D&O case studies: data breaches, investor claims and limits

In short. International D&O cases show three trends. First, cyber security and risk management have become part of the board's duty of oversight, and data breaches are followed by investor suits. Second, in major crises D&O insurance is often the main source of funding for defence costs and settlements. Third, the limit is not bottomless: in large cases the insurance cover has been exhausted and the loss has remained with the company or the directors.¹ The descriptions are based on public secondary sources. Boeing, Volkswagen and ClientEarth v Shell, together with Estonian case law on the liability of management board members, are analysed in more depth on the D&O insurance page of the Estonian site: see D&O-kaasused (in Estonian). D&O insurance under Estonian law is covered in D&O claims in Estonia.

A. A cyber incident as a management risk

1. Equifax (United States)

In 2017 the data of about 148 million people were stolen from the systems of the credit reporting company; the incident is attributed to a failure to patch a known security vulnerability. In addition to consumer and regulatory claims, investors brought a securities class action, which was settled in 2020 for USD 149 million.²

Lesson. Cyber security is a matter of board oversight. If a company has made public statements about its cyber security, an incident may turn into a securities claim.

2. Yahoo! derivative suit (United States)

Former officers and directors of Yahoo! entered into a USD 29 million settlement in a shareholder derivative suit concerning the late disclosure of data breaches.³ It has been regarded as one of the first derivative suits arising from a data breach to end with a monetary recovery.

Lesson. Directors' knowledge of security problems combined with a failure to disclose them is a classic D&O risk.

B. The duty of oversight and its consequences

3. Boeing 737 MAX (United States)

After two air crashes, shareholders brought a derivative suit alleging that the board had failed to organise oversight of safety risks. The suit was settled in 2021 for USD 237.5 million, funded by the D&O insurers; the settlement also included governance changes.⁴

Lesson. The duty of oversight (in US law, the so-called Caremark standard) is not limited to financial reporting. Under Estonian law, too, a member of the management board or of the supervisory board must prove that he or she acted with the diligence of a prudent businessperson (Commercial Code (äriseadustik, ÄS) §§ 187, 327).⁵

4. Wells Fargo (United States)

For years, the bank's employees opened accounts without customers' knowledge in order to meet sales targets. Regulatory fines, derivative suits and securities suits followed; one of the securities class actions was settled in 2023 for USD 1 billion.⁶

Lesson. The board's responsibility also extends to the company's culture and incentive systems. Deliberate misconduct is excluded under D&O policies, but defence costs are often advanced.

5. CBS and #MeToo (United States)

After harassment allegations concerning senior executives, investors brought a securities class action alleging that the company had not disclosed the resulting risks. The suit was settled in 2022.⁷

Lesson. Employment and culture risk can quickly turn into investor risk.

C. Large investor claims and the limits of the limit

6. Volkswagen "dieselgate" (Germany, United States)

In 2015 it emerged that the software of the company's diesel engines detected emissions tests. In the United States, regulatory and consumer claims were settled in 2016 for up to USD 14.7 billion.⁸

Lesson. A company may itself claim damages from its former directors, and the contribution of the D&O insurers is often decisive in such settlements.

7. Wirecard (Germany)

The payment company collapsed in 2020 when it emerged that EUR 1.9 billion shown on its balance sheet did not exist. A German court later held former management board members liable for EUR 140 million plus interest.⁹

Lesson. The loss may exceed the D&O limit several times over. Personal protection for the directors through a separate Side A layer is important for large risks.

8. Enron and WorldCom (United States)

The accounting frauds at these two large companies in the early 2000s led to investor class actions. In both cases outside directors paid part of the settlements personally, in addition to the insurers' payments.¹⁰

Lesson. These cases shaped the D&O market: limit towers grew, and so did separate layers of personal protection for directors.

9. Petrobras (Brazil, United States, Netherlands)

The exposure of a corruption scheme in 2014 and 2015 led to a US securities class action, which was settled in 2018 for about USD 3 billion. A collective action continued in the Netherlands, and in 2024 a Dutch court gave judgment in it.¹¹

Lesson. An international investor base brings a risk of proceedings in several jurisdictions and loss amounts that exceed D&O limits.

10. Royal Bank of Scotland rights issue (United Kingdom)

Investors alleged that the prospectus for the bank's 2008 rights issue did not disclose the risks adequately. In 2017 the bank reached settlements with investors.¹²

11. Tesco (United Kingdom)

In 2014 the retailer announced that it had overstated its profit. The investor claims that followed were settled.¹³

12. Fortis/Ageas (Belgium, Netherlands)

Investor claims brought after the 2008 financial crisis were settled under the Dutch collective settlement procedure for about EUR 1.3 billion.¹⁴

Lesson from cases 10 to 12. In Europe, collective investor claims have become a serious risk. An Estonian or other Baltic company that issues bonds or shares must take prospectus liability into account.

D. Climate and ESG disputes

13. ClientEarth v Shell's board (United Kingdom)

An environmental organisation, acting as a shareholder, brought a derivative claim against the members of Shell's board, alleging that the way the board managed climate risk breached the directors' duties. In 2023 the English court refused permission to continue the claim.¹⁵

14. Climate disputes and activist investors (United States)

The disputes between ExxonMobil and activist investors, and the suits concerning the disclosure of climate risks, show that ESG issues have become a potential D&O risk.¹⁶

Lesson. Climate risk is not merely a reputational issue. D&O policies have begun to include ESG-related restrictions, and these must be read.

E. Insurers' claims examples

The management liability claims examples published by insurers (anonymous and generalised) show the situations in which a D&O policy responds in practice.¹⁷ The five examples below are the author's summaries of such examples; they should be read as illustrative scenarios, not as verified reports of particular payments or of the wording of the policies involved.

• Food safety crisis. A food producer's products were suspected of contamination; a recall, a regulatory investigation and investor allegations that the board had failed to invest in quality control followed. D&O insurance funded the directors' defence and the costs of the regulatory proceedings.
• Asset freeze. The personal accounts of the chief executive of an international group were frozen during an investigation, although no charges were brought. The asset freezing extension covered the executive's living expenses until the freeze was lifted.
• Insolvency investigation. A family-run transport company went bankrupt, and the authorities investigated whether the board had continued trading when insolvency was foreseeable. D&O insurance funded the directors' representation.
• Fatal workplace accident. After the death of a haulage company's driver, the liability of the company and of its managers for disregarding the rules on working and rest time was investigated. Extended management liability cover funded the defence.
• Pollution and a shareholder class action. Pollution from a chemical plant was followed by regulatory claims and a shareholder class action. D&O insurance funded the directors' defence and part of the settlement; the clean-up fell under environmental liability insurance.

Estonian law context. Where the company's insolvency is not temporary, the management board must file a bankruptcy petition without delay, and no later than 20 days after the insolvency became apparent, and must not make payments that are inconsistent with the diligence of a prudent businessperson (ÄS § 180 lg 5¹).⁵ The bankruptcy trustee may bring a claim against the board members, and in that situation D&O insurance is often the only realistic source of defence costs.

F. What these cases mean for Estonian directors

1. Cyber security is the board's responsibility, particularly within the scope of the Cybersecurity Act (küberturvalisuse seadus, KüTS § 6¹).¹⁸
2. The limit must match a realistic claim, bearing in mind that defence costs may sit within the limit and that the limit is shared by all insured persons.
3. Personal protection for directors (Side A cover, a separate Side A limit) matters where the company cannot or will not indemnify them (insolvency, conflict of interest).
4. Notice of circumstances given before the policy ends can attach a later claim to the earlier policy, but only if the policy contains a notice-of-circumstances clause and the notice is given in time and in the detail the clause requires; an extended reporting period is a contractual window within which claims may be first made or reported, not in itself the period during which an already notified claim is defended. The notification duty in VÕS § 514 does not by itself link a later claim to the earlier period.
5. Documentation is a director's best defence.

G. D&O policy checklist based on the cases

1. The limit and how it is shared. Is the limit sufficient if several directors need a defence at the same time and the company itself is also insured (Side C)? Do defence costs erode the limit?
2. Side A limit. Do the directors have a separate limit that claims by or against the company cannot exhaust (Wirecard, Petrobras)?
3. Insured persons. Are former directors, directors of subsidiaries, supervisory board members and de facto directors covered?
4. Definition of claim. Does "claim" include a regulatory investigation, an asset freeze and criminal proceedings?
5. Cyber exclusion. Does the D&O policy exclude claims arising from a cyber incident (Equifax, Yahoo)?
6. Conduct (intent) exclusion. Does the exclusion apply only where intent has been established by a final judgment, and are defence costs advanced?
7. Severability. Is the knowledge or conduct of one director prevented from being imputed to the others?
8. Insured vs insured. Does the exclusion contain exceptions for claims by the company, derivative suits and claims by the bankruptcy trustee?
9. Territory. Are claims brought in foreign countries covered, including the United States, if the company has investors or operations there?
10. Run-off. Does the policy provide an extended reporting period on cessation of business, a merger or insolvency?
11. ESG. Does the policy contain a climate or ESG exclusion, and is it acceptable?

Related pages

• D&O claims in Estonia: director liability and insurance
• Public incidents in the Baltic states
• Stsenaariumid (in Estonian): scenarios, including a data breach followed by an investor claim
• Simulatsioonid (in Estonian): simulations, including a D&O crisis

References