Wesco Settles Coverage Dispute Over $36 Million IRA Financial Cyber Attack

Wesco Insurance, a part of AmTrust, has agreed to settle its dispute with a financial firm that lost millions in retirees’ money in a well publicized 2022 cyber attack.

The settlement notice, filed in federal court in Miami, did not specify the amount that Wesco had agreed to pay to IRA Financial Group for coverage of the data breach and legal defense costs. The amended complaint in the case, along with related lawsuits, allege that Miami-based IRA Financial lost $37 million in retiree funds that were held in crypto currency. IRA, which held a $5 million professional liability policy with Wesco, has been sued by retirees who had put their money into the firm’s individual retirement account products.

After the cyber attack, IRA Financial Trust sued its crypto currency and trading partner, Gemini, alleging that inadequate security measures allowed the cyber theft. News reports also have said that at the very moment that IRA was under cyber theft, its South Dakota office was “swatted” – someone claimed an armed robbery was under way, prompting police tactical units to swarm the building.

Wesco filed its action in U.S. District Court in South Florida in late 2022, asking the judge to declare that it had no duty to defend IRA in the class actions. IRA had purchased four policies, including a general liability policy from Travelers, a premier business owners policy from Allied Insurance Co., and an injured persons and company indemnification from Houston Specialty Insurance. Houston has agreed to provide a defense under a reservation of rights, IRA explained in court documents.

But Wesco has argued that its professional liability policy, effective from March 2021 to March 2022, excludes coverage for cyber incidents. Under a section of the exclusion titled, “Cyber Liability,” it reads: “The insurer shall not be liable to pay any loss in connection with any claim made against any insured arising from, based upon, or attributable to … theft, loss, disclosure, collection, storage, retention, inability to access, alteration or corruption of, or use or misuse of any protected information.”

The exclusion also refers to corruption of computer systems and theft of monies.

IRA’s team, in answer to the complaint, argued that the policy wording did not specifically mention cyber attacks or crypto currency and the policy speaks for itself. Besides, IRA said, Wesco did not come to the table in good faith.

“Wesco’s claims are barred in whole or in part by reason of Wesco’s unclean hands because Wesco … refused to defend or advance defense costs on the basis that it is excess to other insurance,” IRA argued.

Wesco also failed to defend under a reservation of rights prior to filing its court action, then filed confidential information “in an effort to harm IRA when it had no obligation to do so,” the filing reads.

After the case went to mediation, both sides agreed to a settlement. They plan to ask the court to dismiss Wesco’s demand for declaration.

IRA Financial was founded by Adam Bergman, a former tax attorney who worked at some of the largest law firms, according to the IRA website.

Topics Cyber Liability