United States Court of Appeals for the Fifth Circuit United States Court of Appeals Fifth Circuit

FILED July 21, 2021 No. 19-20430 Lyle W. Cayce Clerk

Landry’s, Incorporated, as successor in interest to Landry’s Management, LP,

Plaintiff—Appellant,

versus

The Insurance Company of the State of Pennsylvania,

Defendant—Appellee.

Appeal from the United States District Court for the Southern District of Texas USDC No. 4:18-CV-2679

Before Smith and Oldham, Circuit Judges.* Andrew S. Oldham, Circuit Judge: The question presented is whether the Insurance Company of the State of Pennsylvania (“ICSOP”) has a duty to defend its insured, Landry’s, in data-breach litigation. At summary judgment, the district court said no. We disagree and reverse.

* Judge Ho participated in oral argument and then determined that he is recused. Accordingly, this matter is decided by a quorum. See 28 U.S.C. § 46(d). Case: 19-20430 Document: 00515945903 Page: 2 Date Filed: 07/21/2021

No. 19-20430

I. Landry’s is a Houston-based company that operates retail properties like restaurants, hotels, and casinos. Paymentech, LLC—a branch of JPMorgan Chase Bank—processes Visa and MasterCard payments to those properties. A typical payment process follows the same steps: (1) The customer presents his card to a Landry’s property; (2) a point-of-sale system at Landry’s sends the credit-card information to Paymentech; (3) Paymentech obtains an authorization from Visa or MasterCard and from the bank that issued the customer’s credit card; and (4) the funds are collected and sent to JPMorgan Chase. On December 2, 2015, Paymentech 1 discovered credit-card problems at some Landry’s properties. Paymentech began an investigation, which uncovered a data breach that occurred across 14 Landry’s locations between May 2014 and December 2015. Landry’s then initiated its own investigation, and it discovered that the data breach involved the unauthorized installation of a program on its payment-processing devices. The program was designed to search for data from credit cards’ magnetic strips—including the cardholder’s name, card number, expiration date, and internal verification code—as the information was being routed through the payment-processing systems. Over approximately a year and a half, the program retrieved personal information from millions of customers’ credit cards. And at least some of that credit-card information was used to make unauthorized charges. As relevant here, the fallout from the data breach implicated four contracts. The first two bound Paymentech to Visa and MasterCard. In its membership agreement with Visa, Paymentech agreed to participate in the

1 Given their corporate relationship, and for ease of reference, we refer to JPMorgan Chase and Paymentech simply as “Paymentech.”

2 Case: 19-20430 Document: 00515945903 Page: 3 Date Filed: 07/21/2021

No. 19-2043