More bad news followed.
A cybersecurity software company refused to cover any of his losses under an identity-theft protection policy he had purchased.
So Dr. Ephraim Atwal sued NortonLifeLock Inc. in state court, saying his LifeLock Ultimate Plus policy should provide him up to $1 million for stolen funds reimbursement, personal expense compensation, and coverage for lawyers and experts.
The lawsuit moved to federal court, and U.S. District Judge William Skretny recently weighed in with a split ruling on the Arizona company's bid to dismiss the case. The judge's Feb. 3 ruling allowed the doctor to pursue two claims: that he is entitled to the coverage and that the cybersecurity software company breached the policy when it refused to cover any of the doctor's losses.
Skretny, however, dismissed the doctor's claims of unjust enrichment and breach of good faith.
The case could turn on whether the policy's definition of "account" includes the kind of cryptocurrency account the doctor maintained.
Beginning in June 2017, Atwal maintained a private cryptocurrency account, using a popular digital currency that operates on blockchain technology. That technology uses linked computers to record transactions on permanent digital "blocks." The currency can be purchased on crypto exchanges.
The theft of Atwal's cryptocurrency and the lawsuit that followed highlight the troubles that have grown out of the fast-growing world of digital currency such as Bitcoin. The virtual currencies remain highly unregulated and offer less regulatory protection than traditional investments.
Last week, for example, federal investigators seized $3.6 billion worth of cryptocurrency and arrested two people in Manhattan for laundering virtual currency stolen in a 2016 hack. The Department of Justice said the financial seizure was its largest ever.
A Western New York Crypto Theft
Atwal, a medical director at Atwal Eye Care in Cheektowaga, specializes in laser vision correction and has provided free cataract surgeries to non-insured and low-income residents as well as military veterans and immigrants through his role as chief medical officer for Eyes on America, a nonprofit.
He opened a private crypto account in 2017 and had key credentials to access it, but in late August 2018, someone obtained the credentials through a fraudulent mobile device app, according to his lawsuit. In February 2019, the doctor's misappropriated credentials were used to steal all the funds then in his account.
Attorney Anna Mercado Clark, who represents Atwal, declined to discuss the specifics related to the case, citing the ongoing litigation.
Speaking generally, she said "data security and data protection are fields that continually evolve as new technologies emerge."
While Atwal's case focuses on cryptocurrencies, Clark noted that data protection involves a wide-range of new technologies such as "surveillance technologies, peer-to-peer financial technologies, social media and much, much more," said Clark, a partner at Phillips Lytle.
Was Theft A Stolen Identity Event?
NortonLifeLock, in court papers, said Atwal's policy covered U.S. regulated checking, savings, money market, brokerage and credit card accounts held by a financial institution and established primarily for personal, family or household purposes. It defines a financial institution as a bank, savings association, credit union, credit institution or company using credit.
Cryptocurrency is not subject to control or oversight by any governmental agency, NortonLifeLock's lawyers said in court papers.
"Cryptocurrencies are not legal tender ... are not accepted as currency by the government, and are not accepted as payment by the overwhelming majority of private business and individuals," according to the company's court papers. "Importantly, virtual currency does not have legal tender status in any jurisdiction."
So LifeLock did not breach any contractual obligation by denying coverage because the doctor's cryptocurrency does not fall within the definition of account under the policy, and that means the theft does not qualify as a "stolen identity event" under the policy, according to the company's court papers.
NortonLifeLock's lawyers did not respond to a request for comment.
A company spokesperson said the company did not have data available about the prevalence of cryptocurrency scams it deals with.
Policy Purchased to Guard Against Theft
Atwal purchased the stolen identity insurance police precisely to protect against identity theft, said Clark and her co-counsel Daniel R. Maguire in court papers opposing the company's request for the case to be dismissed.
After benefiting from Atwal's premium payments, LifeLock now seeks to avoid its obligations under that policy by incorrectly claiming that the misappropriation of his credentials and theft of his funds are not covered by the policy, according to court papers for the doctor.
A "bad actor's use or access of an account" is not necessary for what the company considers a "stolen identity event," his lawyers told the court.
"All that is required is the misappropriation of personal information or personal data," they said.
Atwal adequately alleged that his account qualifies as an account under the policy anyway, according to his lawyers.
"Dr. Atwal's account does constitute a brokerage account," they said.
(c)2022 The Buffalo News (Buffalo, N.Y.) Distributed by Tribune Content Agency, LLC.
