Victimized by ransomware, law firm sues insurer for $700K in lost billings
Imilian/Shutterstock.com
A Rhode Island law firm has filed a lawsuit against its insurer over coverage for a ransomware attack that locked down the firm’s computer files for three months.
Moses Afonso Ryan, a 10-lawyer law firm in Providence, says it paid $25,000 in ransom, but the amount is far less than its lost billings, the Providence Journal reports. A review of records for the same three months last year shows the firm had more than $700,000 in billings during the time period, according to the suit.
The suit (PDF) was originally filed in state court and removed to federal court. It claims that Sentinel Insurance Co. is responsible for the loss under policy coverage for lost income.
Moses Afonso Ryan’s computers became infected with the ransomware virus last year as a result of a lawyer clicking on an email attachment, the suit says. The virus disabled the firm’s computer network, along with all of the documents and information on the network. As a result, lawyers and staffers “were rendered essentially unproductive,” according to the suit.
Computer experts hired by Moses Afonso Ryan could not unlock the network. The firm began to search for the perpetrators and made contact in June 2016. The firm could not immediately pay ransom, however, because payment was to be made in bitcoins, and new account holders can purchase only two bitcoins per day.
After payment, the initial decryption tools did not work. The law firm contacted the perpetrators again and arranged for additional ransom. When new encryption tools were supplied, the law firm was able to recover the majority of encrypted information. Documents stored on a temporary server had to be created again.
In its answer (PDF) to the complaint, Sentinel denies an unjustified refusal to provide coverage under the law firm’s business owner’s policy. The policy form “speaks for itself,” the answer says.
Sentinel says it has paid the law firm the policy maximum of $20,000 for losses caused by computer viruses, which are covered under a computers and media endorsement.
The insurer says it has no legal obligation to cover other ransomware losses. The policy coverage for lost business income applies only when there is physical loss or damage to property at the business premises, according to Sentinel.
See also: Moses Afonso Ryan’s lawsuit against its insurer, Sentinel Insurance Co. (PDF)
See also: Response from Sentinel Insurance Co. (PDF)
