{"id":4082,"date":"2026-04-03T20:03:01","date_gmt":"2026-04-03T20:03:01","guid":{"rendered":"https:\/\/www.insuracarelife.com\/blog\/a-matter-of-time-negligence-claim-for-cyber-fraud-falls-outside-consecutive-claims-made-cyber-policies-wiley-rein-llp\/"},"modified":"2026-04-03T20:03:01","modified_gmt":"2026-04-03T20:03:01","slug":"a-matter-of-time-negligence-claim-for-cyber-fraud-falls-outside-consecutive-claims-made-cyber-policies-wiley-rein-llp","status":"publish","type":"post","link":"https:\/\/www.insuracarelife.com\/blog\/a-matter-of-time-negligence-claim-for-cyber-fraud-falls-outside-consecutive-claims-made-cyber-policies-wiley-rein-llp\/","title":{"rendered":"A Matter of Time: Negligence Claim for Cyber Fraud Falls Outside Consecutive Claims-Made Cyber Policies | Wiley Rein LLP"},"content":{"rendered":"
\n

The United States District Court for the Southern District of Ohio, applying Ohio law, has held that a negligence claim arising from a cyber fraud incident was not first made or reported while the first policy was in effect, and that notice was outside the second policy\u2019s 30-day reporting window. Spinnaker Ins. Co. v. Heart of Gold Title, LLC,<\/em> 2026 WL 710135 (S.D. Ohio Mar. 13, 2026). The court also held that the second policy\u2019s prior knowledge exclusion precluded coverage because the title company was aware of the cyber incident prior to the policy\u2019s effective date.<\/p>\n

Between February and March 2024, two individuals wired funds pursuant to bogus wiring instructions sent by someone impersonating the insured title company. Shortly after the fraud was discovered, the title company\u2019s IT vendor reviewed the company\u2019s information systems and confirmed that they had not been infiltrated. In October 2024, the individuals filed a negligence action against the title company, alleging breach of duties by failing to maintain adequate cybersecurity protocols. The title company provided notice of the underlying lawsuit to its cyber insurer in November 2024.<\/p>\n

The title company had two consecutive cyber policies, effective from August 2023 to August 2024 and from August 2024 to August 2025, respectively. Both policies were claims-made-and-reported, and the declarations pages stated that each policy \u201capplies only to claims first made and reported to the insurer during the policy period or any applicable extended period.\u201d The insurer denied coverage.<\/p>\n

In the ensuing coverage litigation, the court held that no coverage was available under either policy. As to the 2023-2024 policy, there was no coverage because the underlying lawsuit was a \u201cClaim\u201d made and reported after the policy period ended. The insuring agreement of the 2023-2024 policy provides coverage for \u201cLoss\u201d and \u201cDefense Expenses\u201d resulting from a \u201cClaim that is Discovered during the Policy Period.\u201d The court found that the earliest plausible \u201cClaim\u201d was the underlying negligence action filed in October 2024, as the title company never received any prior written demand. The lawsuit was thus filed in October 2024 and reported in November 2024, after the policy expired in August 2024.<\/p>\n

As to the 2024-2025 policy, the court held that there was no coverage because the title company provided notice outside of the policy\u2019s 30-day post-discovery reporting period. The 2024-2025 policy\u2019s notice condition provided that, \u201cafter a situation that results in, or may result in, a Loss covered under this Policy is Discovered,\u201d the insured \u201cmust notify [the insurer] in writing as soon as practicable, but not to exceed thirty (30) days from the date Discovered[.]\u201d \u201cDiscovered\u201d was defined as the time when specified senior personnel \u201cfirst become[] aware of facts which would cause a reasonable person to believe that a Loss covered by this Policy has been or will be incurred,\u201d even if \u201cthe exact amount or details of Loss may not then be known.\u201d Given that the incident occurred between February and March 2024 and that the title company immediately undertook an IT review to assess infiltration, the court determined that \u201cDiscovery\u201d took place at least seven months before the title company gave notice in November 2024.<\/p>\n

The court also held that a prior knowledge exclusion barred coverage for any cyber incident or Wrongful Act of which the title company was aware prior to the policy\u2019s effective date in August 2024. Because the pleadings showed the title company\u2019s awareness in early 2024, the exclusion applied on the same facts that established the late notice defense.<\/p>\n

Finally, the court dismissed the title company\u2019s bad faith claim, concluding that the insurer had a reasonable basis to deny coverage based on the 2024-2025 policy\u2019s notice condition and prior knowledge exclusion.<\/p>\n

[View source.]<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

The United States District Court for the Southern District of Ohio, applying Ohio law, has held that a negligence claim arising from a cyber fraud incident was not first made or reported while the first policy was in effect, and that notice was outside the second policy\u2019s 30-day reporting window. Spinnaker Ins. Co. v. Heart […]<\/p>\n","protected":false},"author":1,"featured_media":4083,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[389,2852,2851,209,2850,234,2132,2048,2849,1561,2796,2086,2795],"class_list":["post-4082","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-claim","tag-claimsmade","tag-consecutive","tag-cyber","tag-falls","tag-fraud","tag-llp","tag-matter","tag-negligence","tag-policies","tag-rein","tag-time","tag-wiley"],"_links":{"self":[{"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/posts\/4082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/comments?post=4082"}],"version-history":[{"count":0,"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/posts\/4082\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/media\/4083"}],"wp:attachment":[{"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/media?parent=4082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/categories?post=4082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.insuracarelife.com\/blog\/wp-json\/wp\/v2\/tags?post=4082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}