A US bank employee left her individual token in her computer and left the computer running at the end of a work day. Overnight two unauthorised wire transfers had been made to different banks in Poland and one of $485 000 could not be recovered.
The policy covered loss resulting from hacking but excluding loss ’caused by an employee’. Insurers rejected the claim because of the employee’s fault.
Under Minnesota US law when an excluded peril contributes to the loss, an insured may recover if the covered peril is the efficient and proximate cause of the loss. The court held that the efficient and proximate cause of the loss in the situation was the illegal transfer of money and not the employee’s violations of policies and procedures.
The illegal wire transfer was not a foreseeable and natural consequence of the bank employee’s failure to follow proper computer security protocols. Even if the employee’s negligent actions played an essential role in the loss and those actions created a risk of intrusion into the computer system of a malicious and larcenous virus, the intrusion and ensuing loss of bank funds was not certain or inevitable. The overriding cause was the criminal activity and judgment was granted against the insurer in State of Bellingham v Red Rock Insurance Co, in the U.S. Court of Appeals for the Eighth Circuit.
Similar principles would be applied in South Africa.
