CoWorx, an insured policyholder of Ace American Insurance Company, suffered a ransomware attack due to alleged negligence by its cybersecurity vendors, Congruity 360 and Trustwave Holdings. Ace, after paying a $500,000 claim to CoWorx, filed a subrogation lawsuit (Case No. 2:25-cv-15657) against both vendors. The lawsuit claims Congruity 360 failed to implement multifactor authentication (MFA) and secure network servers, enabling the ransomware installation. Meanwhile, Trustwave allegedly delayed critical incident notifications, preventing CoWorx from mitigating damages proactively. The attack led to financial losses, operational disruption, and reputational harm, with Ace asserting breach of contract and negligence against the vendors. This case underscores rising risks in third-party cybersecurity vendor accountability, where insurers increasingly pursue legal action against service providers post-incident.

CoWorx Staffing Services, a nationwide staffing firm, suffered a ransomware attack in April 2024 due to security lapses by its contracted technology providers. Threat actors exploited a compromised CoWorx user password to access a virtual machine hosted by Congruity, a cloud services provider, which had failed to enforce multi-factor authentication (MFA). The attackers elevated privileges, accessed the host network, and encrypted critical data after Trustwave, the cybersecurity firm monitoring the network, misclassified an initial breach alert as 'moderate' instead of 'high/critical', delaying response. Without backups, CoWorx was forced to pay a $500,000 ransom to decrypt files. The insurer, ACE American Insurance (Chubb), covered the cost but is now suing both Congruity and Trustwave for negligence, alleging their failures enabled the attack and exacerbated damages by preventing timely mitigation.