CYBER CORNER

A construction funds administration company (“CFA”) was the victim of a social engineering scheme, where, following receipt of transfer instructions it did not realize were fraudulent, the CFA transferred money to a Hong Kong company. The company was not previously listed in the fund operating agreement, nor did it meet other criteria set up for distribution of funds, and no documentation or verification was made by the CFA. The fraud was eventually discovered when there were insufficient funds in the account to make other valid distributions, and it was subsequently determined to be the result of a threat actor hacking an employee’s email account. Prior to notifying its insurer of the loss, the CFA borrowed money to replace the misdirected funds and avoid default of payments to valid subcontractors and suppliers.  

The CFA thereafter tendered notice under its professional liability insurance policy for the full amount of the transfer, but the insurer denied the claim. Asserting that the improperly transferred funds arose from a fraudulent email stream, the insurer concluded the claim was excluded pursuant to the policy’s “Unauthorized Network Access Exclusion.” The exclusion precluded coverage for any claim “based upon, arising from or in consequence of any unauthorized or exceeded authorized access to, use of or alteration of, any computer program, software, computer, computer system or any input, output, processing, storage and communication devices that can be connected thereto.” Coverage litigation ensued.

Finding in favor of the insurer, the court held that the breach exclusion applied, rejecting the CFA’s argument that the failure to verify the account was the proximate cause of the fraudulent transfer. According to the court, the exclusionary language at issue “clearly contemplates losses precipitated by social engineering events such as hacking.” Significantly, the court noted that rather than limiting the breach exclusion’s application to injuries “arising out of” unauthorized access, the exclusion more broadly precluded coverage for injuries “based upon, arising from or in consequence of any unauthorized or exceeded authorized access to” any computer program or network.

The court further held that even if the breach exclusion did not apply, the CFA failed to notify its insurer of the loss before settling the claim. The policy’s notification provisions stated that the insurer “shall not be liable for any settlement, Defense Cost, assumed obligation or admission to which it has not given its prior written consent.” When the CFA failed to notify its insurer of the claim prior to its resolution, “it materially prejudiced [the insurer]’s ability to assert any defenses,” the court found, further concluding that since the insurer “did not give its written consent to [the CFA]'s unilateral resolution of the hacking issue,” the CFA could not obtain indemnification under the policy.

A federal court in Georgia dismissed a purported class-action complaint filed by the owners of a gas station and convenience store against the operators of one of the largest gas pipelines in North America, following a ransomware attack on the company’s network that led to a disruption in fuel shipments.

The owners of the gas station alleged negligence by the pipeline in the maintenance of its computer system, thereby leaving it vulnerable to the cyberattack and resulting in fuel shortages and a sharp decrease in sales. The pipeline company argued it owed no duty to continually provide service to the retailer. Even if a duty were owed, the company argued the retailer could not make out a claim of negligence because its losses were strictly economic in nature.  

Applying Georgia law, the court agreed with the pipeline company, concluding that no such duty existed and the state’s “economic loss rule” precluded tort claims by businesses suffering purely financial harm. The court ruled that the only recourse for the retailer was a claim sounding in contract.