Courts Strictly Construing Cyber Insurance Policies, Finding Coverage Is Narrow

In February 2021, a Texas federal court determined that a payment processor for rental property management companies was not covered for losses from a phishing event. See, RealPage v. National Union Fire Insurance Co. of Pittsburgh, Case No. 3:19-cv-1350-B, United States District Court, Northern District of Texas (Feb. 24, 2021). Hackers used a fishing scam to gain access to funds held by RealPage's third-party payment processor, Stripe. RealPage made a business decision to reimburse its clients. The policy required that RealPage "hold" funds as a prerequisite to coverage for any funds stolen through cyber fraud. The insurer denied the claim because, while RealPage could direct the transfer of those funds in the Stripe accounts, RealPage never "held" the funds that were lost.

In September, a Minnesota federal court determined that there was no computer fraud coverage for a social engineering loss. Social engineering is a term used for certain types of security incidents where malicious actors trick someone into giving away sensitive information or transferring company funds. See, SJ Computers v. Travelers Casualty and Surety Company of America, Case No. 21-CV-2482, United States District Court, District of Minnesota (Aug. 12, 2022). "Spoofed" emails were sent from an outside vendor to the purchasing manager at SJ Computers. The "spoofed" emails contained updated wire transfer instructions for the payment of the vendors' invoices. SJ Computers paid invoices totaling nearly $600,000, but the payments went to the hackers' bank accounts.