Insurance is supposed to work like a safety net — catch the fall, absorb the damage, keep the business standing. But sometimes the net has holes, or at least that's the accusation now playing out in federal court. A Wisconsin business process outsourcing company claims a Chubb insurance unit yanked that net away right when it was needed most, breaching its policy by refusing to cover $5 million the company paid to Adidas over data breaches that exposed the sportswear giant's customers' personal information.

The Company at the Center of the Dispute

Alta Resources Corp. filed a complaint Monday alleging Ace American Insurance Co. improperly denied coverage for Adidas' claims against Alta, arguing that the underlying damages fall squarely within the Chubb professional enterprise risk management policy the company had purchased.

A Costly Payout Tied to Compromised Data

According to the complaint, Alta paid more than $5 million to Adidas over allegations that third parties gained access to Adidas customers' personally identifiable information through Alta's systems. Adidas itself had been sued by customers alleging their personal data was exposed in hacking incidents — and the sportswear company, facing that legal pressure, turned around and demanded Alta cover the resulting damages.

The Insurer Draws a Different Line

Alta says it promptly alerted Ace to Adidas' claim against the call center. While Ace acknowledged that Adidas' demand could be considered a timely claim, the insurer denied third-party coverage, citing the policy's contract exclusion and arguing the claim didn't involve a covered professional incident, according to the complaint.

Accusations of Bad Faith

Alta isn't taking the denial quietly. The company alleges Ace breached the policy and acted in bad faith, accusing the insurer of advancing what it calls "an unreasonably narrow construction" of the contract exclusion. Alta further claims Ace was fully aware of the company's operations — operations Alta says are explicitly listed in the professional services section of the very policy at issue — yet denied coverage anyway.

Marketing Promises Versus Claims Denials

"Ace's own marketing materials hold out its policies as covering business-process outsourcing companies like Alta for exactly the type of claims at issue, yet Ace relied on the contract exclusion to avoid its obligations," Alta stated in the complaint, adding that "Ace knew or recklessly disregarded the fact that there was no reasonable basis for denying coverage" — essentially accusing the insurer of selling one story to attract customers and telling a different one when it came time to pay.

What the Policy Actually Covers

The policy in question, running from June 1, 2024, through June 1, 2025, provides third-party liability coverage that includes cyber, privacy and network security liability, according to the complaint. Through this coverage, Ace had promised to defend and indemnify Alta against cyber incidents — a promise Alta says the insurer is now trying to sidestep.

A Two-Decade Relationship Now in Dispute

This isn't a case of an insurer meeting an unfamiliar client. Alta has purchased coverage from Ace or its Chubb affiliates for roughly 20 years, paying "millions of dollars" in premiums for cyber and professional liability insurance over that span. Given that lengthy history, Alta argues Ace was intimately familiar with the nature of its business and understood precisely why the company needed protection against data breaches involving personal information.

Defining the Terms at the Heart of the Case

Alta further contends that Ace knew customers frequently brought cybersecurity-related claims against companies like Alta, and that the insurer had marketed its policies as covering exactly these kinds of data breach scenarios — including claims resembling the Adidas dispute now at issue.

Breaking Down the Policy Language

According to the complaint, the policy defines a cyber incident, in part, as "any actual or reasonably suspected failure by an Insured … to properly handle, manage, store, destroy, protect, use, or otherwise control protected information." That protected information includes a person's name, email address, Social Security number, protected health information, debit and credit card numbers, phone number and more — a broad category seemingly built to cover exactly the kind of exposure Adidas' customers experienced.

Professional Services Squarely in Scope

The professional liability coverage, meanwhile, extends to damages and claims expenses arising from a professional incident — defined as any error, omission, negligence or breach of duty in rendering or failing to render a professional service, according to the complaint. Alta points out that call center services and customer service solutions are explicitly included in the policy's list of covered professional services — precisely the type of work Alta says it performed for Adidas.

Why the Contract Exclusion Shouldn't Apply

Alta also pushes back directly against Ace's reliance on the contract exclusion, which generally bars coverage for breach-of-contract claims against an insured. According to Alta, that exclusion simply doesn't apply to the Adidas claim as structured, making Ace's denial legally unsupportable in the company's view.

Tracing the Breach Back to Its Source

The underlying dispute stems from Adidas' allegation that Alta bore responsibility for data breaches the sportswear company experienced in June 2024 and January 2025. In May 2025, Adidas formally notified Alta of cyber breaches in which third parties accessed customer personal information using credentials issued to Alta, according to the complaint.

The Bill Comes Due

Adidas subsequently demanded that Alta cover damages connected to those breaches, including exposure tied to two putative class actions filed against the sportswear company. Alta says it ultimately paid more than $5 million to resolve those claims — and is now seeking to recover the full $5 million policy limit from Ace.

Where Things Stand Now

Alta did not immediately respond to a request for comment Tuesday. A Chubb representative also did not immediately respond to a request for comment.

Alta Resources Corp. is represented by Michael J. Grant of Tabet DiVito & Rothstein LLC. Counsel information for Ace was not immediately available Tuesday.

For a company that spent two decades paying premiums in good faith, this case boils down to a simple but expensive question: when a data breach finally arrives and the bill comes due, does the safety net actually hold — or does fine print quietly pull it away at the exact moment it's needed most?