Insurer Disputes Coverage for FullStory's Legal Costs in Cyber Litigation

The intersection of technology and insurance often leads to complex legal landscapes, especially when it comes to cyber liability. This is exemplified in the recent case of Evanston Insurance Company vs. FullStory, where the insurer is contesting its obligation to cover a $5 million excess demand made by the software company. The lawsuit highlights critical issues surrounding insurance coverage, particularly in the realm of excess insurance and the nuances of policy triggers in the wake of multiple class action lawsuits.

On August 4, 2026, Evanston Insurance Company filed a declaratory judgment complaint in a California federal court, asserting that it owes no coverage to FullStory, the company known for its Session Replay tracking tools. FullStory has claimed that its legal defense costs have exceeded $10 million, leading to its demand for the $5 million under an excess cyber policy. However, Evanston contends that the terms of its policy were never triggered, raising questions about the actual costs incurred and the definition of what constitutes exhausting the underlying limits of coverage.

Understanding Excess Insurance Policies

Excess insurance serves as an additional layer of coverage that sits above primary policies, designed to kick in when the limits of those primary policies have been exhausted. In this case, Evanston’s policy is structured as a "follow form" policy, meaning it mirrors the terms of the underlying insurance policies issued by two primary insurers. The key aspect of Evanston's coverage is its stipulation that it only activates after the underlying insurers have paid out a total of $5.01 million in covered losses.

Trigger Language and Its Importance

The crux of Evanston's argument lies in the policy’s trigger language, which specifies that coverage attaches only after the insured or the underlying insurers have paid the full amount of the Underlying Limit in legal currency. This means that unless there is a verified expenditure of $5.01 million in defense costs or losses, Evanston claims it is not liable for the excess coverage. The insurer's interpretation of this clause is central to the lawsuit and could set a precedent for similar cases in the future.

Background on FullStory and Session Replay Litigation

FullStory's technology allows businesses to track user interactions on their websites and applications, including keystrokes and mouse movements. However, this capability has stirred controversy, leading to a wave of litigation. Since October 2020, over thirty class action lawsuits have been filed against FullStory and its clients, alleging violations of consumer privacy laws and state wiretapping regulations.

The legal troubles for FullStory intensified when a California federal court ruled that the primary insurers had a duty to defend only four of the claims out of the multitude filed against the company. This ruling is pivotal as it significantly narrows the scope of defense costs that can be attributed to the underlying limit, as Evanston argues that only those specific claims can count toward exhausting the coverage.

Defense Costs Under Scrutiny

Evanston's complaint details the legal invoices submitted by FullStory, totaling over $10 million. However, the insurer highlights that a significant portion of these costs—approximately $6.7 million—pertained to claims for which the primary insurers had no duty to defend. This brings into question the validity of FullStory's claim regarding the exhaustion of coverage limits.

• 141 invoices submitted by FullStory totaling $10,358,220.17 for legal services.
• 83 invoices valued at $6,724,519.44 linked to non-covered claims.
• Only 53 invoices related to the actual claims for which the primary insurers had a duty to defend, totaling $3,387,350.00.

Consent Issues and Policy Violations

Another critical issue in the case pertains to consent. Evanston's policy requires that any expenses incurred or settlements entered into must receive prior written consent from the insurer. The complaint alleges that FullStory proceeded with over $10 million in defense costs without notifying or obtaining consent from Evanston, raising questions about the appropriateness of those expenditures and whether they should be covered under the policy.

This consent requirement is a common feature in insurance agreements aimed at protecting insurers from unexpected liabilities. If the court finds that FullStory failed to adhere to this requirement, it could further weaken the case for coverage under Evanston's policy.

Implications for the Insurance Industry

The outcome of this case could have far-reaching implications for the insurance industry, particularly regarding excess coverage and the expectations placed on insured parties. Insurers may become more stringent in their policy language and claims processes, which could impact businesses that rely on excess coverage for protection against legal claims.

This case also raises broader concerns about the nature of defense costs and whether they can be equated with the actual exhaustion of coverage limits. If the court sides with Evanston, it may set a precedent that could restrict the ability of insured companies to claim excess coverage based solely on incurred legal expenses without actual payments of covered losses.

Key Takeaways

• The lawsuit emphasizes the importance of understanding the specific terms and conditions of insurance policies.
• The definition of "exhausting limits" is crucial in determining coverage obligations.
• Consent requirements in insurance policies can significantly impact claims for coverage.
• The outcome could influence future cases involving excess insurance and coverage disputes.
• Businesses should be aware of the implications of their legal expenditures on insurance claims.

Frequently Asked Questions

What is an excess insurance policy?

An excess insurance policy provides coverage beyond the limits of a primary insurance policy. It is designed to kick in when the primary coverage has been exhausted, offering additional financial protection against significant claims. Businesses often purchase excess policies to ensure they have adequate coverage in case of large legal claims or losses. Understanding the terms of these policies, including how coverage is triggered, is essential for policyholders.

What are defense costs and how do they relate to insurance coverage?

Defense costs refer to the legal expenses incurred in defending against lawsuits. In the context of insurance coverage, these costs can be critical in determining whether a policy's limits have been exhausted. Insurers may require that such costs be directly related to covered claims to count toward the exhaustion of limits. This case highlights the complexity of assessing whether defense costs qualify under insurance policies.

How can businesses protect themselves against coverage disputes?

To protect against potential coverage disputes, businesses should carefully review their insurance policies and understand the terms regarding coverage limits, defense costs, and consent requirements. It may also be beneficial to engage legal counsel to ensure compliance with policy stipulations and to properly document all legal expenditures. Businesses should also maintain open communication with their insurers to avoid surprises during claims processes.

What are the potential consequences of this lawsuit for FullStory?

The potential consequences for FullStory could be significant if the court sides with Evanston. If the court rules that Evanston is not liable for the excess coverage, FullStory could be left to absorb millions in legal expenses without insurance support. This outcome may not only impact FullStory's financial stability but also influence its reputation in the marketplace, especially given the ongoing scrutiny surrounding its privacy practices and technology.