A Texas court has issued a split decision in a dispute between an American International Group (AIG) unit and RealPage Inc. over the allocation of a clawback provision, ruling that the property management software company is entitled to keep a portion of the money recovered after a phishing attack.

The phishing attack occurred in 2018, resulting in $10 million being stolen from RealPage. AM Best reports that the stolen money included $9 million in rent payments RealPage owed to its landlord clients and about $1 million in transaction fees owed to the company, according to court documents.

In response to the theft, RealPage reimbursed its customers for the stolen rent money. The company then sought coverage under its commercial crime insurance policy with National Union Fire Insurance Co., an AIG subsidiary in Pittsburgh, Pennsylvania, seeking reimbursement for the stolen transaction fees and the $9 million in fees paid to customers.

National Union agreed to pay $1.2 million to cover transaction fees but rejected the $9 million claim, arguing that RealPage’s decision to reimburse customers was a business decision and an indirect loss not covered by the policy.

The court sided with the National Union, ruling that the customers’ compensation constituted a separate loss outside of policy coverage.

While the case was ongoing, the Secret Service recovered approximately $2.9 million in stolen funds. RealPage filed a successful claim for the recovered funds.

In September 2020, the National Union demanded that RealPage repay $1.2 million paid under the policy, citing the policy’s allocation of recovery (ARP) provision.

Read more: Cybersecurity and AI – How prepared are companies to face threats?

The Financial Reform Act specified that any recovery, whether made before or after payment under the policy, should be applied first to any excess loss incurred by the policyholder, with the insurer being entitled to compensation for its payments thereafter.

The National Union claimed that the refunded funds were subject to the Money Back Act, and that the insurance company should receive full compensation, as RealPage’s covered loss – the stolen transaction fees – had already been paid in full.

RealPage refused to reimburse the insurer, claiming that the ARP only applies to recoveries of covered losses. The company claimed that it was unclear whether the refunds were for covered transaction fees or non-covered customer reimbursements.

National Union responded by filing a breach of contract lawsuit against RealPage, while RealPage countersued, alleging that the insurer violated Texas insurance law by engaging in unfair or deceptive acts. Both parties sought summary judgment.

U.S. District Judge Jane J. Boyle, who presided over the case in the Northern District of Texas, dismissed RealPage’s claim of violations of Texas insurance law. The court found that RealPage had not suffered any actual damages related to the policy misinterpretation, other than legal expenses.

However, Boyle ruled in RealPage’s favor on the ARP issue, determining that the refunded funds were not subject to the appropriation clause and that the national union was not entitled to compensation.

What do you think of this story? Feel free to share your comments below.