Can you afford to have cyber insurance coverage?

This blog has been following a number of lawsuits between insurance companies and their insureds over who is responsible for covering cyber-attack losses. In many cases the insureds have been forced to file a lawsuit against their insurance providers because the insurance companies have denied claims for hundreds of thousands or millions of dollars.

In a recent case, however, the insurance company acted first and filed a lawsuit in federal court asking the court to rule that the insurance company does not have to pay for an insured’s losses. The facts that led to the cyber loss in Maxum Indemnity Company v. Long Beach Escrow & Joyce Clark are all too familiar.

The case started when an escrow company, Long Beach Escrow, received an email from a real estate company instructing Long Beach Escrow to wire $250,000 to a bank account. The email claimed to be from the real estate company’s managing partner and explained that the managing partner would be unavailable for several weeks.

The email was not legitimate, and was actually from hackers who had gained access to the real estate company’s email system. Long Beach Escrow did not attempt to verify the authenticity of the wire transfer request and instead wired the money to the fraudster’s bank account. The money could not be recovered.

The real estate company sued Long Beach Escrow. Long Beach Escrow made a claim under its insurance policy from Maxum Indemnity. Maxum agreed to pay the costs of defending Long Beach Escrow, but reserved the right to file a lawsuit asking a court to rule that Maxum Indemnity is not liable for Long Beach Escrow’s losses.  

On August 8, 2016 Maxum Indemnity filed its lawsuit disputing coverage for Long Beach Escrow’s losses. Maxum Indemnity argues that two exclusions in the policy deny coverage to Long Beach Escrow. First, the policy denies coverage for any loss resulting from the misappropriation or conversion of funds. Second, the policy excludes coverage for any claim resulting from a breach of the insured’s fiduciary duty.

Regarding the first exclusion, Maxum Indemnity argues that ultimately the real estate company’s claim against Long Beach is for the theft of funds. In essence, Maxum Indemnity claims that Long Beach either participated in or facilitated the theft of funds and therefore should not be covered.

Regarding the second exclusion, as an escrow company Long Beach Escrow owes a fiduciary duty to companies that contract with Long Beach Escrow to hold funds. Maxum Indemnity argues that Long Beach Escrow did not have sufficient security and controls in place to prevent the fraudulent wire transfer from occurring and this was a breach of Long Beach Escrow’s fiduciary duty to the real estate company.

The second claim is interesting because if Maxum Indemnity is successful then it will mean that fiduciaries, such as trust and real estate companies, have an obligation to implement effective cybersecurity practices and procedures. Maxum Indemnity’s argument could apply to any organization that is responsible for safeguarding money that belongs to others.

Maxum Indemnity’s case was filed on August 8, 2016, so it will be a while before the court resolves it. In the meantime, Long Beach Escrow will have to fight two lawsuits—one against the real estate company and one against its own insurance company. Even though Long Beach Escrow only has to pay attorneys’ fees for one of the cases it will still have to spend valuable staff hours dealing with each case. The takeaway from cases between insureds and their insurance providers is that organizations should carefully review their insurance policies to determine whether they have coverage for cyber-attack losses.

 The material in this blog is not intended, nor should it be construed or relied upon, as legal advice. Please consult with an attorney if specific legal information is needed.