$40M+ in Claims Denied or Disputed

Ransomware attack crippled 80% of Hamilton's network, impacting business licensing, property-tax processing, transit systems. Insurer denied the $18.3M claim — MFA was not fully implemented at time of breach. Taxpayers now on the hook for full $18.3M, of which $14M spent on external response experts.

ICS suffered ransomware attack. During investigation, Travelers discovered ICS stated on insurance application it used MFA for administrative access. In reality, ICS only used MFA for its firewall, not its servers — precisely where the breach originated. Court voided the entire $1M policy.

Over 30,000 patient medical records exposed publicly online. Insurer paid $4.125M settlement then sued to void the policy. Alleged Cottage Health misrepresented that it replaced factory default settings, maintained security patches, and exercised due diligence. Policy contained 'Minimum Required Practices' exclusion.

Landmark subrogation case. After paying $500K claim, insurer sued the cybersecurity vendors. Cloud provider allegedly failed to implement MFA. Trustwave misclassified a detected security event as 'moderate' instead of critical, delaying response by five days. Attackers encrypted systems before escalation.

Hackers sent spoofed emails impersonating SS&C client, tricking employees into wiring $5.9M. SS&C had failed to follow own internal policy requiring four-person authorization. AIG denied claim. Court ruled against AIG — but only because criminal act exclusion applied to insured's own acts, not third-party hackers.