Pennsylvania Bank Can Pursue Insurer For Coverage of Reimbursed Breach Funds

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

Oct. 8 — A bank that refunded some $3.5 million to one of its clients after a hacker breached the client's servers and initiated unauthorized wire transfers can pursue a breach of contract claim against its insurer after the insurer denied coverage, a federal district court ruled Oct. 6.

Magistrate Judge Maureen P. Kelly of the U.S. District Court for the Western District of Pennsylvania said she “cannot agree with Defendant that Plaintiffs' payment to their client was voluntary under the terms of the Policy” because a Pennsylvania statute required the bank to refund the payment.

Accordingly, the court denied the defendant insurance company's motion to dismiss.

The ruling comes as companies are paying increased attention to mitigating cybersecurity risks through insurance coverage in the wake of several high-profile data breaches, including a large breach involving JPMorgan Chase & Co., the largest U.S. bank.

Unauthorized Wire Transfers

The plaintiffs, First Commonwealth Bank and its parent company, First Commonwealth Financial Corp., provide financial services to customers in western and central Pennsylvania. Using malware, an unknown third party was able to obtain the user name and password for the senior vice president of one of the bank's clients and initiate three unauthorized wire transfers, the court explained.

Although the bank recovered the amount of one of the wires, it was unable to recover the amounts of a $2.2 million wire to an account in Russia and a $1.4 million wire to an account in Belarus, the court said. After the client demanded that the bank refund or credit the funds, the bank refunded about $3.5 million to the client.

The bank sought to recover the funds under a liability policy with its insurer, St. Paul Mercury Insurance Co., but the company refused to provide coverage on the grounds that the bank refunded the funds without its consent.

The bank sued St. Paul for breach of contract, and St. Paul moved to dismiss the complaint.

Voluntary Payment?

The insurance policy at issue provides that St. Paul “shall not be liable for any settlement, Defense Costs, assumed obligation, admitted liability, voluntary payment, or confessed or agreed Damages or judgment to which it has not consented.”

However, the bank alleged that it was required by law to issue the refund to its client under 13 Pa. Cons. Stat. Ann. § 4A204(a), which requires a bank to refund a payment if it accepts a payment order that isn't authorized or enforceable.

“It is difficult for the Court to find that the mandate of 13 Pa. C.S.A. § 4A204(a) is not an outside influence that interfered with the restrictions imposed upon Plaintiffs under the Policy,” the court said, concluding that the statute weighed against the insurance company's argument that the bank's payment was voluntary.

In addition, the court said that none of the cases upon which the insurance company relied concerned a bank's legal obligation to issue a refund to a client following an unauthorized wire transfer or a similar situation.

Schnader Harrison Segal & Lewis LLP and Morgan, Lewis & Bockius LLP represented the plaintiffs. Stradley Ronon Stevens & Young LLP represented the defendant.

Full text of the court's opinion is available at


Request Bloomberg Law Privacy and Data Security