New York College Sues Cyber Insurer Over Breach Claims

Keuka College seeks $1.6 million in damages after insurer paid only $38,643 of its claim.

Published on Feb. 9, 2026

Got story updates? Submit your updates here. ›

A New York college has sued its cyber insurer, At-Bay Insurance Services LLC, for refusing to pay most of the college's claims following a cyberattack in April 2024 that affected its computer systems. Keuka College is seeking at least $1.6 million in damages, alleging the insurer only paid $38,643 of its insurance claim despite the college having to rebuild its systems over several months.

Why it matters

This case highlights the growing tensions between organizations and their cyber insurers over the scope and payouts of coverage following cybersecurity incidents. As cyberattacks become more frequent, insurers are facing pressure to limit their exposure, leading to disputes over the extent of coverage and reimbursement.

The details

According to the complaint, the April 2024 cyberattack damaged Keuka College's remote VPN and departmental shared drives, forcing the school to rebuild its systems over several months. The college is seeking damages for the costs associated with this recovery effort, which it claims the insurer refused to fully cover.

  • The cyberattack occurred in April 2024.
  • Keuka College filed the lawsuit on February 6, 2026.

The players

Keuka College

A private college located in New York that was the victim of a cyberattack in 2024.

At-Bay Insurance Services LLC

The cyber insurer that Keuka College claims failed to adequately cover the college's losses following the 2024 cyberattack.

Got photos? Submit your photos here. ›

What they’re saying

“We must not let individuals continue to damage private property in San Francisco.”

— Robert Jenkins, San Francisco resident (San Francisco Chronicle)

What’s next

The case is ongoing in the US District Court for the Western District of New York.

The takeaway

This dispute highlights the growing challenges organizations face in securing adequate cyber insurance coverage and the need for clearer policies and guidelines around payouts following cybersecurity incidents.