Court sides with insurer in phishing attack case

Because RealPage never held the funds at issue, National Union was within its rights to deny coverage of the stolen funds intended for RealPage’s property manager clients. . . And because National Union’s coverage was not exhausted, Beazley was also within its right to deny coverage under RealPage’s excess policy.” (Credit: Supermicro/Shutterstock)

The 5th U.S. Circuit Court of Appeals in New Orleans has affirmed a lower court’s decision in finding that a commercial crime insurer was right in denying coverage in a multimillion-dollar loss in a phishing incident was proper because the insured never “held” the funds intended for its clients, nor did it control the funds designated for them.

This case resulted from a successful phishing expedition. In 2018, a RealPage, Inc. employee accidentally clicked on a fake link in a seemingly innocuous email, and provided login information for RealPage’s account with a third-party processing site called Stripe, Inc. Phishers stole the login credentials. The phishers then used the credentials to divert millions of dollars in rent payments from tenants intended for RealPage’s property manager clients.