Uniontown, Pa.—In a pivotal preliminary ruling, a Pennsylvania judge has greenlit the continuation of a lawsuit brought by a jeweler against PNC Bank and certain employees, following a devastating cyberattack resulting in losses exceeding $1 million.
Joyce’s Jewelry, situated in the vicinity of Pittsburgh in Uniontown, initiated legal action against PNC in September 2022, subsequent to cybercriminals executing a series of unauthorized wire transfers, siphoning close to $1.6 million from the jeweler’s bank accounts.
The incident unfolded on May 12, 2022, when an employee unwittingly accessed a fraudulent website masquerading as PNC Bank’s official platform, inadvertently disclosing login credentials to malicious actors.
Exploiting these credentials, cybercriminals swiftly depleted all four of the jewelry store’s bank accounts through 11 unauthorized wire transfers spanning a 20-hour period.
In its lawsuit, Joyce’s Jewelry asserted that PNC Bank had failed to uphold adequate safeguards for its funds, whereas PNC countered, contending it had adhered to proper protocols regarding the transactions, attributing fault to Joyce’s Jewelry and its employee.
The jeweler argued that the unusual nature of the transfers, including their destination to unfamiliar accounts and businesses, coupled with amounts significantly surpassing typical transaction values, should have raised red flags for PNC. Moreover, the transfers resulted in overdraft charges totaling nearly $200,000, a departure from the jeweler’s prior banking history.
While PNC managed to recover a portion of the pilfered funds, it levied charges against the jeweler for its retrieval efforts, mitigating the total loss to $1.1 million.
Initially, the case was adjudicated in the Court of Common Pleas of Fayette County, Pennsylvania, a state court. Despite PNC’s bid to escalate the matter to the U.S. District Court for the Western District of Pennsylvania, this request was rebuffed on January 12, 2023, with the state court retaining jurisdiction.
Subsequently, PNC sought dismissal of Joyce’s claims of negligence and breach of fiduciary duty, along with the jeweler’s entreaty for attorneys’ fees and punitive damages, arguing that it could only be sued under the state’s Uniform Commercial Code governing commercial transactions, including wire transfers.
In a significant turn of events earlier this year, the state court ruled in favor of Joyce’s Jewelry. In a decision rendered on March 11, Judge Nancy D. Vernon maintained that claims of negligence against PNC and individual bank employees could not be summarily dismissed. Additionally, the jeweler was permitted to pursue attorneys’ fees and punitive damages.
Judge Vernon underscored that PNC’s obligations transcended mere contractual duties and suggested the bank might still be liable under tort principles, denoting an injury or wrong independent of contractual obligations.
A spokesperson from PNC expressed regret over the jeweler’s victimization but emphasized that Joyce’s Jewelry could have mitigated the fraud by implementing precautionary measures advised by PNC.
Howard Kaplan, partner at Kaplan & Grady, representing Joyce’s Jewelry, emphasized the significance of the ruling, noting its departure from conventional legal proceedings. Kaplan suggested that broader liability under negligence theories could amplify potential damages compared to claims rooted solely in contract law.
As the legal proceedings unfold, Kaplan stressed the broader implications of the case, expressing hope that a favorable outcome could establish a precedent benefiting defrauded customers and fostering accountability among financial institutions.
