Court Finds Physical Manifestations Of Purely Mental And Emotional Injuries Do Not Constitute ‘Bodily Injury’

In a win for Wiley’s client, the United States District Court for the Western District of Pennsylvania, applying Pennsylvania law, has held that physical manifestations of emotional injuries resulting from a hacker’s alleged access to private photos do not constitute “bodily injury.” Keffer Dev. Servs., LLC v. Hartford Cas. Ins. Co., 2026 WL 2267711 (W.D. Pa. Aug. 6, 2026). The court further held that the policy’s information disclosure exclusion barred coverage for the alleged injuries under the policy’s personal and advertising injury coverage.

The insured developed and operated software used by collegiate athletic programs. A former university coach allegedly gained unauthorized access to personal identifying information of numerous female athletes stored in this software, including passwords and information commonly used in passwords. He then allegedly used that information to hack into the athletes’ social media and cloud accounts, gaining access to the athletes’ personal photos. The victims of the breach filed various class actions against numerous defendants, including the insured, alleging that the insured failed to institute reasonable protective measures to prevent the data breach. The plaintiffs alleged that they experienced emotional distress, embarrassment, and anxiety as a result of the breach, and also alleged physical manifestations of those emotional symptoms. The insured’s general liability insurer denied coverage for the class actions, asserting that the allegations in the complaints did not trigger the policy.

The court granted the insurer’s motion to dismiss, finding that the policy’s bodily injury coverage part did not apply. The policy defined “bodily injury” to include only physical injuries, and the plaintiffs did not allege that the coach had any physical contact with the plaintiffs. Although the plaintiffs had alleged physical manifestations of emotional distress, under Pennsylvania law, those injuries did not constitute physical or bodily injury because they did not arise from harmful physical contact.

The court further held that the policy’s personal and advertising injury coverage part did not apply. Although that coverage part provided coverage for wrongful entry into premises occupied by the insured, that coverage was only triggered when the invasion was committed by the premises’ owner, landlord, or lesser, which the coach indisputably was not. Additionally, the court held that even if the policy’s personal and advertising injury coverage was triggered, coverage would have been barred by the information disclosure exclusion, which barred coverage for personal and advertising injuries resulting from the disclosure of personal information.