Having failed to adequately secure cyber coverage, the insured law firm's lawsuit was properly dismissed by the trial court on summary judgment. Johnson v. Smith Bros. Ins., LLC, 2020 Vt. Unpub. LEXIS 98 (Vt. Sept. 4, 2020).
The law firm attended a CLE seminar presented by the Vermont Attorneys Title Insurance Corporation. Scott Garcia, an employee of Smith Brothers, an insurance agency, gave a presentation on professional liability insurance focusing on cybersecurity issues, including fraudulent scams. After the presentation, one of the law firms members spoke with Garcia and expressed an interest in securing a professional malpractice policy with cyber security coverage. Garcia said he would check the firm's current policy, but was confident he could provide better coverage. It was unclear whether the firm ever provided its current policy.
A couple of weeks later, the firm submitted an online application for professional liability coverage through the Smith Brothers' website. The application neither referenced the conversation with Garcia nor specifically requested cybersecurity coverage. Smith Brothers then sent the policy covering a one-year period. The policy included coverage for up to $10,000 for losses resulting from a network or security breach in the performance of professional services. A year later, the firm renewed the same policy.
Thereafter, the law firm conducted a residential real estate closing, representing the buyers. At the closing, the law firm provided the sellers with a $100,744 check for the net proceeds of the sale. That same day, the law firm received an email purportedly from the sellers' attorney stating that the sellers wanted the buyers to stop payment on the check and instead wire wire the money to a bank in Texas. The law firm did so, but learned a few days later that the firm was the victim of a wire fraud scam. The sellers had never asked that payment be stopped on the check nor that the funds be wired to a bank in Texas.
The law firm sought coverage under its policy. The claim was initially denied, but then the insurer paid $50,000 as part of a settlement of the sellers' lawsuit against the law firm.
The law firm sued Smith Brothers and Garcia for breach of contract and negligent misrepresentation. The trial court granted defendants summary judgment.
The Supreme Court affirmed. The negligent misrepresentation claim failed because no reasonable factfinder could conclude that the law firm reasonably relied on Garcia's representation at the CLE seminar to mean that the firm would be provided with some unidentified level of cybersecurity coverage in any policy that they applied for a month later on Smith Brothers' website without any request for such coverage.
As for their breach of contract claim, the law firm made no showing that a contract was formed between the parties at the CLE seminar. The casual conversation with Garcia, which was nothing more than a preliminary informational discussion, did not amount to a contract to procure insurance.
