A major insurer is chasing more than $1 million after a cyber scam rerouted company payments - putting contract obligations and cyber risk front and center for the industry.
On September 4, 2025, Berkley Insurance Company filed a complaint in federal court in Pennsylvania, aiming to recover losses it paid out to PPL Corporation. According to the complaint, an unknown perpetrator compromised Alliance Systems Integrators, Inc.’s email system, using a manager’s legitimate email address to send false ACH payment instructions to PPL’s accounts payable team. PPL, relying on those instructions, updated Alliance’s payment information and sent more than $1 million to a third-party account.
Here’s how it unfolded. Alliance, a New York-based service provider, entered into a Master Services Agreement with PPL Services Corporation on or about July 18, 2022. The agreement required Alliance to notify PPL within 24 hours of any known or suspected compromise of its systems, take all necessary and reasonable steps to protect information, and indemnify PPL for losses arising from breaches or disclosures of data or information from PPL’s computer systems.
On July 24, 2023, the complaint states, a threat actor used one of Alliance’s manager’s email addresses to provide false ACH transaction routing instructions to PPL’s accounts payable team, requesting that PPL update the ACH payment information associated with Alliance to a third-party bank account. The complaint alleges that Alliance did not inform PPL of the compromise of its email system within 24 hours or another reasonable time period as required by the agreement.
PPL’s accounts payable team, acting on the instructions sent from Alliance’s manager’s email account, updated the ACH payment information. On August 18, 23, and 24, 2023, PPL issued wire transfer payments in the amounts of $322,941.59, $325,110.22, and $357,320.71, respectively, totaling $1,005,372.52, to the third-party bank account provided by the threat actor. PPL discovered the misdirected transfers on or about September 7, 2023, after Alliance followed up on the status of outstanding invoices.
The complaint alleges that Alliance’s failure to secure its email accounts, the threat actor’s impersonation of Alliance’s manager, and Alliance’s failure to immediately alert PPL to the missing or late payments resulted in PPL being damaged in an amount in excess of $1 million. After discovering the misdirected transfers, PPL submitted an insurance claim to Berkley Insurance Company under its commercial crime policy. Berkley evaluated the claim, determined that it was covered under the policy, and after application of the deductible, issued payment to PPL. In exchange for payment, PPL assigned to Berkley any and all of its rights, titles, interest, claims, causes of action, or rights of recovery arising from or relating to its loss to the extent of Berkley’s payment.
Berkley now seeks recovery against Alliance for PPL’s loss as both a subrogee and assignee of PPL. The complaint asserts claims for negligence, breach of express contract, and breach of implied contract. The contract clauses cited in the complaint include requirements for Alliance to notify PPL of security incidents within 24 hours, to protect information against unauthorized access or improper use, and to indemnify PPL for losses caused by Alliance’s failure to comply with the contract or arising from security incidents.
Berkley Insurance Company requests that judgment be entered against Alliance Systems Integrators, Inc. for the misdirected transfers, an award of all attorneys’ fees and costs incurred in bringing the action, an award of pre-judgment and post-judgment interest, and such other relief as the court deems just and necessary.
As this is a newly filed complaint, all allegations represent Berkley’s claims and have not been adjudicated. The outcome of the case is pending.
