7th Circuit Sides with Insurer, Bars Coverage for Hackers’ Fraud

By Don R. Sampen, published, Chicago Daily Law Bulletin, August 18, 2026

The 7th U.S. Circuit Court of Appeals recently construed a policy providing coverage for losses due to email fraud. It found that an exclusion applied and denied coverage for a $4 million loss.

The case is Office of the Special Deputy Receiver v. Hartford Fire Insurance Co., No. 25-2309. The insured, OSD, was represented by Massey & Gail LLP of Chicago. Lavin Rindner Duffield LLC of Washington, D.C., and Hinkhouse Williams Walsh LLP of Chicago represented Hartford.

OSD is an Illinois nonprofit corporation that administers estates for insolvent or financially troubled insurance companies. It had coverage with Hartford under a policy titled “Financial Institution Bond for Insurance Companies,” referred to as the “Hartford Bond.”

Rider 13 to the Hartford Bond provided coverage generally for computer systems fraud. Rider 17 provided coverage specifically for loss resulting for OSD having transferred funds based on a fraudulent instruction sent electronically to OSD purportedly by an OSD customer or someone on behalf of the customer (when in fact the instruction did not originate with the customer).

Rider 17 also excluded coverage for losses due to transfers by OSD in reliance on any other “fraudulent instruction sent to OSD through electronic mail.”

While the Hartford Bond was in effect, fraudsters outside of OSD used a phishing scheme to gain access to the email account of OSD’s chief financial officer. Impersonating the CFO, the fraudsters sent emails to other OSD employees instructing them to transfer assets to the benefit of the fraudsters.

Over the course of a few weeks, OSD lost nearly $7 million, but was able to recover $3 million, for a net loss of about $4 million.

OSD filed claims under the Hartford Bond, but Hartford denied coverage based on the exclusion in Rider 17. OSD subsequently filed suit seeking coverage; Hartford moved to dismiss; and the district court granted the motion. OSD took this appeal.

Analysis

In an opinion by Judge Thomas L. Kirsch II, the 7th Circuit affirmed. He wrote that whether OSD’s claims fell within Rider 17’s exclusion turned on a simple question, namely, whether an email sent from a hacker posing as an OSD employee to another OSD employee was “a fraudulent instruction sent to OSD.”

OSD argued that an email sent within the OSD office — i.e., from the CFO’s office by a fraudster to another person within the office — was not such an email. But Kirsch disagreed, finding that just because the email both originated within the office and was received within the office, did not mean that OSD was not the recipient.

He further rejected the argument that the exclusion only applied to emails sent from outside the OSD office. He observed that the affirmative grant of coverage in Rider 17 included such a restriction on senders, in that it contemplated a fraudulent email that originated with a customer or someone acting on behalf of a customer. But the exclusion was not limited in this regard.

OSD finally argued that the loss was covered by the broad language of Rider 13, and the exclusion in Rider 17 should not apply to limit the scope of Rider 13.

Kirsch acknowledged that Rider 17’s exclusion created a conflict with the fraud coverage for computer systems under Rider 13. Nonetheless, no ambiguity arose because the exclusion did not nullify much of the positive coverage of Rider 13.

In sum, that rider continued to afford coverage to all instances of computer systems fraud that did not involve reliance on fraudulent instructions sent to OSD by email. Hence the exclusion did not render Rider 13 illusory.

Accordingly, the court affirmed the dismissal in favor of Hartford.

Key Point

An exclusion placed in one section of a policy may apply to limit coverage in other parts of the same policy so long as it does not fully eliminate a positive grant of coverage such as to render coverage illusory.