The Federal Reserve, however, did contact intermediary institutions to inform them that the transfers were fraudulent, and one of the intermediary institutions was able to reverse one of the transfers. The other fraudulent transfer was not recovered.

Bellingham notified BancInsure, Inc., which had issued a financial institution bond to the bank, of the loss and provided a copy of the transaction details of the two transfers. After an investigation, it was determined that a “Zeus Trojan horse” virus had infected the computer and had permitted access to the computer for the fraudulent transfers. After its investigation, BancInsure determined that the loss was not covered due to certain exclusions in the bond.

Specifically, BancInsure claimed the loss was not covered based on exclusions for employee-caused loss in Sections 2(h) and 2(bb)(17), for theft of confidential information in Section 2(bb)(4), and for mechanical breakdown or deterioration of a computer system in Section 2(bb)(12).

Bellingham sued, alleging that BancInsure had breached the contract when it denied coverage under the bond.

In response, BancInsure sought a declaratory judgment that it owed no duty under the bond to provide coverage.

The district court granted summary judgment to Bellingham on its breach of contract claim. The district court held “that the computer systems fraud was the efficient and proximate cause of [Bellingham's] loss,” and “neither the employees' violations of policies and practices (no matter how numerous), the taking of confidential passwords, nor the failure to update the computer's antivirus software was the efficient and proximate cause of [Bellingham's] loss.”

Further, the district court held that “it was not then a 'foreseeable and natural consequence' that a hacker would make a fraudulent wire transfer. Thus even if those circumstances 'played an essential role' in the loss, they were not 'independent and efficient causes' of the loss.”

The district court awarded Bellingham $620,187.36, which included prejudgment interest.

BancInsure appealed to the Eighth Circuit, challenging only the district court's grant of summary judgment on Bellingham's breach of contract claim.

The Bond

Under Insuring Agreement (H) of the bond, BancInsure agreed to indemnify Bellingham for:

Loss resulting directly from a fraudulent

(1) entry of Electronic Data or Computer Program into, or

(2) change of Electronic Data or Computer Program within

any Computer System operated by the Insured, whether owned or leased, or any Computer System identified in the application for this Bond, or a Computer System first used by the Insured during the Bond Period, provided the entry or change causes

(1) property to be transferred, paid or delivered,

(2) an account of the Insured or of its customer to be added, deleted, debited or credited, or

(3) an unauthorized account or fictitious account to be debited or credited.

In this Insuring Agreement (H), fraudulent entry or change shall include such entry or change made by an employee of the Insured acting in good faith

(1) on an instruction from a software contractor who has a written agreement with the Insured to design, implement or service programs for a Computer System covered by this Insuring Agreement (H), or

(2) on an instruction transmitted by Tested telex or similar means of Tested communication identified in the application for this Bond purportedly sent by a customer, financial institution, or automated clearing house.

The bond also provided:

This Bond does not cover

….

(h) loss caused by an Employee, except when covered under Insuring Agreement (a) or when covered under Insuring Agreement (B), (C), or (R) and resulting directly from misplacement, mysterious unexplainable disappearance or destruction of or damage to Property;

….

(bb) under Insuring Agreement[ ](H) …, in addition to all of the other Exclusions

….

(4) loss resulting directly or indirectly from theft of confidential information,

….

(12) loss resulting directly or indirectly from

(a) mechanical failure, faulty construction, error in design, latent defect, fire, wear or tear, gradual deterioration, electrical disturbance or electrical surge which affects a Computer System,

(b) failure or breakdown of electronic data processing media, or

(c) error or omission in programming or processing,

….

(17) loss caused by a director or Employee of the Insured or by a person in collusion with any director or Employee of the Insured … except when the loss is caused by an Employee and covered under Insuring Agreement (L) or (M)…. 

The circuit court affirmed.

In its decision, the circuit court first rejected BancInsure's argument that the concurrent-causation doctrine did not apply to financial institution bonds, reasoning that Minnesota generally treated financial institution bonds as insurance policies and stating that “[n]o Minnesota case preclude[d] application of the concurrent-causation doctrine to financial institution bonds.”

The Eighth Circuit also rejected BancInsure's argument that the bond imposed a “higher standard-of-proof than the concurrent-causation doctrine,” stating that Bellingham “still had to show that its loss was directly caused by the fraudulent transfer, and the application of the concurrent-causation doctrine did not interfere with that requirement.”

The circuit court next rejected BancInsure's argument that exclusions 2(bb)(4) and 2(bb)(12) contracted around the concurrent-causation doctrine because those exclusions also applied to “indirect” causation, ruling that the bond's reference to “indirectly” was not a sufficient invocation of the “anti-concurrent causation” provision, and concluding that the bond did not contain such a provision.

Finally, the circuit court rejected BancInsure's contention that even if the district court was correct to apply the concurrent-causation doctrine to the bond, it erred in concluding that the fraudulent hacking of the computer system by a criminal third party was the overriding, or efficient and proximate, cause of the loss instead of leaving that question to the jury. The Eighth Circuit agreed with the district court's conclusion that “the efficient and proximate cause” of the loss was the illegal transfer of the money and not the employees' violations of policies and procedures.

An “illegal wire transfer” was not a “foreseeable and natural consequence” of the bank employees' failure to follow proper computer security policies, procedures, and protocols, the circuit court declared. It added that, even if the employees' negligent actions “played an essential role” in the loss and those actions created a risk of intrusion into Bellingham's computer system by a malicious and larcenous virus, the intrusion and the ensuing loss of bank funds was not “certain” or “inevitable.” The Eighth Circuit concluded that the “overriding cause” of the loss Bellingham suffered remained the criminal activity of a third party, and Bellingham had properly been granted summary judgment in its favor.

The case is State Bank of Bellingham v. BancInsure, Inc., No. 14–3432 (8th Cir. May 20, 2016). Attorneys involved include: Joseph Arthur Nilan, argued, Minneapolis, MN, (Joseph Arthur Nilan, Mark J. Johnson, Thomas James Power, on the brief), for Defendant–Appellant; Jonathan Millea Bye, argued, Minneapolis, MN, (Jonathan Millea Bye, Bryan R. Freeman, on the brief), for Plaintiff–Appellee.