Please ensure Javascript is enabled for purposes of website accessibility
Home / Opinion Digests / Company did not have common law duty to protect customers from hacking

Company did not have common law duty to protect customers from hacking

Where defendants claimed that a hack of a third party’s email communication caused them to misdirect funds to the hacker instead of the plaintiff, the defendants could not assert a claim for equitable indemnification and contribution against the third-party because Virginia has not yet recognized a common law duty to safeguard the private information of others.

Background

This action stems from a real estate transaction in which an unidentified, non-party hacker allegedly caused funds to be misdirected to the hacker and away from the proper party, plaintiff Deutsche Bank National Trust Co. Deutsche Bank had hired defendants Craig Buck and The Buck Law Firm PC to perform the closing and had hired third-party defendant Altisource Portfolio Solutions LLC to act on its behalf in effectuating the real estate transaction and facilitating the sale and closing.

Buck and the law firm claim that the hacker obtained access to confidential email communications containing the financial information of Altisource’s customers, including Deutsche Bank, prior to the closing. Through this breach, the hacker learned of the upcoming wire transfer between the real estate buyer and Deutsche Bank and then used this information to provide fraudulent wiring instructions to Buck and the law firm. When Buck and the law firm received the transfer money, they followed these instructions and wired the money to a bank account that is presumed to belong to the hacker. At the time, Buck and the law firm thought they were wiring the money to a Deutsche Bank account.

Buck and the law firm also claim that Altisource failed to promptly notify or warn them about the hacking. Specifically, although Buck and the law firm transferred the money on March 18, 2018, three days after the closing, Altisource did not inquire about the transfer until the latter part of April 2016. Buck and the law firm claim this delay made it impossible to track the misdirected funds.

Altisource now moves to dismiss the third-party complaint asserted against it by Buck and the law firm.

Analysis

Relying exclusively on the allegations in the third-party complaint, the court is unable to identify the source of any duty Altisource may have owed to Deutsche Bank. Indeed, the third-party complaint does not mention any purported contract between Altisource and Deutsche Bank, and, in reply to the motion to dismiss, Buck and the law firm deny that such a contract existed. Under these circumstances, the third-party complaint cannot be dismissed based on the ground that a contract precludes the third-party plaintiffs’ claims of negligence.

In response to the motion to dismiss, Buck and the law firm improperly attempt to provide new factual allegations and raise new legal theories in support of the third-party complaint. Specifically, Buck and the law firm identify federal and state statutes and federal regulations that they claim support a finding that Altisource owed a legal duty to Deutsche Bank. Because this information was not included in the third-party complaint, however, it cannot be considered now.

In order for Buck and the law firm to pursue claims of equitable indemnification and contribution, they must first establish that Altisource owed a legal duty to Deutsche Bank. Only if that demonstration is made will the court be able to hold Altisource derivatively liable for any liability Buck and the law firm may incur from Deutsche Bank’s complaint.

While the third-party complaint alleges that Altisource owed a common law duty to safeguard the private information of its customers, like Deutsche Bank, the case law on this developing area of law is sparse and conflicting. As such, Buck and the law firm are unable to establish that Altisource owed Deutsche a legal duty under this theory.

Nevertheless, given the additional factual allegations and legal theories contained in response to the motion to dismiss may establish the existence of such a legal duty, Buck and the law firm are granted leave to amend their complaint

Motion granted.

Deutsche Bank National Trust Co. v. Buck, Case No. 3:17-cv-833, March 29, 2019. EDVA at Richmond (Lauck). VLW 019-3-146. 15 pp.

VLW 019-3-146