While the bank was able to recover roughly $135,000 of those unauthorized transfers, Tennessee Electric was on the hook for the rest. This month, the company sued TriSummit in state court, alleging negligence, breach of contract, gross negligence and fraudulent concealment.

Tennessee Electric alleges that the bank only called to seek approval for the fraudulent payroll draft a day after having approved it, and after security blogger Brian Krebs (of Krebs On Security) alerted them to the heist.

According to Krebs’ report on his blog: “This lawsuit, if it heads to trial, could help set a more certain and even standard for figuring out who’s at fault when businesses are hit by cyberheists (for better or worse, most such legal challenges are overwhelmingly weighted toward banks and quietly settled for a fraction of the loss).”

While consumers who bank online are protected by Regulation E’s limits on liability for customers losing money through unauthorized account activity, businesses do not have the same protections. The Uniform Commercial Code (UCC) holds that a payment order received by a bank is “effective as the order of the customer, whether or not authorized, if the security procedure is a commercially reasonable method of providing security against unauthorized payment orders, and the bank proves that it accepted the payment order in good faith and in compliance with the security procedures and any written agreement or instruction of the customer restricting acceptance of payment orders issued in the name of the name of the customer.”

States across the U.S. have adopted this code, and interpretations mean that the most a business can hope to recover is the amount stolen in a cyber attack – often making it unfeasible to sue the bank and incur litigation fees, the report says.