Cyber claims have traditionally been treated as loss-containment files: identify the breach, stop the bleeding, restore operations, and pay the covered response costs. However, recent cases suggest a developing category of subrogation claims with meaningful recovery potential where a vendor, financial institution, managed service provider, professional advisor, or other commercial actor failed to meet a specific cybersecurity, verification, or incident-response obligation that contributed to the loss. These cases point to a developing area of recovery for cyber insurers and insured businesses, where cyber losses can sometimes be recovered from a third party even where a criminal is the immediate cause of the loss.
A cybercriminal’s intervention does not necessarily end the causation analysis. Recovery is most realistic where counsel can identify: (1) a defendant with practical control over the failed safeguard; (2) a concrete legal duty; (3) contemporaneous red flags or a measurable control failure; (4) a defensible subrogation or assignment chain; and (5) evidence connecting that failure to each category of loss paid.
A major 2026 U.S. decision opens the door
The most direct recent example is the Delaware Supreme Court’s decision in Travelers Casualty and Surety Company of America v. Blackbaud, Inc. earlier this year. Blackbaud provided software and data-hosting services to nonprofit and educational organizations. Following a ransomware and data-exfiltration incident, affected customers incurred investigation, legal, notification, credit-monitoring, communications, and other response costs. Their insurers paid claims and pursued Blackbaud as subrogees and assignees.
The insurers alleged that Blackbaud had made specific contractual promises about information-security safeguards and breach response. They also alleged concrete failures, including obsolete servers, missing security updates, inadequate encryption, and ignored internal warnings. A lower court dismissed the claims. In February 2026, the Delaware Supreme Court reversed the decision and held that the insurers had adequately pleaded breach of contract and causation.
Blackbaud is not a final finding that the vendor is liable, but it shows that the court accepted that insurers could plead claims across many insured customers and that contractual promises concerning cybersecurity and incident response could potentially support recovery of downstream response costs. The immediate hacker did not make the vendor’s alleged obligations legally irrelevant.
For example, contracts can include a promise to “maintain appropriate security”. A clause that identifies Multi-Factor Authentication (MFA), patching intervals, encryption, logging, backup testing, breach notice, investigation, containment, or a response deadline gives the court something much more concrete to assess.
The opposite result appeared in Axis Insurance Company v. Barracuda Networks, Inc., No. 24-1920 (1st Cir. 2025). There, an insurer pursuing assigned and subrogated claims after a healthcare data breach lost on summary judgment. A data breach at Barracuda Networks exposed protected health information of patients of Zoll Services LLC, a subsidiary of Zoll Medical Corporation. Zoll had contracted with Fusion LLC for data security services, and Fusion in turn relied on Barracuda’s technology. Axis, on behalf of Fusion and Zoll, made a claim against Barracuda. The appellate court held that Axis failed to present evidence of a relationship between Zoll and Barracuda that would support derivative or vicarious liability necessary for equitable indemnification under Massachusetts law. The court found that Fusion did not meet all of its contractual obligations to Barracuda. The case involved a chain of service providers, and the court found gaps in the relationship needed for indemnification.
Canadian courts are already allocating cyber-enabled losses
Canadian decisions do not yet provide a single, settled cyber-subrogation rule but they do show the questions courts are asking.
In Groupe TYT inc. c. Caisse Desjardins de Drummondville, 2026 QCCS 1707 , released in May 2026, a Quebec business was deceived by a “president fraud” scheme and made unauthorized international transfers. The court found fault on both sides. It attributed 25% of the responsibility to Desjardins based on shortcomings in reasonable verification and internal protocols, and 75% to the business because of its own control failures and inaccurate responses. The criminal caused the immediate loss, but the court still found liability on the part of the legitimate actors.
A newer Ontario case, Litvin v. Mackenzie Financial Corporation, 2025 ONSC 6138 illustrates that traditional routes remain available. The court certified a national class action arising from a ransomware event involving a file-transfer platform used by a downstream communications provider that held Mackenzie clients’ personal information. The court held that negligence and contract claims were allowed to proceed at the certification stage, including claims concerning the processor’s possession and protection of sensitive information. Although this is a preliminary decision and certification does not assess the merits of the case, it suggests that traditional causes of action can still be available for cyber claims, and that possession of sensitive data, the service contract, and the processor’s role may support a duty analysis even without a direct contract between every affected individual and the processor.
Ontario decisions involving fraudulent wires point in the same general direction. In Bank of Montreal v. Asia Pacific International Inc., BMO reimbursed its customer after an imposter obtained a $428,000 wire transfer, then tried to recover the funds from an innocent gold dealer that had released product to the fraudster. The court dismissed BMO’s application, finding that as between two innocent parties, BMO was in the better position to prevent the loss because it failed to act with sufficient diligence in the face of significant red flags about the imposter’s identity. The court took a practical approach to the loss-allocation analysis.
These cases suggest that recovery turns on which party controlled the relevant system or verification step, how the governing contract allocated the risk, what each party knew at the time, and whether any available warning or anomaly was ignored.
It is important to note that not every attractive claim is legally available. Recently, in Owsianik v. Equifax Canada Co, 2022 ONCA 813, the court of appeal held that an organization that allegedly failed to prevent a hacker from accessing personal information did not itself commit the intentional tort of intrusion upon seclusion, and that the defendant had to be the intruder themselves. This decision does not bar recovery opportunities, but it shows that the defendant’s actual conduct must reflect some liability.
Where recovery opportunities are most likely to exist
A viable third-party claim is most likely where the evidence reveals more than the fact of a breach. Useful indicators include:
- a vendor expressly promised a safeguard, such as MFA, encryption, patching, segmentation, backup testing, monitoring, or a response deadline and did not provide it;
- a financial institution or advisor possessed specific information about a fraud pattern or prior attempted diversion but failed to warn or verify;
- a provider departed from its own incident-response plan, security schedule, service level, or documented escalation process;
- the insured paid identifiable costs because notice, containment, restoration, or investigation was delayed;
- the contracts preserve subrogation rights and do not extend a waiver, limitation, or exclusive remedy to the proposed defendant.
The reverse is also true. A claim becomes harder where the insured rejected stronger security, failed to follow verification procedures, contractually assumed the risk, cannot establish a direct or derivative right against the target, or seeks speculative losses without evidence of actual harm.
A developing recovery practice: not automatic liability
Cybersecurity failures are becoming a potential source of third-party liability, particularly through contract. But the cases do not impose strict liability on every organization connected to a breached system. Courts still need to find a defined duty, a measurable control failure, a preserved right of recovery, and evidence linking that failure to the loss.
For victims and cyber insurers, the lesson is to look beyond the attacker and assess who undertook the relevant obligation, who controlled the failed safeguard, what warnings were available, and whether the evidence can connect that failure to the amount claimed.
The information and comments herein are for the general information of the reader and are not intended as advice or opinion to be relied upon in relation to any particular circumstances. For particular application of the law to specific situations, the reader should seek professional advice.
