Background:

• Incident: CarePartners suffered a cyberattack in June 2018, leading to a data breach.
• Class Action: Initiated in 2020, alleging CarePartners' negligence and breaches of statutory and contractual obligations.
• Insurance: Aviva, CarePartners’ insurer, denied coverage citing a Data Exclusion Endorsement.

Legal Proceedings:

1. Funding Agreement (July 2021): Aviva and CarePartners agreed to share defense and settlement costs on a 60/40 basis, without prejudice to their rights.
2. Superior Court Decision: No duty to defend/indemnify personal injury claims; duty recognized for bodily injury claims.
3. Settlement: Class action settled for $3.4 million, shared per the funding agreement.
4. Appeals: Aviva appealed but later abandoned. CarePartners' cross-appeal contested cost allocation.

Court of Appeal Decision:

• Coverage Dispute: Confirmed no duty to defend/indemnify personal injury claims; duty exists for bodily injury claims.
• Funding Agreement: Initial application did not address cost allocation, thus no ruling on this issue.
• Res Judicata: Rejected CarePartners' claim, as allocation was not previously decided.
• Costs: Cross-appeal dismissed; CarePartners to pay Aviva $7,500 in costs.