Court Rulings Shape Subrogation Rights in Cybersecurity Breaches: Key Cases Define Vendor Liability Two recent court decisions Axis Insurance Company v. Barracuda Networks, Inc. (2025) and Travelers Casualty and Surety Company of America v. Blackbaud, Inc. (2026) have clarified the limits of insurers’ subrogation rights against vendors following data breaches, with outcomes hinging on contractual relationships and legal standing. ### Axis v. Barracuda: No Privity, No Subrogation In Axis v. Barracuda, the U.S. First Circuit Court of Appeals ruled on November 20, 2025, that insurer Axis could not pursue subrogation against Barracuda Networks after a breach exposed Zoll Medical Corporation’s customer data. The case stemmed from a 2023 incident where Barracuda’s email archiving service, used by Zoll’s vendor Fusion LLC, was compromised. Zoll settled a class-action lawsuit from affected customers and sought recovery from Fusion and Barracuda. The court rejected Axis’s equitable indemnification claim, finding no direct or vicarious contractual relationship between Zoll and Barracuda only a chain of independent contracts (Zoll-Fusion, Fusion-Barracuda). Without privity, the court ruled that equitable indemnification, a narrow remedy, could not reallocate risk post-breach. The First Circuit also dismissed Axis’s breach-of-contract claim, affirming that Fusion failed to meet a contractual condition precedent (a liability-limiting provision) and that Barracuda’s lack of audit obligations did not waive this defense. Similarly, Axis’s claim for breach of the covenant of good faith failed, as Fusion had not negotiated protections for breach scenarios. ### Travelers v. Blackbaud: Direct Contracts Enable Subrogation In contrast, the Delaware Supreme Court ruled on February 13, 2026, in Travelers v. Blackbaud that insurers could proceed with subrogation claims against the software provider. Blackbaud, which provided donor management services to nonprofits, suffered a 2020 ransomware attack but offered clients only a self-remediation "toolkit" instead of direct support. Insurers, including Travelers, covered their policyholders’ incident response costs (legal fees, notifications, credit monitoring) and sued Blackbaud for recovery. The lower court dismissed the case, citing insufficiently pleaded aggregate claims under New York law. However, the Delaware Supreme Court overturned the decision, finding that the insurers had adequately alleged breach of contract. Unlike Axis, the insureds had direct contracts with Blackbaud, giving insurers standing to pursue subrogation. The court emphasized that Blackbaud could address individual claims through discovery, and that foreseeable breach-related costs (e.g., remediation expenses) constituted recoverable damages. ### Key Takeaways: Contracts Determine Liability The rulings underscore a critical distinction: subrogation claims against vendors require a direct contractual relationship between the insured and the breached party. In Axis, the lack of privity doomed the claim, while Travelers succeeded because the insureds’ contracts with Blackbaud established clear liability pathways. Both decisions reinforce that: - Equitable indemnification is unavailable without a direct or derivative contractual link. - Breach-of-contract claims hinge on compliance with contractual terms, including conditions precedent. - Aggregate subrogation may proceed if insurers plead sufficient facts, as seen in Travelers. The cases signal that cyber insurers and policyholders must scrutinize vendor contracts for liability clauses, indemnification rights, and subrogation waivers to mitigate exposure in breach scenarios.

Cisco Patches High-Severity Privilege Escalation Flaws in IOS XR Software Cisco has released high-severity software updates to address two critical privilege escalation vulnerabilities in its IOS XR Software, which could allow authenticated, local attackers to gain root-level access or full administrative control over affected devices. Given the role of these routers in enterprise networks, the flaws pose a significant security risk. ### Vulnerability Details Both vulnerabilities are rated High severity (CVSS 8.8/10) and can be exploited independently: 1. CVE-2026-20040 – A CLI privilege escalation flaw caused by improper validation of user-supplied arguments in certain commands. A low-privileged attacker could execute arbitrary commands as root on the underlying OS. 2. CVE-2026-20046 – A CLI privilege escalation issue in Cisco IOS XRv 9000 Routers, stemming from incorrect command-to-task-group mapping. Attackers could bypass security checks to perform unauthorized administrative actions. Cisco confirmed that IOS, IOS XE, and NX-OS Software are not affected by these flaws. ### Mitigation & Patching Cisco urges administrators to upgrade to fixed software versions (e.g., 25.2.21, 25.4.2) or apply Software Maintenance Updates (SMUs). For CVE-2026-20040, patching is mandatory, as no workarounds exist. For CVE-2026-20046, organizations using TACACS+ AAA command authorization can restrict unauthorized command access as a temporary measure. Systems running older versions (25.1 or earlier, 25.3 branch) are particularly vulnerable and should migrate to patched releases immediately.

On May 14, 2020, Emma Willard School suffered a data breach caused by an external hacking incident. The breach exposed Social Security numbers (SSNs) of 2,273 individuals, including 16 Maine residents, potentially leading to identity theft risks. The school took nearly five months to notify affected individuals, sending letters on October 28, 2020, and offered 24 months of identity theft protection services as a remedial measure. The compromised data—primarily SSNs—poses a long-term risk of financial fraud, unauthorized account openings, and other identity-related crimes. The delay in disclosure may have further exacerbated vulnerabilities for the victims. The breach highlights systemic weaknesses in the institution’s cybersecurity defenses, particularly in safeguarding highly sensitive personal identifiers from external threats.

The Hawaii Attorney General's Office reported that Maryknoll School experienced a data breach involving Blackbaud, Inc. on July 16, 2020. The breach, which was a ransomware attack, occurred between February 7, 2020 and May 20, 2020, affecting personal information of 2 individuals, including names and Social Security numbers. Maryknoll School began mailing notification letters to the affected individuals on March 24, 2021.