Thomas D. Cunningham

TOM CUNNINGHAM leads the firm’s Privacy and Cybersecurity practice in Chicago. He is a trial lawyer who has first chaired over 25 trials and arbitrations and secured judgments and achieved settlements totaling over US$1 billion. Tom’s practice focuses on contested matters and regulatory enforcement proceedings over cybersecurity, privacy, insurance, and financial services-related issues. In addition to his contested work, Tom advises clients on digital risk management and compliance programs and conducts diligence in the corporate transactional context, based on his 30 years of representing clients in the US, UK, EU, and Bermuda in contested matters. He is also a Certified Information Privacy Professional/United States (CIPP/US). 

Tom helps his clients achieve successful outcomes in complex, multi-faceted contested matters. For one publicly traded client, he orchestrated an internal investigation of corporate governance and securities regulation practices while overseeing the defense of an SEC enforcement action and a simultaneous shareholder activist campaign, all while coordinating strategy for and messaging with state insurance departments, credit rating agencies, and the public. For one insurance client, Tom defended against a series of multi-state insurance conduct and market examinations, developed the theory for and first-chaired the lawsuit against the lead agency for exceeding its authority, and secured an advantageous settlement of all outstanding matters.

Clients turn to Tom to navigate high-stakes cybersecurity and privacy matters, including data breach response and the resulting litigation and governmental inquiries that often follow. He has first-chaired the defense of class action privacy lawsuits and advised on regulatory investigations conducted by the New York Department of Financial Services and numerous other agencies. Drawing on his experience in contested cybersecurity matters, Tom helped develop the first ever 144A cyber risk catastrophe bond, for which the firm won the 2024 “Cyber ILS Award” from Insurance Insider.

Tom has advised clients in the development of cybersecurity and data privacy programs and counseled clients on CAN-SPAM, CCPA, FCPA, GDPR, HIPAA, UDAP, and state privacy laws. Tom advises clients on preparation for sophisticated cybersecurity incidents, including on development of policies and presentation of trainings and tabletop exercises. In his diligence work, Tom has advised clients on data privacy and cybersecurity issues for transactions across a host of industries, with particularly emphasis on insurance and financial services companies.

Tom also regularly represents companies in insurance-related disputes. He leads the firm’s reinsurance dispute practice and represents clients in life, health, property, casualty, and agent-related disputes. He has first-chaired trials and arbitrations over alternative risk transactions, Affordable Care Act reimbursements, asbestos, catastrophe bonds, COVID-19, commutations, environmental pollution, long term care, opioids, PFAS, talcum powder, wildfires, and yearly renewable term (YRT) premium increases. Tom is repeatedly asked to take over cases heading to trial from prior counsel.

Tom’s advocacy has earned him recognition in both Illinois and Nationwide by Chambers USA (2011–2025) for Insurance Dispute Resolution: Reinsurance. Clients in the 2025 edition of Chambers USA lauded Tom as “one of the leading counsel for coverage trials” with a “wealth of experience.”

Cybersecurity and Privacy

• Representation of leading Chicago-based entity in relation to cybersecurity attack, including incident response, defense of resulting class action litigation, and resolution of subsequent governmental inquiries.
• Representation of broker-dealer institution in an investigation and assessment of cybersecurity governance and risk, and subsequent remediation and policy advisory work.
• Assisted in development of first ever 144A cyber risk catastrophe bond.
• Advised financial services client on compliance issues surrounding implementation of artificial intelligence.
• Representation of publicly traded financial services company in transnational cybersecurity incident and coordination of US, UK, EU, and Bermuda governmental agency reporting and inquiry response.
• Representation of numerous companies in insurance, entertainment, financial services, healthcare, manufacturing, and technology industries in data breach investigation and response including governmental reporting and inquiries.
• Representation of global insurer in creation of comprehensive suite of privacy, cybersecurity, and business continuity standards, practices, and policies across over 20 jurisdictions.
• Development of HIPAA privacy and security policies and risk assessments for self-insured health plan client.
• Led cybersecurity and privacy diligence on targets across various industries in private equity and public transactions totaling over US$25 billion.

Insurance and Reinsurance Coverage

• Secured US$214 million judgment for publicly traded healthcare entity in federal court.
• Tried high-stakes “Bermuda-form” reinsurance arbitration over coverage for COVID-19 claims.
• Prevailed in four-week bench trial in US$165 million asbestos insurance coverage action in state court.
• Tried high-stakes reinsurance arbitration over long-term care reinsurance.
• Secured US$113 million judgment for health insurer in federal court.
• Obtained US$64 million jury verdict after three-week reinsurance trial in federal court.
• Obtained US$16 million jury verdict after two-week jury trial in federal court.
• Represented debtor in federal bankruptcy action over insurance coverage of pending and future claims.
• Tried dozens of confidential arbitrations over insurance and reinsurance coverage matters.

Other Contested Proceedings

• Oversaw simultaneous internal investigation, defense of SEC enforcement action, and defense of shareholder activist campaign for publicly traded client.
• Represented grocery foods concern in parallel federal and state court actions with former private equity sponsor over successor rights; case settled after defeat of former sponsor’s motion to dismiss.
• Replaced prior counsel after close of discovery in agency lawsuit. Within three months of appointment, secured ruling requiring agent to post millions in security; action settled shortly thereafter.
• Replaced prior counsel one month before written discovery closed in breach of contract lawsuit. Developed new theory of liability which was borne out in discovery; case settled shortly thereafter.
• Prosecuted minority shareholder oppression claims against majority owner of private concern. Case settled after depositions savaged opponent’s case.
• Secured full defense verdict in broker malpractice case after two-week jury trial in federal court.
• Represented health insurer in multi-state unclaimed property examination; secured complete dismissal of examination without payment following negotiations with examiners.
• Represented numerous life insurers in multi-state unclaimed property examinations; secured settlement of all examinations on favorable terms following negotiations with examiners.

Tom is active in pro bono matters. He has developed cybersecurity and privacy manuals for numerous pro bono organizations and represented prisoners in section 1984 civil rights lawsuits in federal court.