Bill Bosch Discusses IHG Ransomware Attack; Class Action By Franchisees

Listed as a “Hospitality Case to Watch in 2023” by Law360, the case “involves a ransomware attack where the plaintiffs are seeking certification of a class that isn't a consumer class,” according to Pillsbury Commercial Litigation partner Bill Bosch. “Instead of consumers alleging harm because their data was not protected, here the class would be comprised of franchisees, owners and operators of IHG-flagged hotels alleging harm because they were denied access to IHG's systems.”

While the question of whether IHG is responsible for the ensuing losses is still up in the air, Bosch stated, “It will be interesting to see if and how a class is certified by the court and how the court analyzes IHG's duty of care to prevent a denial of service ransomware attack.”

Bosch also commented on cases relating to a possible “second wave” of COVID-19 insurance cases. After a lower court judge ruled in favor of Schleicher and Stebbins Hotels LLC and its affiliates, a group of insurers appealed the ruling which was later taken up by the New Hampshire Supreme Court.

Noting that the lower court judge held that damage caused by the presence of the coronavirus was a “direct physical loss or damage,” Bosch stated, “unlike the first wave of COVID-19 insurance litigation largely brought by small businesses that were closed due to government shutdown orders and had virus exclusions in their policies, this lawsuit is part of a second wave of cases in which insureds with broader coverage are developing scientific and epidemiological evidence that the COVID-19 virus can cause physical damage within the insured's property.”