A federal district court in Utah has ruled that an insurance company had no duty to defend its insureds under a cyber liability policy when the allegations against the insureds alleged "knowledge, willfulness, and malice" instead of "errors, omissions, or negligence."

Global Fitness owns and operates fitness centers in several states with numerous members who provided either credit card or bank account information through which Global Fitness could bill the members (Member Accounts Data.). Federal Recovery Services, Inc. (FRS) and Federal Recovery Acceptance, Inc. (FRA) dba Paramount Acceptance (together, the defendants) provide processing, storage, transmission, and other handling of electronic data for customers. Like many merchants, Global Fitness entered into a Servicing Retail Installment Agreement with FRA that required FRA to process the Member Accounts and transfer the members' fees to Global Fitness.

The payment process worked like this: Global Fitness obtained billing information from its members, which it then uploaded to FRA's encrypted website, including credit card, checking account or savings account information that the member selected to be charged each month for membership. For security purposes, the only copy of the Member Accounts Data was retained by FRA on behalf of Global Fitness. FRA would process or electronically withdraw the necessary funds from the Member Accounts and transfer those funds, following FRA's deduction of its fee, to Global Fitness.