Source: http://mendes.com/news/cyber-risks-evolving-threats-emerging
Timestamp: 2019-04-21 04:21:04+00:00

Document:
In the enclosed article, we discuss matters involving policyholders seeking coverage under commercial crime types of policies, following social engineering scams (so-called “phishing” or “spoofing”). The matters involved rulings that, on the surface, appeared to produce divergent results, and both rulings were the subjects of appeals. See Cyber Risks 745-751 (citing Medidata Sols., Inc. v. Fed. Ins. Co., 268 F. Supp. 3d 471 (S.D.N.Y.) and Am. Tooling Ctr., Inc. v. Travelers Cas. & Sur. Co. of Am., No. 16-12108, 2017 WL 3263356 (E.D. Mich. Aug. 1, 2017)). Recently, the Second Circuit affirmed the district court’s ruling in favor of coverage in one matter and the Sixth Circuit reversed the lower court’s ruling in favor of the Insurer in the other. See Medidata Solutions Inc. v. Federal Insurance Co., Case No.17-2492 (2nd Cir. 2018) and American Tooling Center, Inc v. Travelers Casualty and Surety Company of America, Case No. 17-2014 (6th Cir. 2018). The American Tooling court found that, in fact, the Insured suffered a “direct loss” “when it transferred…approximately $834,000 to [an] impersonator,” stating there was “no intervening event.” The Insurer has requested that the full Sixth Circuit review the three-panel decision. See Appellee Travelers Casualty and Surety Company of America’s Petition for Rehearing or Rehearing En Banc, Case No. 17-2014 (6th Cir. Jul 27, 2018).
In connection with our discussion of the American Tooling case, we note another case in which the Court discussed whether a fraud was accomplished through “use of a computer,” and whether the loss “resulted directly” from such use. (See Cyber Risks at 750, fn. 141, InComm Holdings, Inc. v. Great Am. Ins. Co., 1:15-cv-2671-WSD, 2017 WL 1021749 (N.D. Ga.)). The Eleventh Circuit Court of Appeals agreed with the lower court that where fraudsters manipulated a glitch in a computerized interactive-telephone system to redeem duplicative “chits,” such loss was not covered under a “Computer Fraud” policy. See, Interactive Commc’ns Int’l, Inc. v. Great Am. Ins. Co., No. 17-11712, 2018 WL 2149769 (11th Cir. May 10, 2018). However, in an unpublished opinion, the Appellate Court disagreed that the fraud was not perpetrated through the “use” of a computer system, noting that the fraudsters interfaced directly with the computer system to effectuate their duplicate redemptions. The Appellate Court ultimately agreed that the loss did not “result directly” from the initial computer fraud (there was a chain of causation that involved intervening acts and actors).
In a related discussion of what is a loss “directly” from fraudulent computer use, we note the case of Aqua Star (USA) Corp. v. Travelers Cas. & Sur. Co. of Am., No. C14-1368, 2016 WL 3655265 (see, Cyber Risks at 750-751, fn. 143). In a short not-for-publication ruling, the Ninth Circuit affirmed the lower court ruling. The Court found that an exclusion “unambiguously provid[ed] that the policy ‘will not apply to loss or damages resulting directly or indirectly from the input of Electronic Data by a natural person,” noting that the losses were the result of employees who were authorized to enter the Insured’s system, who then changed wiring instructions, which resulted in wire transfers fraudulently induced by the schemers. See Aqua Star (USA) Corp. v. Travelers Cas. & Sur. Co. of Am., Case No. 16-35614 (9th Cir. Apr. 17, 2018).
View the PDF for the full article.

References: v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v. 
 v.