
proportional to the needs of the case, considering the importance of the issues at stake in the
action . . . the parties’ relative access to relevant information, the parties’ resources, the
importance of the discovery in resolving the issues, and whether the burden or expense of the
proposed discovery outweighs the likely benefit.” Fed. R. Civ. P. 26(b)(1). Courts construe
Rule 26(b)(1) broadly. See Oppenheimer Fund, Inc. v. Sanders, 437 U.S. 340, 351 (1978).
“Given that the [FRCP] allow[s] for broad discovery, the burden is typically on the party
resisting discovery to explain why discovery should be limited.” Cincinnati Ins. Co. v. Fine
Home Managers, Inc., 4:09CV234-DJS, 2010 WL 2990118, at *1 (E.D. Mo. July 27, 2010).
However, courts should be mindful that the scope of discovery is intended to focus on the actual
claims or defenses that are at issue in the litigation. See, e.g., Mallak v. Aitkin County, No. 13cv-2119 (DWF/LIB), 2016 WL 8607391, *6, (D. Minn. June 30, 2016). This standard applies to
requests for production between litigants pursuant to Federal Rule of Civil Procedure 34, as well
as to subpoenas duces tecum under Federal Rule of Civil Procedure 45. See Fed. R. Civ. P. 34;
Prime Aid Pharmacy Corp. v. Express Scripts, Inc., No. 4:16-CV-1237, 2017 WL 3129807, *1
(E.D. Mo. July 24, 2017) (applying Rule 26(b) to subpoena duces tecum).

4

A party responding to a request for production under Federal Rule of Civil Procedure 34
or to a document subpoena under Federal Rule of Civil Procedure 45 must produce material in its
possession, custody, or control, to the extent such material is otherwise relevant and discoverable.
See Fed. R. Civ. P. 34(a)(1); 45(a)(1)(iii). Electronic documents are to be produced in the same
manner as they are kept in the normal course of business or otherwise in a manner organized to
correspond to the categories of the relevant document request. See Fed. R. Civ. P. 34(b)(2)(E)(i);
45(e)(1)(A).
ii.

Parties’ Agreement on Certain Discovery Matters

The parties have represented to the Court that, since this Motion to Compel was fully
briefed, they have reached an agreement with respect to certain information requested by
Underwriters. The parties state that they have agreed to provide to Underwriters by no later than
November 12, 2020, the following items:
(a)

(b)

(c)
(d)

(e)

Any and all internal memoranda or report(s) prepared by
Maritz discussing: (i) the security of data or information
stored in any of Maritz’s electronic systems from January
1, 2014, to January 1, 2018; (ii) the state of Maritz’s data
security software, hardware, protocols, procedures, or
systems from January 1, 2014, to January 1, 2018; and/or
(iii) any change, alteration, or improvement to any of the
Maritz’s electronic systems considered, proposed,
contemplated, executed, or implemented by Maritz from
January 1, 2014, to January 1, 2018.
Any and all memoranda or report(s) prepared for Maritz by
any other Person (or entity) discussing (a) through (c)
above.
Any and all board minutes from Maritz or any subsidiary
of Maritz discussing (a) through (c) above.
All communications to or from any person at Maritz with
decision making authority as respects the security of
Maritz’s electronic systems discussing (a) through (c)
above.
All communications between Maritz and Intersec relating
to the RFP [the “Request for Proposals”] that Maritz was
corresponding with Intersec about prior to the 2017 breach
5

and/or any services, system changes and/or system
improvements contemplated in connection with that RFP.
Additionally, Maritz has agreed to produce its privacy counsel’s files, including all
communications between Melissa Ventrone at Thompson Coburn and Maritz by no later than
November 12, 2020. Finally, Maritz and Intersec have provided a password that they assert will
permit access to all Intersec documents already produced that Underwriters has been unable to
access due to their password-protected state. The Court acknowledges the agreement reached by
the parties as described above and will order Maritz and Intersec to produce all documents and
information encompassed by the agreement by no later than November 12, 2020.
iii.

RFP Nos. 11-13, 16-18, and 29 to Maritz and RFP Nos. 3-12, 14, 28-30,
34, and 35 in Schedule A of Subpoena to Intersec

CRA’s and Intersec’s fees make up a majority of the costs for which Maritz seeks
coverage in this lawsuit. Underwriters asserts that some evidence suggests that Maritz may
have included in the costs submitted to Underwriters for coverage under the Policies certain
Intersec fees related to improvements to Maritz’s digital systems, which are not covered. For
example, another of Maritz’s insurers, Defendant Affiliated FM, retained a forensic
investigator, Envista Forensics, LLC (“Envista”) to review the Intersec invoices submitted by
Maritz when making its claim under the Policies. Underwriters asserts that Envista concluded
that the invoices reflected significant improvement work. Additionally, Underwriters asserts
that Maritz has admitted that some portion of the work reflected in the Intersec invoices was
for uncovered improvements. Furthermore, Intersec’s fees related to the second breach were
significantly higher than the fees charged by CRA for work performed in connection with the
first breach, and Underwriters argues that this suggests that Intersec’s invoices may have
included fees for uncovered improvements.

6

On October 30, 2018, Underwriters submitted certain RFPs to Maritz, which were
intended to gain information about the state of Maritz’s digital systems before and after each
breach, in order to more fully understand whether any portion of the fees submitted by Maritz
to Underwriters may be associated with uncovered improvements to Maritz’s digital assets.
RFP No. 13 requested communication with any vendor retained in connection with the
breaches, including CRA and Intersec, as well as documents related to such communication.
RFP Nos. 11 and 12 sought production of documents related generally to the costs Maritz
claims are covered by the Policies. RFP Nos. 16-18 and 29 sought production of documents
related to the pre-breach state of Maritz’s systems, and any change or improvement to those
systems that was contemplated by Maritz before either of the breaches. Underwriters asserts
that it cannot fully and independently assess which, if any, Intersec fees were for
improvements, and were thus uncovered, unless they have a more complete picture of the state
of Maritz’s digital systems before and after each of the breaches.
Underwriters also submitted to Intersec, in a subpoena duces tecum, similar RFPs
seeking information about Maritz’s digital systems, the work performed by Intersec, and
related communications between Maritz and Intersec. Intersec produced certain documents
responsive to the RFPs, but according to Underwriters, “Intersec has failed to produce
essentially any documents relating to the upgrades to Maritz’s systems that Maritz
contemplated before the second breach.” Doc. [113] at 12. Additionally, Underwriters alleges
that many of the documents produced by Intersec were incomplete or inaccessible for various
reasons. For example, certain of the documents were password protected, and the necessary
passwords were not provided, while some documents were allegedly missing attachments or
were produced in an incoherent format.

7

Maritz objected to these requests, asserting that they were vague, ambiguous,
overbroad, and unduly burdensome, or do not seek relevant documents. Maritz agreed to
produce only “reports” provided by CRA and Intersec. Underwriters and Maritz subsequently
met and conferred regarding their disagreement about these requests in April and September of
2019. Pursuant to those discussions, in October 2019, Underwriters reached an agreement
with Maritz and Intersec to narrow the scope of requested materials to certain subsets of
documents, 3 and Maritz and Intersec agreed to produce the information sought. Underwriters
also requested that Intersec cure the deficiencies identified in certain documents produced,
including providing a valid password for the protected documents, but Intersec never
responded to that request. As of February 2020, none of the agreed-upon documents or
information had been provided by Maritz or Intersec.
Underwriters then filed the instant Motion to Compel, asking this Court to compel
Maritz to produce materials responsive to RFP Nos. 11-13, 16-18, and 29, and ordering
Intersec to turn over all remaining materials responsive to RFP Nos. 3-12, 14, 28-30, 31, 34,
and 35 in Schedule A of the Subpoena duces tecum to Intersec. Underwriters also asks the
Court to order Intersec to produce complete, accessible and coherent copies of all documents
that have been previously produced by Intersec in a format that is incomplete, inaccessible
and/or incoherent.
Underwriters argues that the material requested in the disputed RFPs and subpoena is
plainly relevant to the claims and defenses at issue in this case. The Court agrees. The
requested information pertains to work performed by Intersec for which Maritz seeks
reimbursement from Underwriters in its claim on the Policies. Documentation and

3

Underwriters made this concession without prejudice to its rights to seek further information in the
future. See Doc. [113] at 13.

8

communications discussing the status of Maritz’s digital systems before and after each of the
breaches clearly bears on the question of whether the Intersec fees for which Maritz seeks
reimbursement were related to covered work or to uncovered improvements.
Further, Underwriters has demonstrated that the material sought is proportional to the
needs of the case. Maritz seeks to recover approximately $5.2 million in Intersec fees and
costs. This represents the vast majority of the damages sought by Maritz in this litigation.
Accordingly, information and documentation that sheds light on the nature of Intersec’s work
for Maritz seems neither overreaching nor unduly burdensome. Because the material sought
by Underwriters is both relevant to the claims and defenses in this action and proportional to
the needs of the case, the Court concludes that Maritz and Intersec must produce the material
in question.
Based on the parties’ representations to the Court about their recent agreement
regarding these discovery disputes, as discussed supra, it appears that Maritz and Intersec have
agreed to produce much of the disputed material. Additionally, it seems that Intersec has
agreed to correct its deficient production with respect to password protected and otherwise
inaccessible information. The Court expects that Maritz and Intersec will comply with the
agreement among the parties as represented to the Court and provide the material in question
by no later than November 12, 2020. To the extent that the parties’ agreement did not resolve
all issues with respect to the disputed RFPs and the subpoena, the Court will order production
of all material that is responsive to RFP Nos. 11-13, 16-18, and 29 directed to Maritz, and RFP
Nos. 3-12, 14, 28-30, 31, 34, and 35 in Schedule A of the subpoena duces tecum to Intersec.
iv.

Communications Between Maritz and Thompson Coburn

Maritz retained Melissa Ventrone of Thompson Coburn to address the legal privacy

9

concerns that were expected to arise in connection with the breaches. During the course of
discovery, Underwriters requested that Maritz produce all communications with and records of
Thompson Coburn in its capacity as privacy counsel. Underwriters argues that the information is
relevant to the claims in this case because Maritz, in its claim submitted on the Policies, included
invoices relating to the work performed by privacy counsel. Maritz objected to these requests on
the basis of attorney-client privilege. Underwriters argues that because Maritz and Underwriters
shared a common interest with respect to the privacy work performed by Thompson Coburn, the
attorney-client privilege does not shield its production. See Coregis Ins. Co. v. Lewis, Johs,
Avallone, Aviles, and Kaufman, LLP, 01-CV-3844 (SJ), 2006 WL 2135782, at *15 (E.D.N.Y.
July 28, 2006) (the common interest rule “allows” an insurer aligned in interest with the insured
to have access to privileged communication between the insured and its counsel, without breach
of the attorney-client privilege.”).
As discussed supra, the parties have come to an agreement with respect to the request for
production of communications between Maritz and its privacy counsel. Maritz has conceded that
the requested communications are not privilege-protected and has agreed to produce its privacy
counsel’s files, including all communications between Melissa Ventrone at Thompson Coburn
and Maritz, by no later than November 12, 2020. The Court expects that Maritz will comply
with the terms of the agreement reached between the parties and will order such compliance to
the extent the relevant production has not been completed by November 12, 2020.
Maritz also retained Thompson Coburn to represent it in connection with this matter as
coverage counsel, in which capacity it assisted Maritz with the claims processes and Maritz’s
efforts to recover insurance proceeds for Maritz’s incurred losses. Underwriters requested that
Maritz produce all communications with and records of Thompson Coburn in its capacity as

10

coverage counsel with respect to the breaches. Maritz objects to the request, arguing that these
communications are absolutely protected by the attorney-client privilege. Underwriters argues
that these communications “must be produced to the extent that any such production [of
communications between Underwriters and its coverage counsel, Clyde & Co.] is ordered” by
the Court. See Doc. [113] at 18.
Some background is necessary to understand Underwriters’s argument with respect to
this matter. The parties have been embroiled in a related discovery dispute, during which
Defendant Arthur J. Gallagher Risk Management Services (“Gallagher”) 4 filed a Motion to
Compel production by Underwriters of communications with its coverage counsel, Clyde & Co.
US LLP (“Clyde”), including Clyde’s claims file prepared in connection with the breaches. See
Doc. [66]. After Gallagher filed its Motion to Compel, Maritz filed a memorandum in support of
Gallagher’s motion. See Doc. [90]. Underwriters and Clyde objected, maintaining that
communications between Underwriters and Clyde were protected by the attorney-client privilege
because Clyde’s involvement was solely that of coverage counsel in advising Underwriters as to
whether coverage existed under the law with respect to Maritz’s Policies. However, Gallagher
and Maritz argued that Clyde was deeply involved in the adjustment of the claim and
participated in Underwriters’ factual investigation and determination of coverage. They further
asserted that to the extent Clyde’s actions with respect to Maritz’s claims were akin to that of an
insurance company adjusting a claim, the attorney-client privilege did not apply and could not
protect the contents of Clyde’s claims file.
Generally speaking, communications between an insurer and its outside coverage counsel
are privileged, so long as coverage counsel is providing an insurer with advice as to whether or

4

Gallagher is an Illinois based insurance brokerage service that acted as Maritz’s broker with
respect to the Policies.

11

not coverage exists under the law. Conversely, to the extent that outside coverage counsel
engaged in processing and adjusting the claim, the privilege does not apply. See Workman v.
The Cincinnati Ins. Co., No. 2:17-cv-00036 PLC, 2017 WL 6025999, at *3 (E.D. Mo. Dec. 5,
2017) (“[T]o the extent that an attorney acts as a claims adjuster, claims process supervisor, or
claims investigation monitor, and not as a legal advisor, the attorney/client privilege does not
apply.”); Bertalo’s Restaurant Inc. v. Exchange Ins. Co., 240 A.D.2d 452, 454-55 (N.Y. 1997)
(“The payment or rejection of claims is a part of the regular business of an insurance company.
Consequently, reports which aid it in the process of deciding which of the two indicated actions
to pursue are made in the regular course of its business. Merely because such an investigation
was undertaken by attorneys will not cloak the reports and communications with privilege
because the reports, although prepared by attorneys, are prepared as part of the regular business
of the insurance company.”).
After considering the briefing on the motion, together with the parties’ arguments at the
discovery hearing held before the undersigned on October 21, 2020, the Court concluded that to
the extent Clyde had been acting in the nature of a claims adjustor, the attorney-client privilege
would not serve to protect the factual results of Clyde’s investigation of the breaches.
Consequently, the Court granted Gallagher’s Motion to Compel, and ordered Underwriters and
Clyde to produce unredacted versions of all non-privileged documents and information that were
responsive to Gallagher’s requests for production. See Doc. [161].
Turning now to the instant Motion to Compel, Underwriters does not adequately explain
the significance or relevance of communications between Maritz and its coverage counsel to the
disputes in this case, and it has not provided the Court with any principled rebuttal to Maritz’s
assertion that the communications are protected by the attorney-client privilege. Indeed, the

12

reasons proffered by Underwriters can best be boiled down to an argument that it is only fair that
if they have to produce their communications with Clyde, then Maritz should have to produce
their communications with coverage counsel at Thompson Coburn. In its reply to Maritz’s
memorandum in opposition to the Motion to Compel, Underwriters states that “[i]f Underwriters
are ordered to produce their lawyers’ communications, Maritz needs to produce its lawyers’
communications too.” See Doc. [145] at 14. In other words, if Clyde’s files are not protected by
the attorney-client privilege, then Thompson Coburn’s coverage-related communications with
Maritz also lose their privilege.
Maritz argues that Underwriters’s position is fundamentally misguided, because Clyde
was not acting as coverage counsel with respect to the breaches, but rather, was investigating or
adjusting the losses associated with the breaches. The Court agrees. The undersigned has
already determined that Clyde’s files in connection with the breaches and its communications
with Underwriters are not protected by the attorney-client privilege to the extent that Clyde was
acting as an adjustor of the claim and not as legal counsel. The documents created by Clyde
during its investigation of the breaches are discoverable because such documents would be
discoverable if Underwriters were to perform the same function in-house rather than outsourcing
that function to Clyde. Meanwhile, Thompson Coburn did not similarly perform the role of an
insurer in its work as coverage counsel. Rather, Thompson Coburn advised its client, the
insured—Maritz—in connection with Maritz’s efforts to recover insurance proceeds under the
Policies. Clyde and Thompson Coburn do not stand in the same shoes with respect to the work
they performed in connection to the breaches, and Underwriters has not shown why the
communications between Maritz and Thompson Coburn should be produced. Underwriters’s
arguments to the contrary seem little more than gamesmanship, which is strongly disfavored by

13

this Court. As all parties to this litigation surely know, discovery is not conducted on a “tit-fortat” basis; rather, each litigant is expected to act with the utmost good faith at all times.
Accordingly,
IT IS HEREBY ORDERED that Defendant Underwriters’s Motion to Compel (Doc.
[111]) is GRANTED in part and DENIED in part. Maritz must produce all documents in its
possession, custody, or control that are responsive to Request Nos. 11-13, 16-18, and 29 in the
RFP issued by Underwriters to Maritz. Intersec must produce all documents in its possession,
custody, or control that are responsive to Request Nos. 3-12, 14, 28-30, 31, 34, and 35 in
Schedule A of the Subpoena duces tecum to Intersec, and Intersec must further produce
complete, accessible and coherent copies of all documents that it previously produced in
incomplete, inaccessible and/or incoherent format. And finally, Maritz must produce all
communications with and records of its privacy counsel at Thompson Coburn that are
responsive to the RFPs. Underwriters’s request that this Court order Maritz to produce
communications with and records of its coverage counsel at Thompson Coburn is denied.
IT IS FURTHER ORDERED that, as agreed by the parties, Maritz and Intersec shall
produce all responsive materials by no later than November 12, 2020.
Dated this 10th day of November, 2020.

SARAH E. PITLYK

14