A real estate law firm failed to get a mortgage solution services company to indemnify it for money owed to Deutsche Bank after a hacking attack disrupted a real estate deal, a federal court ruled.

The Buck Law Firm brought a third-party complaint against Altisource Portfolio Solutions Inc. to pay it money owed to Deutsche Bank that was routed to a cybercriminal’s bank account after the hack.

Virginia law doesn’t allow companies to bring negligence claims against organizations that are hit with a data breach based on “a duty to safeguard the private information of another individual,” the U.S. District Court for the Eastern District of Virginia ruled March 29 in tossing the complaint.

The decision rests on a developing area of law: “whether or how to impose liability on a party whose potentially negligent conduct flows from a data breach,” according to the opinion. Courts have come down on both sides of the issues, giving companies little clarity on who is liable for negligence post-breach.

Because the real estate firm, the Buck Law Firm, failed “to establish a legal duty Altisource owed to Deutsche under Virginia law, the Court must dismiss both claims,” Judge M. Hannah Lauck wrote.

The court will allow the Buck Law Firm to file an amended complaint to find alternative theories to bring its third-party indemnification claims, Lauck wrote.

The case stems from a real estate deal where a hacker caused funds to be redirected to the cybercriminal. Deutsche Bank had contracted with the Buck Law Firm to close the real estate transaction and used Altisource to help facilitate closing the deal.

The Buck Law Firm alleged that the hacker obtained access to confidential emails that contained the financial information of Altisource’s customers, like Deutsche Bank, according to the opinion. Due to the breach, the hacker used fraudulent wiring instructions to send the real estate funds to the wrong bank account. The Buck Law Firm thought it was sending the money to Deutsche Bank.

Deutsche Bank sued the Buck Law Firm claiming breach of contract and negligence. In turn, the Buck Law Firm filed a third-party complaint against Altisource to recover any money owed to Deutsche as a result of the lawsuit.

The Buck Law Firm alleged that Altisource should have known about the hack and failed to warn its customers.

The case is Deutsche Bank Nat’l Tr. Co. v. Buck, 2019 BL 112430, E.D. Va., 3:17cv833, 3/29/19.