Background
The Office of the Special Deputy Receiver contracted with Hartford Fire Insurance Company for fraud insurance. Hackers gained access to the Office’s Chief Financial Officer’s email account and used it to instruct employees to transfer funds, causing a loss of nearly four million dollars. The Office sued Hartford for breach of contract after the insurer refused to pay, arguing the loss was covered. The district court dismissed the claims, finding the contract unambiguously excluded coverage for this type of loss.
The court’s reasoning
The Seventh Circuit reviewed the dismissal de novo under Illinois law, which governs the insurance contract. The court analyzed Rider Seventeen of the policy, which provided coverage for electronic mail initiated transfer fraud but also contained an exclusion for losses resulting from fraudulent instructions sent via electronic mail. The court determined that the exclusion applied because the fraudulent emails were sent to the Office, satisfying the recipient requirement of the exclusion. The court rejected the Office’s argument that the exclusion should be limited to emails sent from outside the Office, noting that the contract text did not impose such a restriction. The court also found no ambiguity despite the exclusion potentially overlapping with other coverage provisions, as the exclusion did not render the other coverage illusory.
The exclusion applies. OSD’s arguments to the contrary aren’t persuasive.
What it means going forward
The ruling clarifies that insurance policies with email fraud exclusions will be enforced according to their plain text, even if the fraud involves internal communications or hackers impersonating employees, provided the instruction was sent to the insured entity.