UNITED STATES DISTRICT COURT AT SEATTLE CONNELLY LAW OFFICES, PLLC, CASE NO. 25-cv-00302-JHC
Plaintiff, ORDER v. COWBELL CYBER, INC., SPINNAKER INSURANCE COMPANY,
Defendants.
I INTRODUCTION This matter comes before the Court on Defendants’ motion to dismiss. Dkt. # 18. Plaintiff, Connelly Law Offices, PLLC, claims that Defendants, Cowbell Cyber Inc. (Cowbell) and Spinnaker Insurance Company (Spinnaker), breached their duty to indemnify under a Commercial Cyber Insurance Policy. Dkt. # 1. Plaintiff further claims common law bad faith, violation of the Washington Consumer Protection Act (CPA), and noncompliance with the Washington Insurance Fair Conduct Act (IFCA). Id. Defendants now seek partial dismissal under Federal Rule of Civil Procedure 12(b)(6). Dkt. # 18. For the reasons below, the Court GRANTS in part and DENIES in part the motion to dismiss. II A. Factual Background
This factual background is based on the allegations in the Complaint, which the Court accepts as true on a Rule 12(b)(6) motion to dismiss. Dkt. # 1. 1. The Cyber Attack Cary Woods II (Woods) is a personal injury attorney in Miami, Florida, and the owner of Cary Woods II, P.A d/b/a Law Offices of Cary Woods II (Woods Law) (collectively, the Woods Claimants). Dkt. # 1 at 3. Woods Law and Plaintiff worked together to litigate a case in Pierce County Superior Court on behalf of Darell and Tamicia McCutcheon, McCutcheon v. Town of Steilacoom, Case No. 23-2-04528-4 (McCutcheon). Id. In April 2024, this lawsuit resolved for $15,000,000. Id. These funds were then deposited into Plaintiff’s trust account for distribution.
Id. Under the fee agreement, the Woods Claimants were to receive $1,500,000 for attorney fees and $1,885.55 for costs—a total payment of $1,501,885.55. Id. Unbeknownst to Plaintiff, in June 2024, it suffered a security breach that allowed hackers to obtain unauthorized access to the security codes and passwords of its employees’ email accounts. Id. at 3. These hackers accessed financial information unavailable to the public, including undisclosed details about the McCutcheon settlement. Id. at 4. The hackers also used their access to create “rules” that diverted emails from Woods to Plaintiff’s employees about McCutcheon, and then they created a spoofed email account to impersonate Woods. Id. at 3–4. The hackers were thus able to intercept and delete emails sent by Woods to Plaintiff’s employees, and they were able to email Plaintiff’s employees impersonating Woods. Id.
Plaintiff acknowledges this occurred because of its own failure to prevent unauthorized access to the security codes and passwords of its employees’ email accounts. Id. Around the same time, one of Plaintiff’s employees—Micah LeBank—emailed Woods at cwoods@carywoodslaw.com and asked for tax information about his firm. Id. at 4. Later in June 2024, LeBank again emailed Woods and asked where he should mail his attorney fees from
the McCutcheon settlement. Id. The same day, LeBank received an email from cwoods@carywoodlaw.com (the hackers’ spoofed email account, which does not have an “s” in the domain name) that said, “I am in Europe for vacation, please will you be able wire the funds?” Id. LeBank did not notice this message came from a different email account and he responded, “Send us wiring instructions and we can set it up.” Id. The hackers then sent wiring instructions for a fraudulent CitiBank account to LeBank. Id. Over the following weeks, the hackers continued to intercept emails sent from Woods, delete them, and then resend them from the spoofed email account. Id. at 5. The hackers also used their access to send Woods messages from LeBank’s email account impersonating LeBank.
Id. In July 2024, Plaintiff’s office manager, Sarah Streck, emailed LeBank and asked for Woods’s phone number so that she could call him and telephonically confirm the wiring instructions. Id. The hackers intercepted this email too. Id. They then sent Streck a fake phone number, so that they could impersonate Woods. Id. Streck called this number and unwittingly “verified” the wiring instructions with the hackers. Id. Plaintiff then wired $1,501,885.55 to the fraudulent CitiBank account. Id. at 6. Around the same time, the hackers used their access to LeBank’s account to send Woods an email telling him that he would receive a check for his money once Streck returned from vacation. Id. Because of this misdirection, Plaintiff did not realize that it had been defrauded until nine days later. Id.
When the fraud was finally discovered, the Woods Claimants brought a claim against Plaintiff for the loss of the money wired to the fraudulent account. Id. The claim alleged that Plaintiff allowed the security breach to occur and that Plaintiff failed to prevent unauthorized access to the security codes and passwords of its employees’ email accounts. Id. The claim further alleged that Plaintiff’s failure to prevent this unauthorized access directly resulted in the
loss of the $1,501,855.55. Id. 2. The Policy At the time of the cyber-attack, Plaintiff was insured under a Commercial Cyber Insurance Policy, Prime Cyber Risk Insurance Policy No. FLY-CB-DU1RCVKXK-003 (the Policy). Dkt. # 1 at 2; see Dkt. # 1-1. Plaintiff purchased this insurance from Defendants to protect itself in the event of a cyber-attack or computer security breach. Dkt. # 1 at 3. The Policy provides coverage on a claims-made and reported basis and applies only to claims made and reported during the policy period. Id. During the policy period, Plaintiff tendered the claim from the Woods Claimants to
Defendants. Id. at 6. The Woods Claimants demanded that Defendants pay the Policy limit of $1,000,000 to settle this claim. Id. Defendants agreed to defend the claim under a reservation of rights. Id. Citibank was contemporaneously able to recover $379,592.52 lost in the fraud and returned this money to Plaintiff. Id. at 6. This reduced the total amount lost to $1,122,293.03. Id. Charles River Associates (CRA) also conducted a forensic computer analysis around this time and determined the credentials for LeBank’s email account were compromised. Id. at 6–7. CRA determined these credentials were used to set up unauthorized rules and send unauthorized emails from his account. Id. Plaintiff provided Defendants with the results of CRA’s analysis.
Id. at 7. Plaintiff likewise alleges that Defendants had the opportunity to fully explore the details of CRA’s investigation. Id. Although Defendants maintained that no coverage was available for the claim, Plaintiff nonetheless sought to settle with the Woods Claimants. Id. In November 2024, Plaintiff informed Defendants of its intention to settle. Id. Defendants responded and reiterated that they
denied any indemnity obligation. Id. But Defendants agreed that they would not raise lack of consent or that the payment constituted a voluntary payment so long as the settlement was for no more than $1,122,263.03 plus accrued interest. Id. Plaintiff then entered an “Agreement, Release, and Assignment of Claims with Cary Woods II and the Law Offices of Cary Woods, II” (Settlement Agreement) for $1,501,885.55. Id. at 7–8. The next month, Plaintiff informed Defendants that it intended to sue them for denying the claim and thereby violating IFCA. Id. at 8; see RCW 48.30.015(8). Defendants responded by once again denying the claim because there was no evidence that hackers gained access to LeBank’s email password. Dkt. # 1 at 8. In any event, Defendants did eventually pay $100,000
towards the claim under the Policy’s Social Engineering Endorsement. Id. at 9. B. Procedural History Plaintiff brings four causes of action against Defendants. Id. at 10–14. First, Plaintiff claims a breach of the duty to indemnify as required by the terms and conditions of the Policy. Id. at 10. Second, Plaintiff claims Defendants have engaged in common law bad faith for their failure to appropriately investigate and handle the claim. Id. at 10–12. Third, Plaintiff says Defendants’ unfair and deceptive acts have violated the CPA. Id. at 13. Fourth, Plaintiff asserts that Defendants have violated IFCA because they have refused to provide the benefits owed to Plaintiff under the Policy. Id. at 14. Plaintiff seeks damages, attorney fees and costs, and all other just and proper relief. Id. at 15.
Pursuant to Rule 12(b)(6), Defendants move to dismiss Plaintiff’s first cause of action; Defendants also seek dismissal of the first, third, and fourth causes of action against Defendant Cowbell. Dkt. # 18. Defendants argue that they have paid the full Social Engineering Sublimit of $100,000, defended Plaintiff against the claim brought by the Woods Claimants, and helped Plaintiff to recover $379,592.52 from Citibank. Id. Because there is about a $1,000,000
shortfall between the amount paid in the Settlement Agreement and the amount it wired to the fraudulent bank account, according to Defendants, Plaintiff now seeks to manufacture coverage that is not owed under the Policy. Id. III A. Motion to Dismiss Standards “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Upon
such a motion, a court accepts all factual allegations in the complaint as true and construes them in the light most favorable to the nonmoving party. Chubb Custom Ins. Co. v. Space Sys./Loral, Inc., 710 F.3d 946, 956 (9th Cir. 2013). But a “court need not . . . accept as true allegations that contradict matters properly subject to judicial notice or by exhibit. Nor is the court required to accept as true allegations that are merely conclusory, unwarranted deductions of fact, or unreasonable inferences.” In re Gilead Scis. Sec. Litig., 536 F.3d 1049, 1055 (9th Cir. 2008). (quoting Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001)). // // //
// // B. Duty to Indemnify In Washington, insurance policies are construed as contracts and the language of a policy is interpreted as a matter of law.1 Findlay v. United Pac. Ins. Co., 129 Wash.2d 368, 378, 917 P.2d 116 (1996); Expedia, Inc. v. Steadfast Ins. Co., 180 Wash. 2d 793, 802, 329 P.3d 59 (2014). The policy must be construed as a whole and given a “fair, reasonable, and sensible construction as would be given to the contract by the average person purchasing insurance.” Am. Nat. Fire Ins. Co. v. B & L Trucking & Const. Co., 134 Wash. 2d 413, 427, 951 P.2d 250 (1998) (internal citation omitted). If the language of the policy is unambiguous, “the court must enforce it as written and may not modify it or create ambiguity where none exists.” Id. (internal citation omitted). But “[u]nresolved ambiguities are resolved against the drafter-insurer and in favor of the insured. Queen City Farms, Inc. v. Cent. Nat. Ins. Co. of Omaha, 126 Wash. 2d 50, 68, 882 P.2d 703 (1994) (internal citation omitted). “A clause is ambiguous when, on its face, it is fairly
susceptible to two different interpretations, both of which are reasonable.” Am. Nat. Fire Ins. Co., 134 Wash. 2d at 428 (internal citation omitted). 1. Language of the Policy The language of an insurance policy should be construed according to its ordinary meaning. Queen City Farms, 126 Wash. 2d at 81. If the policy defines a term, “then the term will be interpreted in accordance with that policy definition.” Black v. Nat’l Merit Ins. Co., 154 Wash. App. 674, 679, 226 P.3d 175 (2010). If the policy does not define a term, then it must be given its “plain, ordinary, and popular meaning.” Id. at 680 (internal citation omitted). Courts
1 The parties do not dispute that Washington substantive law applies to this matter. Dkt. ## 18, 21, and 24; see Cuprite Mine Partners LLC v. Anderson, 809 F.3d 548, 554 (9th Cir. 2015) (“[F]ederal courts sitting in diversity apply state substantive law.”). look to the dictionary to determine the common meaning of an undefined term. Id. (internal citation omitted). The parties’ primary dispute centers on whether the settlement between the Woods
Claimants and Plaintiff is covered under the Policy’s Security Breach Liability insuring provision. Defendants offer two grounds for denying coverage under this provision. First, they assert that the funds at issue were owed under the fee agreement in McCutcheon, and a preexisting contractual obligation cannot be considered a Loss as a result of a Claim for a Wrongful Act. Dkt. # 18 at 15–17. Second, they say that the “Claim must be for a Wrongful Act,” and that this denotes a strict causal connection between the Claim and the Wrongful Act. Id. at 17–20. Defendants say Plaintiff cannot show the requisite causal nexus. Id. Plaintiff responds that the settlement falls within the plain language of the Policy and argues that coverage for liability caused by a third-party’s criminal conduct is not extinguished by the mere
existence of a contract. Dkt. # 21 at 14–20. Plaintiff also disputes that it has not adequately alleged the requisite causal nexus between the Claim and the Wrongful Act. Id. at 20–21. It says there “is a clear nexus between the security breach and the loss of funds” because “[w]ithout the security breach[,] the cyber criminals would never have learned about the settlement and funds transfer and the funds would not have been stolen.” Id. at 21. In the Court’s view, the language of the Security Breach Liability insuring provision is, at best for Defendants, ambiguous and thus must be construed in Plaintiff’s favor. This provision covers, in pertinent part, “Loss . . . as a result of a Claim . . . for a Wrongful Act[.]” Dkt. # 1-1 at 9. And the Policy provides the following definitions for these terms: • Loss: “Compensatory damages, settlement amounts and costs awarded pursuant to
judgments or settlements[.]” • Claim: “A written demand for monetary or nonmonetary damages, including but not limited to injunctive relief[.]” • Wrongful Act: “[A]ny actual or alleged: a. Security Breach; b. Failure to prevent
unauthorized access to, or use of, electronic or non-electronic data containing Personal Information.” Dkt. # 1-1 at 9–14. According to these definitions, the $1,501,885.55 Plaintiff tendered to the Woods Claimants as part of their Settlement Agreement qualifies as a Loss because Plaintiff alleges this money is a “settlement amount[] . . . awarded pursuant to . . . settlement[.]” Dkt. # 1 at 6–7; Dkt. # 1-1 at 9. Plaintiff further alleges it entered the Settlement Agreement with the Woods Claimants as a result of the claim they brought against it. Dkt. # 1 at 6–8. This claim was for the security breach that “directly resulted in the loss of $1,501,885.55.” Id. at 6. This claim also meets the definition of a Claim under the Policy because it was a “written demand for
monetary . . . damages[.]” Id.; Dkt. # 1-1 at 10. Finally, for the purposes of the instant motion only, Defendants do not deny that Plaintiff’s failure to prevent the unauthorized acquisition of its employee’s email password and surreptitious access to his email account is a Wrongful Act. Dkt. # 24 at 7 n.1. The ambiguity in this provision, if any, arises from the word “for,” as it is used in the clause “Claim . . . for a Wrongful Act.” Dkt. # 1-1 at 9 (italics emphasis added). This word is not defined in the Policy, so the Court looks to a dictionary to determine its “plain, ordinary, and popular” meaning. Black, 154 Wash. App. at 680. One definition of “for” is “a function word to indicate the object or recipient of a[n] . . . activity.” Merriam-Webster’s Dictionary (11th ed. 2025), https://www.merriam-webster.com/dictionary/for. Under this definition, although it
seems to be a stretch, it could be understood that Plaintiff’s Claim is not for a Wrongful Act. That is, Plaintiff does not allege the Woods Claimants issued a written demand for money damages simply because Plaintiff failed to prevent hackers from accessing its employees’ email accounts—there were the intervening acts of the hackers in the causal chain. See generally Dkt. # 1. The Woods Claimants filed suit because hackers obtained access to the employees’ email
accounts, spoofed messages between Woods and Plaintiff, impersonated Woods over the telephone, and only then diverted the funds intended to satisfy the fee agreement into a fraudulent CitiBank account. Id. at 4–6. In Defendants’ view, this means the Wrongful Act does not form the basis of the relief sought and there is too remote a connection between the Claim and Wrongful Act to qualify for coverage under the Security Breach Liability insuring provision. Dkt. # 18 at 17–18. Regardless of whether the foregoing rises to the level of a reasonable interpretation, there is another definition of “for,” which the Court deems reasonable here: “because of.” Merriam- Webster’s Dictionary (11th ed. 2025), https://www.merriam-webster.com/dictionary/for.2 And Plaintiff does allege that because of its failure to prevent hackers from accessing one of its employee’s email accounts, the Woods Claimants issued a written demand for money damages. Dkt. # 1 at 6. Said differently, Plaintiff alleges its failure to prevent unauthorized access to an employee’s email account directly resulted in the loss of the money Plaintiff intended to pay the Woods Claimants under the fee agreement and the subsequent written demand for money damage. Id. This interpretation of the Security Breach Liability insuring provision is reasonable because it employs a common meaning of “for,” as found in the dictionary. Assuming the Security Breach Liability insuring provision is ambiguous, it must be construed in favor of Plaintiff. Queen City Farms, 126 Wash. 2d at 68.
2 Defendants look to the American Heritage Dictionary to define “for” as, “used to indicate the object or purpose of an action or activity,” Dkt. # 18 at 17; this source also defines “for” as, “[a]s a result of; because of.” American Heritage Dictionary (5th ed. 2022), https://ahdictionary.com/word/search.html?q=for. Defendants raise two arguments that urge the Court to reach a different interpretation of this provision. First, they say that an agreement compelling an insured to pay money it was already required to pay under a contract cannot be considered a Loss as a result of a Claim for a
Wrongful Act. Dkt. # 18 at 15. Second, they say that the term “for” denotes a strict causal connection in the context of insurance grants. Id. at 18. This Order next considers these arguments. a. Loss as a result of a Claim for a Wrongful Act Defendants say Sauter v. Houston Cas. Co. controls the outcome here because it establishes that an agreement compelling an insured to pay money it was already obligated to pay under a contract cannot be a Loss as a result of a Claim for a Wrongful Act.3 168 Wn. App. 348, 349, 276 P.3d 358 (2012); Dkt. # 18 at 15. In Sauter, S-J Management, LLC (SJM) entered a business loan agreement with The Commerce Bank of Washington, N.A. (Commerce Bank) and Commerce Bank extended SJM a $3.5 million line of credit. Id. at 350. Michael Sauter, SJM’s CEO and manager, signed the loan agreement and promissory note in his official capacity on behalf of SJM. Id. To comply with the loan agreement, Sauter then guaranteed payment of SJM’s indebtedness to Commerce Bank (the guaranty), and he secured the guaranty with deeds of trust on real property owned by him and his wife. Id. SJM thereafter failed to pay its indebtedness to Commerce Bank, and the bank sought payment in full on the guaranty, a sum greater than $2.8 million. Id. When Sauter demanded indemnification from SJM for the amount he owed Commerce Bank, SJM could not indemnify Sauter for the same reason it could not repay its loan—it was insolvent. Id. at 351. Commerce Bank sent multiple notices of default to
3 Defendants cite several other cases to support a similar argument, but these cases are of little persuasive value because none apply Washington law, and, as noted above, it is undisputed that Washington law controls the interpretation of the Security Breach Liability insuring provision. See Dkt. # 18 at 16-18. Sauter and informed him that failure to cure the default on the guaranty could result in the sale of his real properties. Id. Counsel for SJM provided the demand on the guaranty from Commerce Bank, Sauter’s indemnification letter to SJM, and the notices of default on Sauter’s properties to
Houston Casualty Company (Houston Casualty). Id. But Houston Casualty informed SJM that coverage was unavailable under the directors’ and officers’ (D & O) liability policy that insured SJM’s members and officers because no act by Sauter was a Wrongful Act and because Sauter did not suffer a Loss. Id. at 353. Among other arguments, Sauter contended that the obligation to Commerce Bank pursuant to the guaranty was a Loss that the Houston Casualty policy provided coverage for. Id. at 359. Conversely, Houston Casualty urged the court to conclude that the repayment of a loan is not a Loss and, more generally, that liability insurance does not insure against this sort of obligation. Id. As the court acknowledged, “Washington courts have not previously addressed
whether a voluntary contractual obligation, such as an obligation to repay a loan, constitutes a ‘Loss’ that may be insured against,” but elected not to reach this issue. Id. at 360. Instead, the court said that it “need not look beyond the explicit language of the Houston Casualty policy in order to determine that Sauter’s purported ‘Loss’ [was] not covered by that policy, regardless of whether his obligations pursuant to the guaranty constitute[d] a ‘Loss’ as defined therein.” Id. This was because the policy provided it would only cover “Loss resulting from any Claim . . . for a Wrongful Act,” so coverage was only available for Sauter’s guaranty obligation if that obligation resulted from Commerce Bank’s demand for payment on the guaranty. Id. But Sauter’s obligation to Commerce Bank did not result from the bank’s demand on the guaranty, his obligation resulted from the guaranty itself. Id. at 361. The court thus concluded the
guaranty was not a Loss resulting from any Claim for a Wrongful Act and this obligation was not covered under the policy. Id. The allegations here are markedly different. Plaintiff does not allege it was unable or unwilling to pay the money it owed the Woods Claimants under the fee agreement in McCutcheon, and Plaintiff does not seek coverage under the Security Breach Liability agreement
for this monetary obligation. But Plaintiff does allege that it negligently allowed hackers to access an employee’s email account, the hackers intercepted and spoofed emails between Woods and Plaintiff, and then the hackers convinced Plaintiff’s office manager to wire the money intended to satisfy the fee agreement to the wrong bank account. Dkt. # 1 at 3–6. Plaintiff further claims that it settled with the Woods Claimants for $1,501,855.55 after Woods and Woods Law sued Plaintiff and alleged Plaintiff’s failure to prevent unauthorized access to its employee’s email account directly resulted in the loss of this money. Id. at 6–7. So, unlike Sauter, Plaintiff does not allege that it seeks coverage for money owed under a contractual obligation (the fee agreement in McCutcheon). Rather, Plaintiff claims it seeks coverage for the
settlement entered with the Woods Claimants after the money intended to satisfy their fee agreement was wired to the wrong bank account. Id. at 9. Plaintiff also says it entered this settlement because it failed to prevent the unauthorized access of an employee’s email account that directly resulted in the loss of this money. Id. Of course, the dollar value Plaintiff owed under the fee agreement and the money it seeks coverage for are the same because it intended to satisfy the fee agreement at the time the money was stolen. Id. at 6. But unlike Sauter, Plaintiff does not allege its duty to pay the Woods Claimants arises from a preexisting contractual obligation. To the contrary, Plaintiff seeks coverage for the security breach that caused funds to be transferred to the wrong bank account and the subsequent settlement between Plaintiff and the Woods Claimants for failing to prevent this security breach. Id. at 8–9.
The Court can also conclude Sauter does not control the outcome here because the Sauter court confined its analysis to the Houston Casualty insurance policy at issue there. Sauter, 168 Wash. App. at 360 (“we need not look beyond the explicit language of the Houston Casualty policy in order to determine that Sauter’s purported ‘Loss’ is not covered by that policy”). Also, the Sauter court decided not to set forth a broader rule that, generally, liability insurance does not
insure against money owed under a preexisting contractual obligation. Id. at 359. (“Houston Casualty urges us to determine that the repayment of a loan does not constitute a ‘Loss’ and that more generally, liability insurance is not intended to insure against such an obligation. Here, however, the policy language itself resolves the issue of coverage[.]”). b. Strict Causal Connection Defendants also say, “Courts have uniformly determined that ‘for’ denotes a narrow causal connection” in the context of insurance grants. Dkt. # 18 at 18. But they cite no Washington authority for this proposition.4 Id. What is more, the Washington Supreme Court has instructed that “[i]f the portion of the policy being considered is an inclusionary clause in the insurance policy, the ambiguity should be liberally construed to provide coverage whenever possible.” Ross v. State Farm Mut. Auto. Ins. Co., 132 Wash. 2d 507, 515–16, 940 P.2d 252 (1997) (emphasis removed); see Diaz v. Kubler Corp., 785 F.3d 1326, 1329 (9th Cir. 2015) (federal courts are bound to follow the decision of the state’s highest court when interpreting state law) (internal citation omitted). An inclusionary clause defines those to whom coverage is extended. See State Farm Mut. Auto. Ins. Co. v. Ruiz, 134 Wash. 2d 713, 718, 952 P.2d 157 (1998). The Security Breach Liability insuring provision is an inclusionary clause because it defines those to whom coverage is provided. Dkt. # 1-1 at 6. To be sure, as acknowledged
4 Defendant does cite Washington authority for the proposition that “arising out of” would not tether the Claim to the Wrongful Act. Dkt. # 24 at 8. But this argument misses the mark because the Policy does not use the words “arising out of”—it uses the word “for.” Dkt. # 1-1 at 9. above, this provision might be interpreted to denote a narrow causal connection between the Claim and the Wrongful Act. Dkt. # 18 at 18–20; see Section III.B.1, supra. But this provision can also be reasonably interpreted to denote a broader, “because of,” connection between the
Claim and the Wrongful Act. See Section III.B.1., supra. Because the Security Breach Liability insuring provision is an inclusionary clause, it must be construed liberally to provide coverage— i.e., with the “because of” connection between the Claim and the Wrongful Act. Ross, 132 Wash. 2d at 515–16. In addition, another defined Policy term belies Defendants’ proposed construction. The Security Breach liability insuring grant applies to “a Claim . . . for a Wrongful Act or a series of Interrelated Wrongful Acts.” Dkt. # 1-1 at 9. “Interrelated Wrongful Acts” are defined as “all Wrongful Acts that have as a common nexus any: i) fact, circumstance, situation, event, transaction or cause; or ii) a series of casually [sic] connected facts, circumstances, situations,
events, transactions or causes.” Id. at 12. So, along with covering “a Claim . . . for a Wrongful Act,” the Security Breach liability insuring grant covers a Claim for any number of Wrongful Acts that are appropriately connected to one another. Id. at 9. This expansive language suggests the parties contemplated and accepted that the Security Breach liability insuring grant should apply to a broad set of circumstances that ultimately lead to a Claim. Yet Defendants’ proposed definition of “for” is “used to indicate the object or purpose of an action or activity.” Dkt. # 18 at 17. This proposed definition would only provide coverage if a Claim were for a singular “action” or “activity,” and would render the defined term “Interrelated Wrongful Acts” superfluous to the Security Breach Liability insuring provision. Dkt. # 1-1 at 12. Thus, this interpretation would conflict with the maxim that the preferred interpretation of a contract, such
as an insurance policy, gives effective meaning to all provisions of the agreement and does not render any part meaningless. See Pub. Util. Dist. No. 1 of Lewis Cnty. v. Washington Pub. Power Supply Sys., 104 Wash. 2d 353, 374, 705 P.2d 1195 (1985) (internal citation omitted). 2. Policy as a Whole
Next, the Court considers whether its interpretation of the Security Breach Liability insuring provision gives the whole Policy a “fair, reasonable, and sensible construction as would be given to the contract by the average person purchasing insurance.” Key Tronic Corp. v. Aetna (CIGNA) Fire Underwriters Ins. Co., 124 Wash. 2d 618, 627, 881 P.2d 201 (1994) (internal citation omitted). Defendants argue that the foregoing interpretation of the Security Breach Liability insuring provision does not give the whole Policy a fair, reasonable, and sensible construction for two reasons. Dkt. # 18 at 20–24. First, they say that the parties contracted for a Social Engineering Endorsement in the Policy, and Plaintiff’s claim falls squarely within the Social
Engineering Endorsement. Id. at 20–22. They say that allowing Plaintiff to recover under the Security Breach Liability insuring provision when it should only be allowed to recover under the Social Engineering Endorsement would render the Social Engineering Endorsement superfluous. Id. Defendants add that the Policy makes clear they need not pay under any other insuring grant if a claim falls within and exhausts the Social Engineering sublimit. Dkt. # 24 at 11. Second, they say, reading the Policy as a whole, the Security Breach Liability insuring provision is intended to cover third-party claims by data-breach victims. Id. at 23–24. Plaintiff responds by saying Defendants are attempting to rewrite the Policy. Dkt. # 21 at 21. According to Plaintiff, when a loss is covered by more than one part of an insurance policy, the insured is entitled to the full coverage available under each part—unless the policy has language to the contrary. Dkt. #
21 at 21–23. Plaintiff also says the Washington Supreme Court has held that an insured can proceed under multiple grants of coverage and the insured is not required to choose a single coverage provision to bring a claim under. Id. at 23–24. a. Social Engineering Endorsement
As Defendants recognize, the first issue to be resolved is not whether one incident can implicate two insuring grants in the Policy or whether Washington requires an insured to choose a single coverage to bring a claim under. Dkt. # 24 at 9–10. The Policy recognizes that a single incident can fall within two insuring grants. Dkt. # 1-1 at 6. And the Washington Supreme Court has found “no authority for the proposition that an insured must elect which coverage it chooses if it has been furnished with overlapping coverage in a policy.” Kitsap Cnty. v. Allstate Ins. Co., 136 Wash. 2d 567, 581, 964 P.2d 1173 (1998). To resolve Defendants’ first argument, the Court must instead determine whether its interpretation of the Security Breach Liability insuring provision renders the Policy’s Social Engineering Endorsement superfluous. The Court
must also evaluate whether Plaintiff’s claim falls within the Social Engineering Endorsement and, if necessary, whether it exhausts the Social Engineering sublimit. The Social Engineering Endorsement covers “Social Engineering Loss resulting directly from a Social Engineering Incident[.]” Dkt. 1-1 at 33. The Policy defines Social Engineering Loss as “the loss of Money as a result of a Social Engineering Incident.” Id. at 34. Money in this context means “currency, coins or bank notes in current use and having a face value, travelers’ checks, register checks and money orders held for sale to the public. The term Money does not include digital currency or other negotiable and nonnegotiable instruments or contracts representing either Money or property.” Id. at 33. A Social Engineering Incident is defined as: the intentional misleading of an Insured to transfer Money to a person, place or account beyond the Named Insured’s control resulting directly from the Named Insured’s employee’s good faith reliance upon an instruction transmitted via email, purporting to be from: i. a natural person or entity who exchanges, or is under contract to exchange, goods or services with the Named Insured for a fee (other than a financial institution, asset manager, broker-dealer, armored motor vehicle “named insured” or any similar entity); or ii. an employee of the Named Insured; but which contained a fraudulent and material misrepresentation and was sent by an imposter. Id. at 33. To be eligible for the Social Engineering Endorsement, the Policy also requires the insured to “have an established and documented funds transfer request verification procedure and that procedure must have been followed before acting upon any instruction.” Id. at 34. This language from the Social Engineering Endorsement can be easily harmonized with the Court’s interpretation of the Security Breach Liability insuring provision. This is because the Court’s interpretation of the Security Breach Liability insuring provision still requires a Claim to be brought against the insured because of a Wrongful Act. See Section III.B.1, supra. But the Social Engineering Endorsement does not require a Wrongful Act to take place—it requires a Social Engineering Incident to occur—before coverage can be provided. Dkt. # 1-1 at 33–34. The Court similarly notes that a Wrongful Act occurs if there is “a privacy breach that includes the acquisition of Personal Information held within a Computer System” or “unauthorized access to, or use of, electronic or non-electronic data containing Personal Information,” while a Social Engineering incident can occur without bad actors acquiring or obtaining access to Personal Information. Dkt. # 1-1 at 13–14, 33. Thus, if a Social Engineering Incident takes place but a Wrongful Act does not, coverage may be provided under the Social Engineering Endorsement but not under the Security Breach Liability insuring provision. On the other hand, if there is a Wrongful Act but no Social Engineering Incident, coverage may be provided under the Security Breach Liability insuring provision but not under the Social Engineering Endorsement. That being so, an incident can implicate the Social Engineering Endorsement without falling under the Security Breach Liability insuring provision. Consider a scenario in which a cyber criminal impersonated one of Plaintiff’s employees and urgently demanded via email that another employee send U.S. currency to a fraudulent bank account. If the duped employee followed Plaintiff’s established
and documented funds transfer request verification procedure before sending the money, then coverage would likely be available under the Social Engineering Endorsement because a Social Engineering Incident occurred. But coverage would not likely be available under the relevant provisions of the Security Breach Liability insuring provision because the fraudster did not acquire or access Personal Information, so no Wrongful Act took place. It follows that the Court’s interpretation of the Security Breach Liability insuring provision does not render the Social Engineering Endorsement superfluous. What is more, the language of the Social Engineering Endorsement contradicts Defendants’ assertion that the “social engineering attack on [Plaintiff] fits squarely within
section i.” Dkt. # 18 at 22. This is because Plaintiff alleges in part that it seeks coverage for the Settlement Agreement it entered with the Woods Claimants. Dkt. # 1 at 10. And settlement agreements are contracts. See, e.g., Hamblin v. Castillo Garcia, 9 Wash. App. 2d 78, 91, 441 P.3d 1283 (2019) (“Settlement agreements are contracts.”). So the Settlement Agreement is not considered Money under the Social Engineering Endorsement. Dkt. # 1-1 at 33 (“The term Money does not include . . . contracts representing either Money or property.”). Because Plaintiff does not seek coverage for the loss of Money, Plaintiff’s claim cannot be considered a Social Engineering Loss. Thus, it is apparent from the Complaint that the Social Engineering Endorsement does not cover Plaintiff’s claim because Plaintiff does not seek to recover for what can be considered a Social Engineering Loss.
In sum, the Court’s interpretation of the Security Breach Liability insuring provision does not render the Social Engineering Endorsement superfluous because this interpretation gives meaning and effect to both parts of the Policy. And since Plaintiff’s claim does not fall within the Social Engineering Endorsement, it is not relevant whether “the Social Engineering Endorsement excludes coverage under other insuring grants for a Loss subject to the Social
Engineering sublimit.” Dkt. # 24 at 10–11. b. Data-Breach Victims Defendants next argue that “reading the Policy as a whole demonstrates that the Security Breach Liability insuring agreement covers third-party claims by data-breach victims.” Dkt. # 18 at 23. Defendants contend that the Security Breach Liability and Expense insuring agreements are complementary. Id. And they contend that when these complementary grants are read together, the applicable definitions of Wrongful Act in the Security Breach Liability provision apply “to third-party claims filed by individuals who have suffered injury because [Plaintiff] failed to prevent their Personal Information from being acquired.” Id. Defendants
also say that Woods Law could not sue Plaintiff for a violation of any privacy law because it does not have Personal Information that could be accessed, and Woods Law would not have standing to sue Plaintiff because its employee’s email account was accessed. Id. at 24. Thus, they contend, it would be unreasonable to construe the Security Breach Liability insuring provision to afford coverage for a claim that is not legally cognizable under privacy laws. Id. Plaintiff responds that Defendants are attempting to re-write the Policy, and that there is no language limiting the Security Breach Liability insuring provision to third-party claims brought by data-breach victims. Dkt. # 21 at 24. The Court agrees with Plaintiff. Attorney argument cannot replace the plain language of the Policy when that language is unambiguous. See Am. Nat. Fire Ins. Co., 134 Wash. 2d at 427.
The Security Breach Liability and Expense insuring agreements, as Defendants acknowledge, define Loss to cover significantly different expenses. Dkt. # 1-1 at 6–7, 9–10; Dkt. # 18 at 23. These provisions also do not reference one another. Dkt. # 1-1 at 6–10. And an Insured can recover under neither, one, or both agreements. Dkt. # 1-1 at 6; see Dkt. # 24 at 9–11. So the Court cannot agree they “are complementary.” Dkt. # 18 at 23.
Moreover, the applicable definitions of Wrongful Act in the Security Breach Liability insuring provision indicate broader coverage than just third-party claims by data-breach victims because Plaintiff failed to prevent the theft of their Personal Information. The Policy defines a Wrongful Act as “any actual or alleged: a. Security Breach; b. Failure to prevent unauthorized access to, or use of, electronic or non-electronic data containing Personal Information; . . . by, or asserted against, an Insured.” Dkt. # 1-1 at 14 (italics emphasis added). Security Breach means “a privacy breach that includes the acquisition of Personal Information[.]” Id. at 13 (italics emphasis added). The choice of the words “containing” and “that includes” in these definitions illustrates that a Wrongful Act is not limited to the theft of a third-party’s Personal
Information. Id. at 13, 14. Rather, these definitions show an event qualifies as a Wrongful Act under broader circumstances, so long as Personal Information is among the data acquired or accessed. Defendants similarly misconstrue the Complaint and Settlement Agreement to argue “Woods Law could not sue [Plaintiff] for a violation of any privacy law given that it, as a company, does not have Personal Information that could be accessed.” Dkt. # 18 at 24. In the Complaint, Plaintiff says, “Cary Woods II is a personal injury attorney in Miami Florida and is the owner of Cary Woods II, P.A d/b/a Law Offices of Cary Woods II.” Dkt. # 1 at 3. Plaintiff also says it “entered into an Agreement, Release, and Assignment of Claims with Cary Woods II and the Law Offices of Cary Woods, II.” Id. at 7. And the Settlement Agreement provides
“Cary Woods II and Cary Woods II, P.A. d/b/a the Law Offices of Cary Woods II has asserted a Claim against Connelly Law Offices for the Loss of $1,501,885.55 as a result of the Cyber Incident, Security Breach, and Wire Fraud” and “Cary Woods II and Cary Woods II, P.A. d/b/a the Law Office of Cary Woods II alleges that Connelly Law Offices engaged in a Wrongful Act whereby it allowed a Security Breach to occur and failed to prevent unauthorized access to, and
use of Personal Information including security codes and passwords.” Dkt. # 1-2 at 4. Consequently, Plaintiff does not merely allege it was sued by Woods Law; it alleges that Cary Woods—a person with Personal Information—also brought a claim. Plaintiff likewise alleges it entered the Settlement Agreement with Woods. So the Court’s construction of the Security Breach Liability insuring provision does not afford coverage for third-party claims that are not legally cognizable under privacy law. Contra Dkt. # 18 at 24. In short, the Court’s interpretation of the Security Breach Liability insuring provision gives the whole Policy a fair, reasonable, and sensible construction because it does not render any portion of the Policy superfluous and is consistent with the plain language of the Policy.
*** To sum up, the “duty to indemnify exists only if the policy actually covers the insured’s liability.” Am. Best Food, Inc. v. Alea London, Ltd., 168 Wash. 2d 398, 404, 229 P.3d 693 (2010). Plaintiff plausibly claims the Policy covers its liability under the Security Breach Liability insuring provision. Dkt. # 1 at 2–9; see Section III.B, supra. But Defendants have refused to indemnify Plaintiff for its claim under this provision of the Policy. Id. at 6, 9. Thus, Plaintiff adequately states a claim for a breach of the duty to indemnify against Defendants. C. Causes of Action Against Defendant Cowbell Cyber, Inc. Finally, Defendants ask the Court to dismiss Plaintiff’s first, third, and fourth causes of action against Defendant Cowbell because it is an insurance administrator, not an insurer. Dkt. #
18 at 24–25. Plaintiff’s first cause of action for breach of the duty to indemnify must be dismissed with respect to Defendant Cowbell because this Defendant is not listed on the Policy. See Woo v. Fireman’s Fund Ins. Co., 161 Wash. 2d 43, 53, 164 P.3d 454 (2007) (duty to indemnify
“hinges on the insured’s actual liability to the claimant and actual coverage under the policy”) (internal citation omitted). In fact, the words “Cowbell Cyber Inc.” do not appear in the Policy. See generally Dkt. # 1-1. Plaintiff’s argument that the Policy’s declarations page lists Cowbell as the “Producer” is incorrect. Id. The declarations page lists Cowbell Insurance Agency LLC—not Cowbell Cyber Inc.—as the producer. Dkt. # 1-1 at 3. Plaintiff’s third and fourth causes of action for violation of the Washington Consumer Protection Act (CPA) and Insurance Fair Conduct Act (IFCA) against Cowbell must likewise be dismissed. Plaintiff alleges that Defendants “violated multiple provisions of WAC 284-30-330” and these “are per se violations” of the CPA. Dkt. # 1 at 13. But WAC 284-30-330 applies only
to insurers because “that regulation defines only unfair acts or practices of the insurer.” Keodalah v. Allstate Ins. Co., 194 Wash. 2d 339, 350, 449 P.3d 1040 (2019). Similarly, “IFCA claims require that the insurer’s unreasonable act or acts result in the unreasonable denial of the insured's claim, and any IFCA damages must be caused by that denial.” Beasley v. GEICO Gen. Ins. Co., 23 Wash. App. 2d 641, 667, 517 P.3d 500 (2022) (emphasis added). Thus, as alleged, Cowbell can be liable under Plaintiff’s third and fourth causes of action only if it is an insurer. But Plaintiff does not plausibly allege that Cowbell is an insurer. Under Washington law, an insurer is “every person engaged in the business of making contracts of insurance, other than a fraternal benefit society.” See RCW 48.01.050. That Cowbell sells insurance, it performed the coverage evaluations, and denied coverage for Plaintiff’s claim does not show Cowbell is an
insurer. Contra Dkt. # 21 at 25. These functions say nothing about whether Cowbell is in the business of making contracts of insurance. In fact, these arguments suggest that rather than l being an insurer, Cowbell is an “Adjuster” or “Insurance producer.” See RCW 48.17.010 (an “Adjuster” is “any person who either investigates and negotiates settlement relative to insurance claims, or applies the factual circumstances of an insurance claim to the insurance policy provisions, or both”); id. (an “Insurance producer” is “a person required to be licensed under the laws of this state to sell, solicit, or negotiate insurance”). Consequently, Plaintiff's first, third, and fourth causes of action must be dismissed against Defendant Cowbell. IV
For all these reasons, the Court GRANTS in part and DENIES in part the motion to
dismiss. Dkt. # 18. Plaintiff's first, third, and fourth causes of action against Defendant Cowbell
D are dismissed without prejudice. Plaintiff does not alternatively request that the Court grant
leave to amend the complaint; nor do the parties address whether such an amendment would be
futile. Plaintiff may timely move for leave to file an amended complaint
Dated this 7th day of August, 2025.
C fake Chur John H. Chun United States District Judge