(Article from Insurance Law Alert, April 2026)
For more information, please visit the Insurance Law Alert Resource Center.
Holding
A Mississippi federal district court ruled that a law firm was not entitled to coverage under its cyber insurance policy’s Social Engineering endorsement for losses resulting from a fraudulent inducement to transfer funds. Gore, Kilpatrick & Dambrino, PLLC v. Spinnaker Ins. Co., 2026 U.S. Dist. LEXIS 69567 (N.D. Miss. Mar. 31, 2026).
Background
Gore, Kilpatrick & Dambrino PLLC (“Gore”), a law firm, secured cyber insurance coverage from Spinnaker Insurance Company (“Spinnaker”), which included an endorsement for coverage for Social Engineering Incidents. This endorsement provides coverage for instances where an insured is misled into transferring funds due to fraudulent misrepresentations. A Social Engineering Incident is defined in relevant part as:
[T]he intentional misleading of an Insured to transfer Money to a person, place or account . . . resulting directly from . . . good faith reliance on an instruction . . . purporting to be from . . . a natural person or entity who exchanges, or is under contract to exchange, goods or services with the Named Insured for a fee . . . but which contained a fraudulent and material misrepresentation and was sent by an imposter.
In May 2024, an imposter posing as David Casteel, a supposed representative of Brooks Machinery, contacted the firm. The imposter claimed to be seeking to recover a debt from Mid-Delta Equipment. The imposter engaged the firm with a signed letter of engagement and fee agreement. In June 2024, the firm received a check from Mid-Delta Equipment for $158,850 to settle the debt. Following the imposter’s instructions, the firm deducted their fee of $425 and wired the remaining balance to the imposter. The check later bounced.
After Spinnaker denied Gore’s insurance claim, the firm filed suit against Spinnaker and two others asserting breach of contract, bad faith, and various other causes of action.
Decision
The court ruled in favor of Spinnaker, granting its motion to dismiss. The court determined that the breach of contract claim failed because the real David Casteel was not, in fact, a client of Gore’s, and had never contracted with the firm. Under the plain language of the policy, the Social Engineering endorsement required that the imposter purport to be a person or entity with whom Gore had an existing contractual relationship for goods or services. Since the real Casteel had never been a client of the firm, the court determined that coverage did not apply. The court also dismissed the bad faith claim, as it was contingent on the breach of contract claim.
Comments
This case highlights the potential limitations of cyber coverage under Social Engineering endorsements, reinforcing that coverage is determined by the specific language and terms of the policy.