In an unusual turn of events, a recent court decision sided with the policyholder, despite specific policy language that probably should have favored the insurer.
The case of Ernst & Haas Mgt. Co. v. Hiscox, Inc isn’t entirely unique. The simple version of the case is an employee at Ernst & Haas gets a BEC phishing email impersonating a superior and the employee wires $200K to a cybercriminal-controlled bank account. Ernst & Haas submit a claim against their cyberinsurance with insurer Hiscox that is denied. And so we find the two in court.
What makes this an interesting case is cyberinsurers are *very* specific about policy verbiage to define what is and isn’t covered. In this case, the two coverage parts in question were:
(1) the Computer Fraud coverage, which covers losses “resulting directly from the use of any computer to fraudulently cause a transfer of that property”; and (2) Funds Transfer Fraud coverage, which covers loss “resulting directly from a [Fraudulent Instruction] to transfer, pay or deliver money” from the policyholder’s bank. Fraudulent Instruction was defined as an “instruction initially received by [the policyholder] which purports to have been transmitted by an Employee but which was in fact fraudulently transmitted by someone else without ... the Employee’s knowledge or consent.”
The court sided with Ernst & Haas, despite the specifics of the attack not meeting either clause: The attack wasn’t Computer Fraud (as defined above), as it was a social engineering attack with the employee using the company computer. And it doesn’t appear to be Funds Transfer Fraud (again, as defined above), as the fraudulent instruction wasn’t initially sent to the policyholder.
The takeaway from this case is that insurers don’t always win. However, organizations shouldn’t count on this; it’s one of the reasons such specificity is used when defining the circumstances in which a policy claim will be paid. It’s a far better position to simply put procedures in place that require validating wire transfer requests using a separate medium, as well as have employees with access to perform transfers enroll in Security Awareness Training to maintain a sense of vigilance when interacting daily with such requests.
