FKB’s Rachel Aghassi and Asher Kest obtained a rare pre-answer dismissal of a cyber-security breach complaint seeking contribution, indemnity, and legal malpractice subrogation against attorneys who allegedly wired funds to an incorrect bank account as the result of a cyber-scam. The decision was recently upheld on a motion to reargue.
As part of a property sale, the seller’s attorney’s email account was breached, and incorrect wiring instructions were circulated from a false but similar email address. The FKB’s client, the buyer’s attorney, allegedly acted on those instructions, and wired the balance for the sale to the cyber scammer’s account. The buyer tendered a claim to their title insurer, which was denied, and sued the title insurer. The insurer initiated a third-party action against FKB’s client for contribution, indemnity, negligence, and under subrogation for legal malpractice.
On January 5, 2022, Justice Maria S. Vazquez-Doles, of the New York Supreme Court, Orange County, granted FKB’s motion to dismiss under CPLR 3211(a)(1) and (7) in its entirety and denied the title insurers cross-motion to amend the complaint to add a legal malpractice claim. The Court adopted FKB’s argument that the insurer could not seek contribution against the buyer’s attorneys since the buyer’s damages primarily sought performance under the insurance policy, and contribution is not available for breach of contract. Further, the Court held that pure economic loss from a breach of contract cannot create a claim for contribution against a third-party defendant, and that the damages sought by the first-party Plaintiff against ORN were monetary damages concerning the policy, regardless of the cyber security breach and fraudulent wire.
On a very complex point, the Court agreed with FKB’s argument that even though there were other tort claims for negligence and professional malpractice aside from breach of contract, they were essentially duplicative because those claims still sought the same mode and measure of damages. The decision notes that a contribution concerning breach of contract cannot subvert CPLR § 1401 by attempting to convert it into another tort, particularly where, as here, there is no legal duty by the insureds concerning the claims that are independent of the contract.
Addressing the indemnification claim, the Court restated FBK’s argument that FKB’s client’s duty to the first-party Plaintiff was irrelevant, and there must be a separate duty owed to the third-party Plaintiff. Since Third-party plaintiff (through its agent) is alleged to have been negligent in failing to confirm receipt of the wire, FKB’s client’s wire based on the cyber hacker’s fraudulent instructions cannot be the subject of an indemnity claim.
Similarly, the Court denied the title insurer’s motion to amend the complaint to add a subrogation claim of legal malpractice, finding that such a claim is not viable, since the insurer lacked privity with the attorneys, and as above, the damages asserted duplicated those sought for performance of the policy.
On August 4, 2022, the Court denied the title insurer’s motion to reargue, agreeing with FKB’s argument that since the damages essentially sought performance under the breach of contract, there was no misapplication of law regarding dismissal of the contribution claim; even though the allegations were different, the damages were the same.
The Court also agreed that subrogation was not available to the title insurer due to the nature of the damages alleged by the Plaintiff, the buyer, for breach of contract.
This decision will provide a positive precedent for future cyber-related malpractice cases, and FKB is very pleased with the result.