Credit: jijomathaidesigners/Shutterstock.com

This story is reprinted with permission from the Insurance Coverage Law Center, the industry's only comprehensive digital resource designed for insurance coverage law professionals. Visit the website to subscribe.

A federal court in New Jersey has refused to dismiss a company's lawsuit against its insurer seeking to recover a nearly $1 million loss allegedly caused by a hacker.

The Case

In July 2017, The Children' Place, Inc. (“TCP”) asserted that it learned that two payments totaling $967,714.29 had been made to an unauthorized third party (the “Hacker”) instead of to TCP's vendor, Thailand-based Universal Apparel Co., Ltd.

TCP alleged that the Hacker, “through the direct use of a computer, falsified email domain names to appear virtually identical to those of individuals working at Universal”; “accessed and infiltrated Universal's web email service[;] and intercepted emails sent between Universal and TCP.”

In addition, the TCP asserted, the Hacker “through the use of a computer, was also able to intercept TCP's Vendor Setup Form, which includes payment instructions, and send it to Universal, making it appear to come from TCP. Universal completed the form and returned it to the Hacker, believing it to be from TCP.” “The Hacker then altered the payment instructions on the Vendor Setup Form to include directions to pay a bank account associated with the Hacker, SITI UMIROH.”

The Hacker thus “changed the contact information for Universal on th[at] Vendor Setup Form” and “sent the forged Vendor Setup Form to TCP.”

Finally, according to TCP, the Hacker “intercepted Universal's letterhead” and sent a letter to TCP on that letterhead dated June 13, 2017, stating that “that SITI UMIROH, the beneficiary on the Vendor Setup Form, was a branch of Universal and that Universal changed its bank account information due to an audit.” “The forged letter . . . direct[ed] TCP to pay Universal using a new bank account number [and] was then emailed to TCP. . . .”

In sum, TCP asserted, the Hacker “intercepted an email conversation between TCP and Universal”; “inserted itself into the conversation”; “requested a change of bank information”; and fraudulently “direct[ed] TCP to pay Universal using [the] new bank account number.” “The Hacker's fraud[] . . . took place over a 6-week period,” leading TCP, on July 14, 2017, to make “a $498,753.58 payment to . . . the altered bank account operated by the Hacker” and, on July 17, 2017, to make “a second payment to the same account in the amount of $468,960.71.”

TCP said that it was unable to recover any of the funds transferred, “resulting in a loss of $967,714.29” (the “Loss”) and other damages.

TCP submitted a claim for the Loss to Great American Insurance Company under its crime protection policy, which Great American denied. TCP sued, asserting a variety of claims, including under the policy's computer fraud coverage.

Great American moved to dismiss the computer fraud claim, contending that:

• “First, although the complaint alleges that the [Hacker] accessed Universal's email system, it does not allege facts to show that the [Hacker] 'gain[ed] direct access' to a computer system that belonged to TCP or its financial institution.”
• “Second, even if the [c]ourt finds that the [Hacker] directly accessed TCP's email system, TCP's loss would not be covered because the [Hacker] did not 'thereby fraudulently cause the transfer of money . . . from [TCP's] premises or banking premises to a person, entity, place or account outside [TCP's] control.'”

The Great American Insurance Policy

The Great American insurance policy defined computer fraud as:

loss resulting directly from the use of any computer to impersonate you, or your authorized officer or employee, to gain direct access to your computer system, or to the computer system of your financial institution, and thereby fraudulently cause the transfer of money, securities or other property from your premises or banking premises to a person, entity, place or account outside your control.

The District Court's Decision

The court, rejecting Great American's arguments, ruled that TCP stated a claim under the computer fraud provision of the Great American policy.

In its decision, the court explained that computer fraud was defined to include “the use of any computer . . . to gain direct access to [TCP's] computer system. . . .” The court then noted that TCP alleged that, “The Hacker, through the use of a computer, . . . accessed and infiltrated Universal's web email service”; “intercepted emails sent between Universal and TCP”; and “inserted itself into [TCP's email] conversation.” TCP also suggested that when “the Hacker redirected [email] messages to go to him,” he “effectively gained access to TCP's email system” because “an email system that does not send the messages to the intended recipient is no longer under the control of the sender.”

The court rejected Great American's assertion that these allegations did “not mean the [Hacker] actually accessed TCP's email system,” explaining that Great American did not cite any legal authority in support of that proposition. By contrast, the court said that it was persuaded by the TCP's legal authority to the contrary: Medidata Sols., Inc. v. Fed. Ins. Co., 268 F. Supp. 3d 471, 478 (S.D.N.Y. 2017); Medidata Sols Inc. v. Fed. Ins. Co., 729 F. App'x 117, 118 (2d Cir. 2018).

Moreover, the court added, any factual issue as to whether the Hacker “actually” accessed TCP's email system through its “infiltrat[ion],” “intercept[ion],” and “insert[ion]” could not be resolved against TCP on a motion to dismiss.

The court also rejected Great American's contention that TCP had not plausibly alleged satisfaction of the causation requirement in the policy's computer fraud coverage, finding that TCP alleged that “TCP's employees transferred [the Loss] to the Hacker as a direct result of the Hacker's access to TCP and Universal's emails, the forged letter, and altered Vendor Setup Form.” These allegations, the court said, did “not lack plausibility.” It added that questions as to the cause of the loss should be left for summary judgment, or a jury.

The court concluded that Great American's contention that the Hacker's activities “were not the cause of the actual funds transfers” was “premature” at the motion to dismiss stage.

The case is Children's Place, Inc. v. Great American Ins. Co., No. 18-11963 (ES) (JAD) (D.N.J. April 25, 2019). Attorneys involved include: For THE CHILDREN'S PLACE, INC., Plaintiff: JOSHUA SETH PASTER, HUNTON & WILLIAMS LLP, NEW YORK, NY. For GREAT AMERICAN INSURANCE COMPANY, Defendant: EZRA H. ALTER, LEAD ATTORNEY, ECKERT SEAMANS CHERIN & MELLOTT, NEWARK, NJ.

Steven A. Meyerowitz, a Harvard Law School graduate, is the founder and president of Meyerowitz Communications Inc., a law firm marketing communications consulting company. Mr. Meyerowitz is the Director of the Insurance Coverage Law Center and editor-in-chief of journals on insurance law, banking law, bankruptcy law, energy law, government contracting law, and privacy and cybersecurity law, among other subjects. He may be contacted at [email protected].