Ride the Lightning

Federal Court Rules Law Firm Not Entitled to Indemnification from Breached Third Party

April 8, 2019

Bloomberg Law reported on April 1st that a Virginia federal court has ruled that a real estate law firm was not entitled to get a mortgage solution services company to indemnify it for money owed to Deutsche Bank after a successful hacking attack disrupted a real estate deal.

The Buck Law Firm brought a third-party complaint against Altisource Portfolio Solutions Inc. to pay it money owed to Deutsche Bank that was routed to a cybercriminal’s bank account after a hack.

Virginia law doesn’t allow companies to bring negligence claims against organizations that are hit with a data breach based on “a duty to safeguard the private information of another individual,” the U.S. District Court for the Eastern District of Virginia ruled March 29th wen it dismissed the complaint.

The decision rests on a developing area of law: “whether or how to impose liability on a party whose potentially negligent conduct flows from a data breach,” according to the opinion. Courts have come down on both sides of the issues, giving companies little clarity on who is liable for negligence post-breach.

Because the real estate firm, the Buck Law Firm, failed “to establish a legal duty Altisource owed to Deutsche under Virginia law, the Court must dismiss both claims,” Judge M. Hannah Lauck wrote.

The court will allow the Buck Law Firm to file an amended complaint to find alternative theories to bring its third-party indemnification claims, Lauck wrote.

The case stems from a real estate deal where a hacker caused funds to be redirected to the cybercriminal. Deutsche Bank had contracted with the Buck Law Firm to close the real estate transaction and used Altisource to help facilitate closing the deal. The Buck Law Firm alleged that the hacker obtained access to confidential emails that contained the financial information of Altisource’s customers, like Deutsche Bank, according to the opinion. Due to the breach, the hacker used fraudulent wiring instructions to send the real estate funds to the wrong bank account. The Buck Law Firm thought it was sending the money to Deutsche Bank.

Deutsche Bank sued the Buck Law Firm claiming breach of contract and negligence. In turn, the Buck Law Firm filed a third-party complaint against Altisource to recover any money owed to Deutsche as a result of the lawsuit.

The Buck Law Firm alleged that Altisource should have known about the hack and failed to warn its customers.

The case is Deutsche Bank Nat’l Tr. Co. v. Buck, 2019 BL 112430, E.D. Va., 3:17cv833, 3/29/19.

Hat tip to Dave Ries.

E-mail:    Phone: 703-359-0700
Digital Forensics/Information Security/Information Technology
https://www.senseient.com
https://twitter.com/sharonnelsonesq
https://www.linkedin.com/in/sharondnelson
https://amazon.com/author/sharonnelson