Two recent court decisions have addressed the issue of subrogation rights of insurance companies against upstream or downstream vendors that experience a data security breach: Axis Insurance Company v. Barracuda Networks, Inc. and Travelers Casualty and Surety Company. of America v. Blackbaud, Inc.
The first was decided on Nov. 20, 2025 by the U.S. First Circuit Court of Appeals. Travelers was decided on Feb. 13, 2026 by the Delaware Supreme Court.
Axis v. Barracuda
In Axis v. Barracuda, Zoll Medical Corporation had an email service contract with Fusion LLC. Fusion, in turn, contracted with Barracuda Networks, Inc. for its email archiving technology.
Barracuda suffered a data breach, which exposed personal health information of Zoll customers who then brought a class action lawsuit against Zoll. Zoll settled those claims with its customers and then brought an arbitration claim against Fusion, with which it was in privity, and a subrogation claim against Barracuda, which lacked
