Medidata Sols. Inc. v. Fed. Ins. Co. - 729 F. App'x 117 (2d Cir. 2018)

Rule:

As with any contract, unambiguous provisions of an insurance contract must be given their plain and ordinary meaning.

Facts:

Plaintiff Medidata Solutions, Inc. brought suit, claiming that its losses from an email "spoofing" attack were covered by, inter alia, a computer fraud provision in its insurance policy with defendant Federal Insurance Company. The provision covered losses stemming from any "entry of Data into" or "change to Data elements or program logic of" a computer system. The district court granted summary judgment to plaintiff, and awarded it $5,841,787.37 in damages and interest. On appeal, defendant argued that the spoofing attack was not covered by the policy, because the policy instead applied to only hacking-type intrusions. 

Issue:

Were the plaintiff’s losses from an email “spoofing” attack covered by a computer fraud provision in its insurance policy with defendant, thereby entitling it to recover under the policy? 

Answer:

Yes.

Conclusion:

The court held that the plain and unambiguous language of the policy's computer fraud provision covered the losses incurred by the insured since the e-mail attack represented a fraudulent entry of data into the computer system as it made a change to a data element so that the e-mail system's appearance was altered by the spoofing code to misleadingly indicate the sender and thus, the fraud compromised the insured's e-mail system. In addition, the insured sustained a direct loss as a result of the fraud because the fraud clearly implicated and compromised the computer system and it was the proximate cause of the insured's losses. The decision was affirmed.