Travelers Casualty and Surety Company of America has filed a lawsuit against several technology companies, alleging negligence in handling cybersecurity that led to a significant ransomware attack. The complaint was filed on October 25, 2024, in the Circuit Court of the Fifteenth Judicial Circuit in Palm Beach County, Florida, targeting ConnectWise, LLC, ConnectWise Holdings, LLC, and iPower Technologies, Inc.

The plaintiff, Travelers Casualty and Surety Company of America (“Travelers”), is acting as a subrogee and assignee for two law firms: Marin, Eljaick, Lopez & Martinez, P.L. (“Marin”) and Weiss Serota Helfman Cole & Bierman, P.L. (“Weiss”). Both firms experienced severe disruptions due to a ransomware attack on October 29, 2020. The attack compromised their internal servers through vulnerabilities in the remote access platform provided by iPower Technologies using software from ConnectWise.

According to the complaint, both law firms had contracted with iPower for IT services. During the attack, an unknown perpetrator demanded substantial ransoms to restore access to encrypted data. For Weiss’s case specifically, a ransom of $2.5 million was initially demanded; however, they eventually paid $15,000 after negotiations facilitated by Travelers’ forensic investigator. Similarly, Marin faced demands totaling $84,700 but settled at $81,620.55 through negotiation by Coveware Inc., funded by Travelers.