(Article from Insurance Law Alert, September 2025)
For more information, please visit the Insurance Law Alert Resource Center.
Holding
A trial court did not err in considering an insured’s sworn statement in ruling that the insurer had no duty to defend, notwithstanding that the four corners of the complaint did not include any allegations that would have negated coverage. Certain Underwriters at Lloyd’s London v. Galey Consulting, LLC, 2025 Ill. App. Unpub. LEXIS 1286 (Ill. App. Ct. July 28, 2025).
Background
Galey Consulting and its principal Brian Galey were insured under a policy issued by the Underwriters. Brian Galey provided notice to an Underwriters claim manager of an incident that could give rise to a claim. Included with that notice was a sworn summary of the incident, which involved the hacking of Galey’s email and a wire transfer of funds to the fraudster’s account.
Thereafter, Galey was sued by another entity with whom it had contracted to manage certain construction payments, seeking reimbursement of the wired funds. The complaint in that action, which alleged claims of professional negligence, errors and omissions, breach of contract and breach of fiduciary duty, made no mention of any hacking, wire fraud or other cyber event. Nonetheless, in light of the details provided in Galey’s summary of events, the Underwriters denied coverage based on an exclusion for claims “arising directly or indirectly out of any cyber event.”
The Underwriters then sued Galey in Illinois state court, seeking a declaration of no coverage. The trial court granted the Underwriters’ summary judgment motion, ruling that they had no duty to defend the underlying suit. The appellate court affirmed.
Decision
The central issue in dispute was whether Galey’s summary of events could be considered in the court’s duty to defend analysis. The court held that it could, noting that while the general rule is that only the allegations within the four corners of the underlying complaint determine an insurer’s defense obligations, exceptions exist in which courts may consider extrinsic evidence.
In particular, the court held that in a declaratory judgment proceeding, an insurer may challenge its duty to defend with evidence that the insured’s conduct falls exclusively within a policy exclusion, provided that such evidence is not relevant to an outcome-determinative issue in the underlying lawsuit. The court rejected the assertion that extrinsic evidence can only be used to establish a duty to defend and not to deny a defense. The court refused to “wear judicial blinders” where, as here, there is no real factual dispute that the loss at issue originated from an incident of email hacking and wire fraud.
Comments
The decision also includes a noteworthy ruling on a commonly disputed issue in cyber coverage cases—the appropriate causation standard for determining whether losses “arise directly or indirectly out of” a cyber event. The court rejected the assertion that the cyber events exclusion did not bar coverage because the losses were concurrently caused by other events, such as the actions of the employees involved in effectuating the wire transfer and the company’s failure to implement sufficient cyber safety measures. The court explained that, based on Galey’s summary of events, the loss at issue unequivocally arose out of a cyber event, even if other potential causes could be identified.