The Illinois Appellate Court held that a “cyber event” exclusion in an E&O policy precluded coverage for a claim where the insured, a construction project manager, forwarded fraudulent wire instructions to his client after the insured’s email system was hacked and compromised by a fraudster. The client had wired over $673,384.17 in funds to the fraudster pursuant to the fraudulent instructions received from the insured.  

The claimant initially submitted a demand letter to the insured in relation to the wire fraud loss, which the insured forwarded to the defendant insurer for defense and indemnity. Several months prior to the demand letter, the insured submitted a notice of circumstances to the insurer wherein the insured admitted that his email system had been hacked. The demand letter omitted that the insured had been hacked and simply claimed general breaches of duty by the insured without any further explanation. In response to the demand letter, BatesCarey issued a denial on the insurer’s behalf and filed a declaratory judgment action in the Chancery Division to preclude any future waiver and estoppel arguments on indemnity.

After the mediation proved unsuccessful, the claimant filed an underlying lawsuit against the insured. The claimant did not allege in his complaint that the insured had been hacked, or even that a wire fraud had occurred at all. Instead, the claimant alleged the insured had breached its duties to the claimant as a construction project manager by not instituting an adequate payment processing system to correctly pay vendors.

BatesCarey then amended the already-pending declaratory judgment action to address the suit. The insured and the claimant entered into a consent judgment for $725,000, and the claimant continued to pursue coverage subject to an assignment from the insured. After the parties filed cross-motions for summary judgment, the court granted the insurer’s motion. The court agreed with the insurer’s argument that the Circuit Court could consider the insured’s statements—specifically his notice that his email had been hacked—as extrinsic evidence to the claimant’s complaint to justify applying the exclusion. The court also rejected the claimant’s argument that the concurrent causation doctrine should apply and preclude the application of the cyber event exclusion, given what the claimant asserted were allegations unrelated to the hacking incident. 

On appeal, the Illinois Appellate Court, First District, affirmed the victory, holding that the insurer was allowed to consider the earlier notice of circumstances submitted by the insured as extrinsic evidence. The court further agreed that the claimant’s lawsuit amounted to a transparent attempt to plead into coverage, as it was filed six months after the insurer filed its declaratory judgment action, and well after the claimant became aware of the insurer’s position on coverage.

The court also rejected the claimant’s concurrent causation argument and held that coverage was precluded where the hack was the event from which all other causes that may have contributed to the loss flowed.

While the court only issued a Rule 23 Order, the decision provides useful analysis on when extrinsic evidence is appropriate in an Illinois coverage dispute and on concurrent causation issues when a claimant tries to plead around the application of an otherwise broad exclusion.