ACE American Targets Tech Firms in $500K Cyber Insurance Subrogation Case

A cyber insurance dispute is unfolding in federal court as ACE American Insurance Co., a Chubb subsidiary, seeks to recoup $500,000 paid in ransomware damages from two IT vendors it claims are at fault. The lawsuit, filed in New Jersey, accuses cloud provider Congruity and cybersecurity firm Trustwave of serious missteps that allegedly enabled and worsened the 2024 ransomware attack on CoWorx Staffing Services, a national temp agency operating in all 50 states.

According to ACE’s complaint, Congruity failed to implement multi-factor authentication (MFA) for remote access, allowing threat actors to breach the network using stolen credentials. Once inside, the attackers escalated privileges and accessed host servers—an event ACE says reflects flawed network segmentation by Congruity. Meanwhile, Trustwave is accused of misclassifying a detected security event as ‘moderate,’ delaying response and preventing timely data backups. Just days later, ransomware encrypted virtual machines, triggering a payout under CoWorx’s cyber policy.

For claims professionals, this case underscores the growing complexity of cyber liability subrogation and the importance of vendor accountability in claims attribution. It also highlights operational cybersecurity risks tied to third-party infrastructure, endpoint monitoring efficacy, and early threat detection protocols—all of which influence claims outcomes and carrier exposure in cyber policies.

The litigation touches on multiple fronts of interest to adjusters: technical causation in cyber claims, layered vendor responsibilities, data loss mitigation failures, and insurer recovery strategies. If successful, ACE’s suit could signal a rising trend in cyber insurance subrogation targeting negligent IT service providers.