Hacked Tech Company Not Entitled to Cyber Coverage for Debt Payment Wired by Client to Hackers' Bank Account

Alorica Inc., a technology services company, was the victim of an apparent phishing attack in October 2017. After gaining access to Alorica's email system, hackers created rules to prevent Alorica from seeing their communications and then emailed Alorica's clients, asking them to send funds due to Alorica to fraudulent bank accounts. One of those clients, Express Scripts, responded to the hackers' emails and wired more than $4.8 million to the hackers' bank account.

According to Alorica's complaint against its insurer, Express Scripts sent a letter to Alorica in September 2018, demanding that Alorica forgive or waive its $4.8 million debt on the ground that the breach of Alorica's computer system caused Express Scripts to issue the payment to the fraudulent account. Express Scripts further stated that it "will not be making additional payments for the amounts previously paid that have not been recovered."

Alorica sought coverage for the outstanding debt under its Security & Privacy Risk Response Policy. In the subsequent coverage litigation, a California federal district court granted summary judgment in favor of the insurer. On appeal, Alorica argued that the letter from Express Scripts constitutes a "claim" against Alorica under the policy. The Ninth Circuit disagreed, stating:

In relevant part, the policy defines a claim as a "written demand for monetary or non-monetary relief." Express Scripts' letter does not fall within that definition. The letter rejects Alorica's demand for $4.8 million. A refusal to accept a demand is not itself a demand; it is only a refusal. Express Scripts' letter does not ask Alorica to do anything at all. (emphasis in original)

The court noted that Alorica characterized Express Scripts' refusal to pay as a request that Alorica forgive a debt, arguing that the letter, therefore, constitutes a "demand for monetary relief." "But the letter could be characterized as a request to forgive a debt," according to the Ninth Circuit, "only if Express Scripts in fact owed a debt in the first place. Express Scripts denies that it owes Alorica $4.8 million, and indeed Alorica has made no further effort to collect this money."

The court further noted that, in the cases on which Alorica relied, a "demand" or "claim" arose when someone asked the insured party for money or to work for free. The court stated that "Alorica cites no case in which the refusal of another's demand, without more, has been held to constitute a demand." Consequently, the Ninth Circuit affirmed the district court's entry of summary judgment in favor of the insurer. Alorica, Inc. v. Starr Surplus Lines Ins. Co., No. 20-55458 (9th Cir., April 9, 2021).