Help

BI’s Article search uses Boolean search capabilities. If you are not familiar with these principles, here are some quick tips.

To search specifically for more than one word, put the search term in quotation marks. For example, “workers compensation”. This will limit your search to that combination of words.

To search for a combination of terms, use quotations and the & symbol. For example, “hurricane” & “loss”.

Login Register Subscribe

Illinois regulator seeks from insurers funds lost in phishing scheme

Reprints
phishing

The Illinois Insurance Department filed suit against units of Hartford Financial Services Group Inc. and Munich Re on Monday seeking recovery of $3.98 million stolen in a phishing scheme.

The case involves the Illinois department’s receivership of two auto insurance companies, commercial auto insurer Gateway Insurance Co., and personal auto insurer, Affirmative Insurance Co., which were placed into liquidation in June 2020 and March 2016, respectively, according to the complaint filed in U.S. District Court in Chicago in Office of the Special Deputy Receiver et al. v. Hartford Fire Insurance Co. and HSB Specialty Insurance Co.

According to the complaint, in June and July 2021 the email of the department’s Office of Deputy Specialty Receiver’s chief financial officer was breached, with new rules set up so that the hackers were able to circumvent the CFO and his email inbox and reply to any questions OSD staff had regarding monetary wire transfer interaction.

The scheme resulted in eight fraudulent wire transfers, totaling $6.85 million, of which OSD’s bank was able to recover about $2.87 million leaving an estimated $3.98 million in lost OSD custodial funds.

Hartford had issued a “financial institution bond for insurance companies” bond in May 2021 that provided computer systems fraud coverage with a $5 million single loss liability limit and a $50,000 single loss deductible, and “electronic mail initiated transfer fraud coverage” that provided a $250,000 single and aggregate loss liability limit and a $50,000 single loss deductible. The bond had an aggregate liability limit of $5 million. Hartford denied coverage under the bond.

HSB Specialty, a unit of Munich Re’s Hartford Steam Boiler Inspection and Insurance Co., issued a cyber policy in 2021 that provided, among other coverages, social engineering and computer fraud coverages, both of which had a $250,000 liability sublimit subject to a $50,000 retention. The policy had a $5 million aggregate limit.

HSB Specialty paid $250,000 under the social engineering coverage but denied the computer fraud coverage.

A Hartford Steam spokesman had no comment and Hartford did not respond to a request for comment.

A report issued in May said phishing attacks deployed for initial access into companies’ computer systems increased by more than half in the first quarter compared with last year’s fourth quarter.