Fishbowl Solutions, Inc. v. Hanover Insurance Company, The

U.S. District Court, District of Minnesota

Fishbowl Solutions, Inc. v. Hanover Insurance Company, The

Trial Court Opinion

                UNITED STATES DISTRICT COURT                             
                    DISTRICT OF MINNESOTA                                


Fishbowl Solutions, Inc.,          Case No. 21-cv-00794 (SRN/BRT)        

          Plaintiff,                                                     

v.                                MEMORANDUM OPINION AND                 

ORDER

The Hanover Insurance Company,                                           

          Defendant.                                                     


Joseph A. Nilan, Daniel A. Ellerbrock, and Nicholas J. Sideras, Gregerson, Rosow, 
Johnson & Nilan, Ltd., 100 Washington Avenue South, Suite 1550, Minneapolis, MN 
55401, for Plaintiff.                                                    

Scott G. Johnson and Rebecca Zadaka, Robins Kaplan LLP, 800 LaSalle Avenue, Suite 
2800, Minneapolis, MN 55402; and Erica Ramsey, Robins Kaplan LLP, 140 North 
Philips Avenue, Sioux Falls, SD 57104, for Defendant.                    


SUSAN RICHARD NELSON, United States District Judge                        
    This matter is before the Court on the Objection [Doc. No. 47] filed by Plaintiff 
Fishbowl Solutions, Inc. (“Fishbowl”) to Magistrate Judge Becky R. Thorson’s April 6, 
2022 Order (the “Order”) [Doc. No. 45], denying Plaintiff’s motion to amend.  Based on a 
review of the files, submissions, and proceedings herein, and for the reasons below, the 
Court OVERRULES the Objection and AFFIRMS the Order.                      
I.   BACKGROUND                                                           
    A.   The Parties                                                     
    Plaintiff Fishbowl is a Minnesota company with its principal place of business in 
Saint Louis Park, Minnesota.  (Proposed First Am. Compl. [Doc. No. 26] (“Proposed Am. 
Compl.”)  ¶ 5.)    Defendant  The  Hanover  Insurance  Company  (“Hanover”)  is  a  New 
Hampshire insurance company with its principal place of business in Massachusetts.  (Id. 

¶ 6.)                                                                     
    B.   Factual Background                                              
         1.   Fishbowl’s Business                                        
    Fishbowl is a software company.  (See id. ¶ 9.)  It creates and customizes packaged 
software  for  its  customers  using  the  latest  technologies.    (Id.)    This  software  helps 
customers innovate and access information.  (Id.)                         
    Fishbowl’s Senior Staff Accountant is Wendy Williams.  (Id. ¶ 10.)  She uses her e-

mail account to send invoices to customers and to communicate with customers regarding 
payment of those invoices.  (See id. ¶ 11.)                               
         2.   The Policy                                                 
    Hanover issued a Technology Professional Liability Policy to Fishbowl, for the 
policy period July 17, 2019, through July 17, 2020.  (Id. ¶¶ 3, 27; Declaration of Scott G. 

Johnson [Doc. No. 32] Ex. 1 (the “Policy”).)  The Policy provides “Cyber Business 
Interruption and Extra Expense” coverage (the “Coverage”), as follows:    
    We will pay actual loss of “business income” and additional “extra expense” 
    incurred by you during the “period of restoration” directly resulting from a 
    “data breach” which is first discovered during the “policy period” and which 
    results in an actual impairment or denial of service of “business operations” 
    during the “policy period.”                                          
(Policy § A.b.1.b.(5); Proposed Am. Compl. ¶ 30.)  The term “[b]usiness income” includes 
net income “that would have been earned or incurred if there had been no impairment or 
denial of ‘business operations’ due to a covered ‘data breach.’ ”  (Policy § F.4.a; Proposed 
Am. Compl. ¶ 31.)  “Business operations” means Fishbowl’s “usual and regular business 
activities.”  (Policy § F.5; Proposed Am. Compl. ¶ 35.)  “Data breach” is defined in seven 

different ways in the Policy.  (Policy § F.9.)                            
         3.   The “man in the middle” attack1                            
    In November of 2019, an unknown individual (“fraudster”) gained unauthorized 
access to Ms. Williams’ e-mail account.  (Proposed Am. Compl. ¶ 10.)  Once inside Ms. 
Williams’ e-mail account, the fraudster created certain “rules” to redirect certain e-mail 
communications  within  the  e-mail  system.    (Id.  ¶ 12.)    One  rule  redirected  e-mail 

communications containing certain keywords to an e-mail account that is not associated 
with  Fishbowl.    (Id.  ¶ 13.)    Another  rule  marked  e-mail  communications  sent  from 
“fedins.com” as having already been “read,” and automatically stored them in the “RSS 
Subscriptions” folder.  (Id. ¶ 14.)  These rules prevented Ms. Williams from noticing 
certain e-mail communications, including e-mails from Federated Insurance regarding 

invoice payments.  (Id. ¶¶ 12–14, 22.)                                    
    The purpose of the scheme was to trick Fishbowl’s customers into paying invoices 
to the fraudster without Fishbowl noticing.  (See id. ¶¶ 16–26.)  Pursuant to this scheme, 
the fraudster directed six of Fishbowl’s customers to change how and where to make their 
payments.  (Id. ¶ 22.)  By employing a variety of techniques to conceal the scheme, the 

fraudster posed as Ms. Williams when communicating by e-mail with Federated Insurance.  

1    The term “man in the middle” refers to when “a person invades a system and 
masquerades as one or more of the entities involved in a communication.”  (Proposed Am. 
Compl. ¶ 2.)                                                              
(Id. ¶¶ 16, 18, 21.)  And the fraudster posed as Federated Insurance when communicating 
by e-mail with Ms. Williams.  (Id. ¶¶ 16–18.)  As a result of the scheme, Federated 

Insurance made two payments to the fraudster, totaling $176,962.  (Id. ¶ 24.) 
    Fishbowl discovered the scheme on January 17, 2020.  (Id. ¶ 22.)  After informing 
the six customers about the scheme, five of them were able to recall or redirect their 
payments.  (Id. ¶ 23.)  However, Federated Insurance was unable to do so.  (Id.)  Although 
the United States Secret Service recovered $29,035.79 of the monies paid by Federated 
Insurance  to  the  fraudster,  Fishbowl  suffered a  loss  of  the  difference,  which  totaled 

$147,926.21.  (Id. ¶¶ 25–26.)                                             
         4.   The Insurance Claim                                        
     In  January  of  2020,  Hanover  received  Fishbowl’s  insurance  claim  seeking 
reimbursement for business interruption and losses due to the fraudster’s conduct.  (Id. 
¶¶ 36–37.)  Within a few weeks, Hanover denied the claim.  (Id. ¶¶ 41, 43.)  Fishbowl 

challenged the denial, and consequently, the parties disputed coverage over the next several 
months.  (See id. ¶¶ 40, 42, 45–72.)                                      
         5.   Fishbowl’s Complaint to the Minnesota Department of        
              Commerce                                                   
    After nine months of disputing coverage, Fishbowl filed a complaint with the 
Minnesota Department of Commerce.  (Id. ¶ 73.)  In response, Hanover’s Property Claims 
Director, Jason Cormier, reviewed the claim again.  (Id. ¶¶ 74–75.)  He concluded, for 
Hanover’s  sixth  time,  that  this  fraudulent  scheme  was  not  covered  by  the  Policy, 
memorializing his conclusion in a letter denying coverage on November 19, 2020.  (Id. 
¶¶ 74, 77.)                                                               

    C.   Procedural History                                              
         1.   The Civil Suit                                             
    On March 24, 2021, Fishbowl filed the Complaint, alleging breach of contract and 
seeking  declaratory  and  monetary  relief.    (Compl.  [Doc.  No.  1]  ¶¶ 71–81.)    During 
discovery, Fishbowl deposed Cormier.  (Proposed Am. Compl. ¶ 78.)  Fishbowl alleges 
that Cormier testified that, as defined by the Policy, Fishbowl “sustained a data breach” 
and “had suffered an actual loss of business income.”  (Id.)              

         2.   Plaintiff’s Motion to Amend                                
    On December 1, 2021, Fishbowl timely moved to amend the Complaint [Doc. No. 
26], seeking to add a claim for bad faith under 
Minn. Stat. § 604.18
.  (Pl.’s Mem. [Doc. 
No. 28] at 1.)  Fishbowl contends that Hanover acted with bad faith by repeatedly ignoring, 
and by failing to properly investigate, its claim and by failing to cover its loss.  (Id.)  

Especially in light of Cormier’s alleged concession that this was a data breach covered by 
the Policy, Plaintiff contends that Hanover acted in bad faith.  (Id.)    
         3.   The Order                                                  
    The magistrate judge denied the motion to amend as futile.  (Order at 13.)  In 
reaching that decision, the court analyzed whether Plaintiff had plausibly plead a claim for 
bad faith under 
Minn. Stat. § 604.18
 in the Proposed Amended Complaint.  (See 
id.
 5–12.)  

Under the first prong of the two-prong test, the magistrate judge found that Fishbowl had 
plausibly plead that Hanover lacked a reasonable basis for denying the Policy’s benefits.  
(Id. at 7–9.)  The court explained that Cormier’s alleged deposition testimony that Fishbowl 
suffered a data breach and business loss under the Policy suggests an “ ‘absence of a 

reasonable basis’ for his earlier denial of coverage.”  (Id. at 8–9.)     
    But the magistrate judge found that Fishbowl failed to plausibly plead the second 
prong of the test.  (See 
id. at 7
, 9–12.)  The court concluded that it is an unresolved legal 
question whether the Coverage applied to losses caused by a “man in the middle” cyber-
attack.  (Id. at 11–12.)  Because the law is unresolved, the court found the issue “fairly 
debatable,” and therefore, cannot serve as a basis for a claim of bad faith.  (Id. at 12.)  

Accordingly, the magistrate judge denied the motion to amend as futile.  (Id. at 13.) 
         4.   The Objection                                              
    Fishbowl objects to the Order, making two arguments.  First, Fishbowl contends 
that it plausibly plead a claim for bad faith under 
Minn. Stat. § 604.18
.  (Obj. at 8.)  Second, 
Fishbowl contends that the magistrate judge improperly relied on information outside of 

the pleadings.  (Id. at 9–13.)                                            
II.  DISCUSSION                                                           
    A.   Legal Standard                                                  
    A district court conducts a de novo review of a magistrate judge’s denial of a motion 
to amend based on futility.  Magee v. Trustees of the Hamline Univ., Minn., 
957 F. Supp. 2d 1047, 1062
 (D. Minn. 2013).  Rule 15(a) of the Federal Rules of Civil Procedure 
provides that “[t]he court should freely give leave [to amend a pleading] when justice so 

requires.”  Fed. R. Civ. P. 15(a)(2).  But “[a] district court may appropriately deny leave to 
amend  where  there  are  compelling  reasons  such  as . . .  futility  of  the  amendment.”  
Moses.com Secs., Inc. v. Comprehensive Software Sys., Inc., 
406 F.3d 1052, 1065
 (8th Cir. 
2005)  (internal  quotation  marks  omitted).    Amendment  is  futile  where  the  proposed 

amended claim would not withstand a motion to dismiss for failure to state a claim.  See 
Lunsford v. RBC Dain Rauscher, Inc., 
590 F. Supp. 2d 1153, 1158
 (D. Minn. 2008).  
    When considering a motion to dismiss under Rule 12(b)(6), the Court accepts the 
facts alleged in the complaint as true and views those allegations in the light most favorable 
to the plaintiff.  Hager v. Arkansas Dep’t of Health, 
735 F.3d 1009, 1013
 (8th Cir. 2013).  
However,  the  Court  need  not  accept  as  true  wholly  conclusory  allegations  or  legal 

conclusions couched as factual allegations.  
Id.
  In addition, the Court ordinarily does not 
consider matters outside the pleadings on a motion to dismiss.  See Fed. R. Civ. P. 12(d).  
Matters outside the pleadings include “any written or oral evidence in support of or in 
opposition to the pleading that provides some substantiation for and does not merely 
reiterate what is said in the pleadings,” as well as statements of counsel at oral argument 

that raise new facts not alleged in the pleadings.  Hamm v. Rhone-Poulenc Rorer Pharm., 
Inc., 
187 F.3d 941, 948
 (8th Cir. 1999) (internal quotation marks and citation omitted).  
The Court may, however, “consider the pleadings themselves, materials embraced by the 
pleadings, exhibits attached to the pleadings, and matters of public record.”2  Illig v. Union 
Elec.  Co.,  
652 F.3d 971, 976
  (8th Cir.  2011) (internal  quotation  marks  and  citation 

omitted).                                                                 


2    For purposes of this motion, the Court has considered the Proposed Amended 
Complaint and the Policy.                                                 
    To survive a motion to dismiss, a complaint must contain “enough facts to state a 
claim to relief that is plausible on its face.”  Bell Atl. Corp. v. Twombly, 
550 U.S. 544, 570
 

(2007).  Although a complaint need not contain “detailed factual allegations,” it must allege 
facts with enough specificity “to raise a right to relief above the speculative level.”  
Id. at 555
.   “Threadbare  recitals  of the  elements  of  a  cause  of  action,  supported  by  mere 
conclusory statements,” are insufficient.  Ashcroft v. Iqbal, 
556 U.S. 662, 678
 (2009) 
(citing Twombly, 
550 U.S. at 555
).                                        

    B.   Analysis                                                        
    The Minnesota Legislature has created a private cause of action to penalize bad faith 
denial of benefits by insurance providers.  See 
Minn. Stat. § 604.18
.  Under the statute, a 
party, after commencing a civil suit, “may make a motion to amend the pleadings to claim 
recovery of taxable costs.”  
Id.,
 subd. 4.  The applicable legal basis for establishing a claim 
under the statute is a two-prong test, which is as follows:               

    The court may award as taxable costs to an insured . . . if the insured can 
    show:                                                                
      (1) the absence of a reasonable basis for denying the benefits of the 
      insurance policy; and                                              
      (2) that the insurer knew of the lack of a reasonable basis for denying the 
      benefits of the insurance policy or acted in reckless disregard of the lack 
      of a reasonable basis for denying the benefits of the insurance policy. 
Id.,
 subd. 2(a).  At this stage of the proceedings, plaintiff needs to plausibly plead facts that 
demonstrate each prong of the test in accordance with Rule 15 of the Federal Rules of Civil 
Procedure.  See Selective Ins. Co. of S.C. v. Sela, 
353 F. Supp. 3d 847, 866
 (D. Minn. 2018). 
    Because the amendment was denied as futile, the Court conducts a de novo review 
of the magistrate judge’s order.                                          

         1.   The First Prong                                            
    The Minnesota Supreme Court has held that “the first prong of the section 604.18 
standard is an objective test.”  Peterson v. W. Nat’l Mut. Ins. Co., 
946 N.W.2d 903
, 910 
(Minn.  2020).    The  pertinent  question  is  “whether  a  reasonable  insurer  under  the 
circumstances would not have denied the insured the benefits of the insurance policy.”  
Id.
   
    Here, Plaintiff alleges, in the Proposed Amended Complaint, that Hanover lacked a 

reasonable basis for denying the Policy benefits.  Simply put, Plaintiff alleges that Cormier 
testified that “Fishbowl sustained a data breach” and that “Fishbowl had suffered an actual 
loss of business income” as defined under the Policy.  (Id.)  Assuming this is true, Hanover 
lacked  a  reasonable  basis  to  deny  Plaintiff  the  Policy’s  benefits.    Put  differently,  a 
reasonable insurer would not have denied the benefits when there was a covered data 
breach.  Accordingly, the Court finds that Plaintiff has plausibly plead the first prong.3 

         2.   The Second Prong                                           
    The second prong is a subjective test, requiring a certain mens rea on the part of the 
insurer.  Peterson, 946 N.W.2d at 912.  Specifically, it requires “an insured to prove that 
the insurer knew, or recklessly disregarded or remained indifferent to information that 



3    The Court finds that Plaintiff has plausibly plead the first prong based on Cormier’s 
alleged testimony and, therefore, does not address Plaintiff’s alternative argument that 
Hanover’s investigation was objectively unreasonable.                     
would have allowed it to know, that it lacked an objectively reasonable basis for denying 
the insured’s claim for benefits.”  Id.                                   

    Here, Plaintiff contends that it has plausibly plead the second prong by alleging that 
Hanover’s investigation was unreasonable.  (Proposed Am. Compl. ¶¶ 36–72, 79–82.)  
Plaintiff  alleges  that  Hanover’s  investigation  “failed  to:  request  supplemental 
documentation from Fishbowl; obtain police reports regarding the incident; contact any 
relevant third parties; secure a formal statement from Williams; obtain recorded statements 
from any relevant individuals; or retain an expert to examine Fishbowl’s system.”  (Id. 

¶ 40, 49.)  Similarly, Plaintiff contends that Hanover failed to reasonably evaluate whether 
first-party coverage was available under the Policy.  (Id. ¶ 43, 52.)  Given these failures, 
Plaintiff contends that Hanover’s investigation was unreasonable and thus asserts that it 
has plausibly plead the second prong.  (See Obj. at 7–8.)                 
    Even if Plaintiff is correct as to the failures of Hanover’s investigation, a district 

court will not grant a motion to amend the pleadings to add a bad faith claim where it is 
“fairly debatable” whether coverage applies.  See, e.g., Swanny of Hugo, Inc. v. Integrity 
Mut. Ins. Co., No. A15-0370, 
2015 WL 9437571
, at *7 (Minn. Ct. App. Dec. 28, 2015) 
(affirming the district court’s denial of the motion to amend to add a bad faith claim under 
Minn. Stat. § 604.18
 based in part on a finding that the claim was “fairly debatable”); 

Homestead Hills Homeowner Ass’n v. Am. Family Mut. Ins. Co., No. A12-0703, 
2012 WL 5896829
, at *4 (Minn. Ct. App. Nov. 26, 2012) (same); Friedberg v. Chubb & Son, Inc., 
800 F. Supp. 2d 1020, 1029
 (D. Minn. 2011) (holding that the insurer’s interpretation was 
“at a minimum, fairly debatable,” which “precludes a finding of bad faith”); The Nw. Mut. 
Life Ins. Co. v. Weiher, Civ. No. 12-1430 (SRN/JSM), 
2016 WL 6917204
, at *17 (D. Minn. 
July  11,  2016)  (“[The  insurer’s]  decision  to  rescind  the  policy  is  ‘fairly  debatable,’ 

rendering the bad faith claim futile.”); Borchardt v. State Farm Fire & Cas. Co., No. 16-
cv-00055 (PJS/KMM), 
2017 WL 8315883
, at *7 (D. Minn. Apr. 26, 2017) (“[T]he prima 
facie evidence submitted in support of the motion to amend shows that the plaintiffs’ claim 
was fairly debatable, and State Farm was entitled to debate it.”).        
    Here, Hanover argues that the Coverage does not apply.  (Def.’s Opp’n at 7–11.)  
First, Hanover argues that the Coverage only applies to potential earnings.  (Id. at 7–8.)  

Because Fishbowl alleges that it continued to earn revenue, but did not receive those 
payments due to the cybercriminal, Hanover argues that there are no lost prospective 
earnings that trigger the Coverage.  (Id. at 8.)  Second, Hanover argues that Plaintiffs’ 
“business operations” were never interrupted.  (Id.).  For example, Hanover contends that 
there is no “period of restoration.”  (Id.  at 9.)  A “period of restoration,” Hanover contends, 

limits coverage to the time during which an actual impairment or denial to Fishbowl’s 
“business operations” is restored.  (Id.)  Because Fishbowl does not allege that it restored 
its business operations, Hanover argues that it had a reasonable basis to deny coverage.  
(Id.)  Lastly, Hanover argues that, because it is an unresolved legal issue whether the 
Coverage applies to a “man in the middle” attack, it could not have acted in bad faith when 

denying coverage.  (Id. at 11–12.)                                        
    The Court finds that it is fairly debatable whether coverage applies. For example, 
Plaintiff alleges that a data breach triggered the Coverage.  (Proposed Am. Compl. ¶¶ 36, 
46, 53, 70.)  To support this claim, Plaintiff cites the following “data breach” definition 
from the Policy:                                                          

    The  failure  or  violation  of  the  security  of  your  “system”  including  the 
    impairment or denial of access to your “system”, including a “Cyber Attack” 
    or unauthorized acts or omissions by a “rogue employee” which damages or 
    harms your “system” or the “system” of a third party for whom you provide 
    “services” for a fee.                                                
(Id. ¶ 34.)  But Plaintiff cites no authority establishing that a “man in the middle” cyber-
attack meets that definition.  In fact, Plaintiff concedes that this is an open legal issue.  
(Hr’g Tr. [Doc. No. 48] 23:8–10.)  And insurers are permitted to dispute coverage on open 
legal issues.  See Sela, 
353 F. Supp. 3d at 865
 (“[B]ad faith arises only when the insurer 
has  no  ‘reasonable  basis’  for  its  construction  of  the  policy.”);  Borchardt,  
2017 WL 8315883
, at *7 (explaining that the insurer is “entitled to debate” an issue that is fairly 
debatable); see also Philadelphia Indem. Ins. Co. v. Youth Alive, Inc., 
732 F.3d 645, 650
 
(6th Cir. 2013) (explaining that, under Kentucky law, an “unresolved legal issue” means 
that the claim is “fairly debatable as a matter of law and will not support a claim of bad 
faith.” (internal quotation marks omitted).)                              
    Even if Plaintiff’s legal interpretation of the Policy might prevail, the fact that the 
issue  is  legally  debatable  precludes  a  bad  faith  claim.    Minnesota  law  only  permits 
amendment to add a bad faith claim in “the absence of a reasonable basis.”  
Minn. Stat. § 604.18
, subd. 2 (emphasis added).  Put differently, the insurer’s interpretation must be 
more than merely incorrect—it must be unreasonable.  See Sela, 
353 F. Supp. 3d at 865
 
(D. Minn. 2018) (“Bad faith does not arise simply because the insurer’s construction of the 
policy was subsequently found to be legally incorrect.” (internal quotation marks omitted)).  
In the absence of any caselaw that controls whether a “man in the middle” attack constitutes 
a data breach on the Policy, the Court finds Hanover’s interpretation reasonable.  See 

Friedberg, 
800 F. Supp. 2d at 1027
 (“[The insurer’s] interpretation of the terms, is at the 
very least fairly debatable and thus not in bad faith.”).                 
    For these reasons, the Court finds that it is fairly debatable whether the Coverage 
applies and thus Plaintiff’s amendment is futile.                         
III.  CONCLUSION                                                          
    Based  on  the  submissions  and  the  entire  file  and  proceedings  herein,  IT  IS 

HEREBY ORDERED that:                                                      
       1.  Plaintiff  Fishbowl  Solutions,  Inc.’s  Objection  [Doc.  No.  47]  is 
         OVERRULED; and                                                  
       2.  The Magistrate Judge’s April 6, 2022 Order [Doc. No. 45] is AFFIRMED.   



Dated: May 9, 2022                   s/ Susan Richard Nelson              
                                    SUSAN RICHARD NELSON                 
                                    United States District Judge         

Trial Court Opinion

                UNITED STATES DISTRICT COURT                             
                    DISTRICT OF MINNESOTA                                


Fishbowl Solutions, Inc.,          Case No. 21-cv-00794 (SRN/BRT)        

          Plaintiff,                                                     

v.                                MEMORANDUM OPINION AND                 

ORDER

The Hanover Insurance Company,                                           

          Defendant.                                                     


Joseph A. Nilan, Daniel A. Ellerbrock, and Nicholas J. Sideras, Gregerson, Rosow, 
Johnson & Nilan, Ltd., 100 Washington Avenue South, Suite 1550, Minneapolis, MN 
55401, for Plaintiff.                                                    

Scott G. Johnson and Rebecca Zadaka, Robins Kaplan LLP, 800 LaSalle Avenue, Suite 
2800, Minneapolis, MN 55402; and Erica Ramsey, Robins Kaplan LLP, 140 North 
Philips Avenue, Sioux Falls, SD 57104, for Defendant.                    


SUSAN RICHARD NELSON, United States District Judge                        
    This matter is before the Court on the Objection [Doc. No. 47] filed by Plaintiff 
Fishbowl Solutions, Inc. (“Fishbowl”) to Magistrate Judge Becky R. Thorson’s April 6, 
2022 Order (the “Order”) [Doc. No. 45], denying Plaintiff’s motion to amend.  Based on a 
review of the files, submissions, and proceedings herein, and for the reasons below, the 
Court OVERRULES the Objection and AFFIRMS the Order.                      
I.   BACKGROUND                                                           
    A.   The Parties                                                     
    Plaintiff Fishbowl is a Minnesota company with its principal place of business in 
Saint Louis Park, Minnesota.  (Proposed First Am. Compl. [Doc. No. 26] (“Proposed Am. 
Compl.”)  ¶ 5.)    Defendant  The  Hanover  Insurance  Company  (“Hanover”)  is  a  New 
Hampshire insurance company with its principal place of business in Massachusetts.  (Id. 

¶ 6.)                                                                     
    B.   Factual Background                                              
         1.   Fishbowl’s Business                                        
    Fishbowl is a software company.  (See id. ¶ 9.)  It creates and customizes packaged 
software  for  its  customers  using  the  latest  technologies.    (Id.)    This  software  helps 
customers innovate and access information.  (Id.)                         
    Fishbowl’s Senior Staff Accountant is Wendy Williams.  (Id. ¶ 10.)  She uses her e-

mail account to send invoices to customers and to communicate with customers regarding 
payment of those invoices.  (See id. ¶ 11.)                               
         2.   The Policy                                                 
    Hanover issued a Technology Professional Liability Policy to Fishbowl, for the 
policy period July 17, 2019, through July 17, 2020.  (Id. ¶¶ 3, 27; Declaration of Scott G. 

Johnson [Doc. No. 32] Ex. 1 (the “Policy”).)  The Policy provides “Cyber Business 
Interruption and Extra Expense” coverage (the “Coverage”), as follows:    
    We will pay actual loss of “business income” and additional “extra expense” 
    incurred by you during the “period of restoration” directly resulting from a 
    “data breach” which is first discovered during the “policy period” and which 
    results in an actual impairment or denial of service of “business operations” 
    during the “policy period.”                                          
(Policy § A.b.1.b.(5); Proposed Am. Compl. ¶ 30.)  The term “[b]usiness income” includes 
net income “that would have been earned or incurred if there had been no impairment or 
denial of ‘business operations’ due to a covered ‘data breach.’ ”  (Policy § F.4.a; Proposed 
Am. Compl. ¶ 31.)  “Business operations” means Fishbowl’s “usual and regular business 
activities.”  (Policy § F.5; Proposed Am. Compl. ¶ 35.)  “Data breach” is defined in seven 

different ways in the Policy.  (Policy § F.9.)                            
         3.   The “man in the middle” attack1                            
    In November of 2019, an unknown individual (“fraudster”) gained unauthorized 
access to Ms. Williams’ e-mail account.  (Proposed Am. Compl. ¶ 10.)  Once inside Ms. 
Williams’ e-mail account, the fraudster created certain “rules” to redirect certain e-mail 
communications  within  the  e-mail  system.    (Id.  ¶ 12.)    One  rule  redirected  e-mail 

communications containing certain keywords to an e-mail account that is not associated 
with  Fishbowl.    (Id.  ¶ 13.)    Another  rule  marked  e-mail  communications  sent  from 
“fedins.com” as having already been “read,” and automatically stored them in the “RSS 
Subscriptions” folder.  (Id. ¶ 14.)  These rules prevented Ms. Williams from noticing 
certain e-mail communications, including e-mails from Federated Insurance regarding 

invoice payments.  (Id. ¶¶ 12–14, 22.)                                    
    The purpose of the scheme was to trick Fishbowl’s customers into paying invoices 
to the fraudster without Fishbowl noticing.  (See id. ¶¶ 16–26.)  Pursuant to this scheme, 
the fraudster directed six of Fishbowl’s customers to change how and where to make their 
payments.  (Id. ¶ 22.)  By employing a variety of techniques to conceal the scheme, the 

fraudster posed as Ms. Williams when communicating by e-mail with Federated Insurance.  

1    The term “man in the middle” refers to when “a person invades a system and 
masquerades as one or more of the entities involved in a communication.”  (Proposed Am. 
Compl. ¶ 2.)                                                              
(Id. ¶¶ 16, 18, 21.)  And the fraudster posed as Federated Insurance when communicating 
by e-mail with Ms. Williams.  (Id. ¶¶ 16–18.)  As a result of the scheme, Federated 

Insurance made two payments to the fraudster, totaling $176,962.  (Id. ¶ 24.) 
    Fishbowl discovered the scheme on January 17, 2020.  (Id. ¶ 22.)  After informing 
the six customers about the scheme, five of them were able to recall or redirect their 
payments.  (Id. ¶ 23.)  However, Federated Insurance was unable to do so.  (Id.)  Although 
the United States Secret Service recovered $29,035.79 of the monies paid by Federated 
Insurance  to  the  fraudster,  Fishbowl  suffered a  loss  of  the  difference,  which  totaled 

$147,926.21.  (Id. ¶¶ 25–26.)                                             
         4.   The Insurance Claim                                        
     In  January  of  2020,  Hanover  received  Fishbowl’s  insurance  claim  seeking 
reimbursement for business interruption and losses due to the fraudster’s conduct.  (Id. 
¶¶ 36–37.)  Within a few weeks, Hanover denied the claim.  (Id. ¶¶ 41, 43.)  Fishbowl 

challenged the denial, and consequently, the parties disputed coverage over the next several 
months.  (See id. ¶¶ 40, 42, 45–72.)                                      
         5.   Fishbowl’s Complaint to the Minnesota Department of        
              Commerce                                                   
    After nine months of disputing coverage, Fishbowl filed a complaint with the 
Minnesota Department of Commerce.  (Id. ¶ 73.)  In response, Hanover’s Property Claims 
Director, Jason Cormier, reviewed the claim again.  (Id. ¶¶ 74–75.)  He concluded, for 
Hanover’s  sixth  time,  that  this  fraudulent  scheme  was  not  covered  by  the  Policy, 
memorializing his conclusion in a letter denying coverage on November 19, 2020.  (Id. 
¶¶ 74, 77.)                                                               

    C.   Procedural History                                              
         1.   The Civil Suit                                             
    On March 24, 2021, Fishbowl filed the Complaint, alleging breach of contract and 
seeking  declaratory  and  monetary  relief.    (Compl.  [Doc.  No.  1]  ¶¶ 71–81.)    During 
discovery, Fishbowl deposed Cormier.  (Proposed Am. Compl. ¶ 78.)  Fishbowl alleges 
that Cormier testified that, as defined by the Policy, Fishbowl “sustained a data breach” 
and “had suffered an actual loss of business income.”  (Id.)              

         2.   Plaintiff’s Motion to Amend                                
    On December 1, 2021, Fishbowl timely moved to amend the Complaint [Doc. No. 
26], seeking to add a claim for bad faith under 
Minn. Stat. § 604.18
.  (Pl.’s Mem. [Doc. 
No. 28] at 1.)  Fishbowl contends that Hanover acted with bad faith by repeatedly ignoring, 
and by failing to properly investigate, its claim and by failing to cover its loss.  (Id.)  

Especially in light of Cormier’s alleged concession that this was a data breach covered by 
the Policy, Plaintiff contends that Hanover acted in bad faith.  (Id.)    
         3.   The Order                                                  
    The magistrate judge denied the motion to amend as futile.  (Order at 13.)  In 
reaching that decision, the court analyzed whether Plaintiff had plausibly plead a claim for 
bad faith under 
Minn. Stat. § 604.18
 in the Proposed Amended Complaint.  (See 
id.
 5–12.)  

Under the first prong of the two-prong test, the magistrate judge found that Fishbowl had 
plausibly plead that Hanover lacked a reasonable basis for denying the Policy’s benefits.  
(Id. at 7–9.)  The court explained that Cormier’s alleged deposition testimony that Fishbowl 
suffered a data breach and business loss under the Policy suggests an “ ‘absence of a 

reasonable basis’ for his earlier denial of coverage.”  (Id. at 8–9.)     
    But the magistrate judge found that Fishbowl failed to plausibly plead the second 
prong of the test.  (See 
id. at 7
, 9–12.)  The court concluded that it is an unresolved legal 
question whether the Coverage applied to losses caused by a “man in the middle” cyber-
attack.  (Id. at 11–12.)  Because the law is unresolved, the court found the issue “fairly 
debatable,” and therefore, cannot serve as a basis for a claim of bad faith.  (Id. at 12.)  

Accordingly, the magistrate judge denied the motion to amend as futile.  (Id. at 13.) 
         4.   The Objection                                              
    Fishbowl objects to the Order, making two arguments.  First, Fishbowl contends 
that it plausibly plead a claim for bad faith under 
Minn. Stat. § 604.18
.  (Obj. at 8.)  Second, 
Fishbowl contends that the magistrate judge improperly relied on information outside of 

the pleadings.  (Id. at 9–13.)                                            
II.  DISCUSSION                                                           
    A.   Legal Standard                                                  
    A district court conducts a de novo review of a magistrate judge’s denial of a motion 
to amend based on futility.  Magee v. Trustees of the Hamline Univ., Minn., 
957 F. Supp. 2d 1047, 1062
 (D. Minn. 2013).  Rule 15(a) of the Federal Rules of Civil Procedure 
provides that “[t]he court should freely give leave [to amend a pleading] when justice so 

requires.”  Fed. R. Civ. P. 15(a)(2).  But “[a] district court may appropriately deny leave to 
amend  where  there  are  compelling  reasons  such  as . . .  futility  of  the  amendment.”  
Moses.com Secs., Inc. v. Comprehensive Software Sys., Inc., 
406 F.3d 1052, 1065
 (8th Cir. 
2005)  (internal  quotation  marks  omitted).    Amendment  is  futile  where  the  proposed 

amended claim would not withstand a motion to dismiss for failure to state a claim.  See 
Lunsford v. RBC Dain Rauscher, Inc., 
590 F. Supp. 2d 1153, 1158
 (D. Minn. 2008).  
    When considering a motion to dismiss under Rule 12(b)(6), the Court accepts the 
facts alleged in the complaint as true and views those allegations in the light most favorable 
to the plaintiff.  Hager v. Arkansas Dep’t of Health, 
735 F.3d 1009, 1013
 (8th Cir. 2013).  
However,  the  Court  need  not  accept  as  true  wholly  conclusory  allegations  or  legal 

conclusions couched as factual allegations.  
Id.
  In addition, the Court ordinarily does not 
consider matters outside the pleadings on a motion to dismiss.  See Fed. R. Civ. P. 12(d).  
Matters outside the pleadings include “any written or oral evidence in support of or in 
opposition to the pleading that provides some substantiation for and does not merely 
reiterate what is said in the pleadings,” as well as statements of counsel at oral argument 

that raise new facts not alleged in the pleadings.  Hamm v. Rhone-Poulenc Rorer Pharm., 
Inc., 
187 F.3d 941, 948
 (8th Cir. 1999) (internal quotation marks and citation omitted).  
The Court may, however, “consider the pleadings themselves, materials embraced by the 
pleadings, exhibits attached to the pleadings, and matters of public record.”2  Illig v. Union 
Elec.  Co.,  
652 F.3d 971, 976
  (8th Cir.  2011) (internal  quotation  marks  and  citation 

omitted).                                                                 


2    For purposes of this motion, the Court has considered the Proposed Amended 
Complaint and the Policy.                                                 
    To survive a motion to dismiss, a complaint must contain “enough facts to state a 
claim to relief that is plausible on its face.”  Bell Atl. Corp. v. Twombly, 
550 U.S. 544, 570
 

(2007).  Although a complaint need not contain “detailed factual allegations,” it must allege 
facts with enough specificity “to raise a right to relief above the speculative level.”  
Id. at 555
.   “Threadbare  recitals  of the  elements  of  a  cause  of  action,  supported  by  mere 
conclusory statements,” are insufficient.  Ashcroft v. Iqbal, 
556 U.S. 662, 678
 (2009) 
(citing Twombly, 
550 U.S. at 555
).                                        

    B.   Analysis                                                        
    The Minnesota Legislature has created a private cause of action to penalize bad faith 
denial of benefits by insurance providers.  See 
Minn. Stat. § 604.18
.  Under the statute, a 
party, after commencing a civil suit, “may make a motion to amend the pleadings to claim 
recovery of taxable costs.”  
Id.,
 subd. 4.  The applicable legal basis for establishing a claim 
under the statute is a two-prong test, which is as follows:               

    The court may award as taxable costs to an insured . . . if the insured can 
    show:                                                                
      (1) the absence of a reasonable basis for denying the benefits of the 
      insurance policy; and                                              
      (2) that the insurer knew of the lack of a reasonable basis for denying the 
      benefits of the insurance policy or acted in reckless disregard of the lack 
      of a reasonable basis for denying the benefits of the insurance policy. 
Id.,
 subd. 2(a).  At this stage of the proceedings, plaintiff needs to plausibly plead facts that 
demonstrate each prong of the test in accordance with Rule 15 of the Federal Rules of Civil 
Procedure.  See Selective Ins. Co. of S.C. v. Sela, 
353 F. Supp. 3d 847, 866
 (D. Minn. 2018). 
    Because the amendment was denied as futile, the Court conducts a de novo review 
of the magistrate judge’s order.                                          

         1.   The First Prong                                            
    The Minnesota Supreme Court has held that “the first prong of the section 604.18 
standard is an objective test.”  Peterson v. W. Nat’l Mut. Ins. Co., 
946 N.W.2d 903
, 910 
(Minn.  2020).    The  pertinent  question  is  “whether  a  reasonable  insurer  under  the 
circumstances would not have denied the insured the benefits of the insurance policy.”  
Id.
   
    Here, Plaintiff alleges, in the Proposed Amended Complaint, that Hanover lacked a 

reasonable basis for denying the Policy benefits.  Simply put, Plaintiff alleges that Cormier 
testified that “Fishbowl sustained a data breach” and that “Fishbowl had suffered an actual 
loss of business income” as defined under the Policy.  (Id.)  Assuming this is true, Hanover 
lacked  a  reasonable  basis  to  deny  Plaintiff  the  Policy’s  benefits.    Put  differently,  a 
reasonable insurer would not have denied the benefits when there was a covered data 
breach.  Accordingly, the Court finds that Plaintiff has plausibly plead the first prong.3 

         2.   The Second Prong                                           
    The second prong is a subjective test, requiring a certain mens rea on the part of the 
insurer.  Peterson, 946 N.W.2d at 912.  Specifically, it requires “an insured to prove that 
the insurer knew, or recklessly disregarded or remained indifferent to information that 



3    The Court finds that Plaintiff has plausibly plead the first prong based on Cormier’s 
alleged testimony and, therefore, does not address Plaintiff’s alternative argument that 
Hanover’s investigation was objectively unreasonable.                     
would have allowed it to know, that it lacked an objectively reasonable basis for denying 
the insured’s claim for benefits.”  Id.                                   

    Here, Plaintiff contends that it has plausibly plead the second prong by alleging that 
Hanover’s investigation was unreasonable.  (Proposed Am. Compl. ¶¶ 36–72, 79–82.)  
Plaintiff  alleges  that  Hanover’s  investigation  “failed  to:  request  supplemental 
documentation from Fishbowl; obtain police reports regarding the incident; contact any 
relevant third parties; secure a formal statement from Williams; obtain recorded statements 
from any relevant individuals; or retain an expert to examine Fishbowl’s system.”  (Id. 

¶ 40, 49.)  Similarly, Plaintiff contends that Hanover failed to reasonably evaluate whether 
first-party coverage was available under the Policy.  (Id. ¶ 43, 52.)  Given these failures, 
Plaintiff contends that Hanover’s investigation was unreasonable and thus asserts that it 
has plausibly plead the second prong.  (See Obj. at 7–8.)                 
    Even if Plaintiff is correct as to the failures of Hanover’s investigation, a district 

court will not grant a motion to amend the pleadings to add a bad faith claim where it is 
“fairly debatable” whether coverage applies.  See, e.g., Swanny of Hugo, Inc. v. Integrity 
Mut. Ins. Co., No. A15-0370, 
2015 WL 9437571
, at *7 (Minn. Ct. App. Dec. 28, 2015) 
(affirming the district court’s denial of the motion to amend to add a bad faith claim under 
Minn. Stat. § 604.18
 based in part on a finding that the claim was “fairly debatable”); 

Homestead Hills Homeowner Ass’n v. Am. Family Mut. Ins. Co., No. A12-0703, 
2012 WL 5896829
, at *4 (Minn. Ct. App. Nov. 26, 2012) (same); Friedberg v. Chubb & Son, Inc., 
800 F. Supp. 2d 1020, 1029
 (D. Minn. 2011) (holding that the insurer’s interpretation was 
“at a minimum, fairly debatable,” which “precludes a finding of bad faith”); The Nw. Mut. 
Life Ins. Co. v. Weiher, Civ. No. 12-1430 (SRN/JSM), 
2016 WL 6917204
, at *17 (D. Minn. 
July  11,  2016)  (“[The  insurer’s]  decision  to  rescind  the  policy  is  ‘fairly  debatable,’ 

rendering the bad faith claim futile.”); Borchardt v. State Farm Fire & Cas. Co., No. 16-
cv-00055 (PJS/KMM), 
2017 WL 8315883
, at *7 (D. Minn. Apr. 26, 2017) (“[T]he prima 
facie evidence submitted in support of the motion to amend shows that the plaintiffs’ claim 
was fairly debatable, and State Farm was entitled to debate it.”).        
    Here, Hanover argues that the Coverage does not apply.  (Def.’s Opp’n at 7–11.)  
First, Hanover argues that the Coverage only applies to potential earnings.  (Id. at 7–8.)  

Because Fishbowl alleges that it continued to earn revenue, but did not receive those 
payments due to the cybercriminal, Hanover argues that there are no lost prospective 
earnings that trigger the Coverage.  (Id. at 8.)  Second, Hanover argues that Plaintiffs’ 
“business operations” were never interrupted.  (Id.).  For example, Hanover contends that 
there is no “period of restoration.”  (Id.  at 9.)  A “period of restoration,” Hanover contends, 

limits coverage to the time during which an actual impairment or denial to Fishbowl’s 
“business operations” is restored.  (Id.)  Because Fishbowl does not allege that it restored 
its business operations, Hanover argues that it had a reasonable basis to deny coverage.  
(Id.)  Lastly, Hanover argues that, because it is an unresolved legal issue whether the 
Coverage applies to a “man in the middle” attack, it could not have acted in bad faith when 

denying coverage.  (Id. at 11–12.)                                        
    The Court finds that it is fairly debatable whether coverage applies. For example, 
Plaintiff alleges that a data breach triggered the Coverage.  (Proposed Am. Compl. ¶¶ 36, 
46, 53, 70.)  To support this claim, Plaintiff cites the following “data breach” definition 
from the Policy:                                                          

    The  failure  or  violation  of  the  security  of  your  “system”  including  the 
    impairment or denial of access to your “system”, including a “Cyber Attack” 
    or unauthorized acts or omissions by a “rogue employee” which damages or 
    harms your “system” or the “system” of a third party for whom you provide 
    “services” for a fee.                                                
(Id. ¶ 34.)  But Plaintiff cites no authority establishing that a “man in the middle” cyber-
attack meets that definition.  In fact, Plaintiff concedes that this is an open legal issue.  
(Hr’g Tr. [Doc. No. 48] 23:8–10.)  And insurers are permitted to dispute coverage on open 
legal issues.  See Sela, 
353 F. Supp. 3d at 865
 (“[B]ad faith arises only when the insurer 
has  no  ‘reasonable  basis’  for  its  construction  of  the  policy.”);  Borchardt,  
2017 WL 8315883
, at *7 (explaining that the insurer is “entitled to debate” an issue that is fairly 
debatable); see also Philadelphia Indem. Ins. Co. v. Youth Alive, Inc., 
732 F.3d 645, 650
 
(6th Cir. 2013) (explaining that, under Kentucky law, an “unresolved legal issue” means 
that the claim is “fairly debatable as a matter of law and will not support a claim of bad 
faith.” (internal quotation marks omitted).)                              
    Even if Plaintiff’s legal interpretation of the Policy might prevail, the fact that the 
issue  is  legally  debatable  precludes  a  bad  faith  claim.    Minnesota  law  only  permits 
amendment to add a bad faith claim in “the absence of a reasonable basis.”  
Minn. Stat. § 604.18
, subd. 2 (emphasis added).  Put differently, the insurer’s interpretation must be 
more than merely incorrect—it must be unreasonable.  See Sela, 
353 F. Supp. 3d at 865
 
(D. Minn. 2018) (“Bad faith does not arise simply because the insurer’s construction of the 
policy was subsequently found to be legally incorrect.” (internal quotation marks omitted)).  
In the absence of any caselaw that controls whether a “man in the middle” attack constitutes 
a data breach on the Policy, the Court finds Hanover’s interpretation reasonable.  See 

Friedberg, 
800 F. Supp. 2d at 1027
 (“[The insurer’s] interpretation of the terms, is at the 
very least fairly debatable and thus not in bad faith.”).                 
    For these reasons, the Court finds that it is fairly debatable whether the Coverage 
applies and thus Plaintiff’s amendment is futile.                         
III.  CONCLUSION                                                          
    Based  on  the  submissions  and  the  entire  file  and  proceedings  herein,  IT  IS 

HEREBY ORDERED that:                                                      
       1.  Plaintiff  Fishbowl  Solutions,  Inc.’s  Objection  [Doc.  No.  47]  is 
         OVERRULED; and                                                  
       2.  The Magistrate Judge’s April 6, 2022 Order [Doc. No. 45] is AFFIRMED.   



Dated: May 9, 2022                   s/ Susan Richard Nelson              
                                    SUSAN RICHARD NELSON                 
                                    United States District Judge         

Reference

Status
Unknown