Former Agent Accused of Secretly Stealing Book of Business (With Family Ties)

Farmers Insurance’s lawsuit against a former Oklahoma agent is a sharp reminder that in insurance distribution, client relationships, carrier data, and office workflows are deeply intertwined, and when that line blurs, the legal and operational fallout can be significant.

A recent federal case involving Farmers Insurance and former agent Bradley McKinney has drawn attention across the industry because it touches several issues that matter to agents, agencies, and carriers alike: alleged book-of-business diversion, the use of competing markets from inside an exclusive agency environment, employee movement, and the handling of confidential customer data during an agency exit.

According to the lawsuit, Farmers alleges that McKinney operated a parallel insurance business while still representing the carrier, routed policyholders and qualifying business to non-Farmers outlets, and downloaded agency data shortly before resigning. The carrier is pursuing claims that include trade secret misappropriation, breach of contract, tortious interference, civil conspiracy, and a claim under the federal Computer Fraud and Abuse Act. Importantly, the case is still at an early stage, and no court has made findings on the merits.

For insurance professionals, the real value in this story is not courtroom drama. It is the practical lesson underneath it: distribution strategy and data governance can no longer sit in separate silos. In today’s market, they are part of the same risk conversation.

“For carriers built on exclusive agent models, the case is a sharp reminder that contractual protections are only as strong as the systems, and the willingness, to enforce them.”

Insurance Business

That observation resonates well beyond one carrier or one agency contract. Whether an organization operates through exclusive agents, independents, hybrids, aggregators, or embedded partnerships, the same core questions apply. Who owns the customer data? Who can access it? What happens when a producer leaves? Which submissions are permitted to move outside the primary channel, and under what circumstances? Many agencies think they know the answers until a dispute forces every assumption into the open.

The timing also matters. Regulators and industry groups have spent years emphasizing cybersecurity, information security programs, and the safeguarding of nonpublic information. The NAIC’s Insurance Data Security Model Law has pushed insurers and licensed entities to treat data protection as an enterprise obligation, not merely an IT checklist. That broader backdrop makes disputes over client files, downloads, and access controls especially important for insurance organizations.

Why this case matters beyond one agency dispute

At first glance, this looks like a familiar producer departure case. But it is more layered than that. The allegations go to the center of how many insurance organizations are structured: a carrier entrusts an agent with market presence, branding, staff, systems access, and customer relationships. In return, it expects business to flow through approved channels and sensitive information to remain protected.

When that arrangement breaks down, the disagreement is rarely limited to one policy or one account. It quickly becomes a dispute over process integrity. If a carrier believes business was intentionally steered away while the agent was still inside the organization, that raises concerns about underwriting visibility, commission economics, customer disclosures, and supervisory controls. If data was exported before departure, the issue expands again, from sales conduct to information security and trade secret enforcement.

For agencies, the takeaway is equally important. Even where owners and producers believe they are acting entrepreneurially, the governing agreement usually defines the boundaries. The details in appointment contracts, producer agreements, handbook policies, technology use rules, and CRM permissions matter far more than many teams appreciate during day-to-day production.

The bigger issue is not just ownership, it is control

Insurance professionals often talk about “ownership of the book” as if the answer is obvious. In practice, ownership and control are different things. A contract may assign ownership or characterize information as proprietary, but real-world control depends on system design, role-based permissions, monitoring, export limits, audit logs, and exit protocols.

That is why these disputes can be so uncomfortable. A company may have airtight language on paper and still discover that staff could access far more information than they needed, or that downloads were not flagged, or that offboarding began only after a resignation rather than when warning signs first appeared.

From a legal standpoint, trade secret claims typically rise or fall on more than just labeling something “confidential.” Courts often look at whether the business actually treated the information like protected information. In insurance, that means asking practical questions. Were customer lists restricted? Were expiration dates, policy details, and marketing notes compartmentalized? Was there a documented expectation of confidentiality? Were outside placements governed clearly? Were agency employees trained on these points, or were they simply assumed?

That is where many organizations have exposure. The vulnerability is often not bad intent at the outset. It is operational looseness that becomes legally consequential later.

What agents and agencies should be reviewing right now

This case should prompt agencies to review the basics with a fresh eye, especially those operating under exclusive or semi-exclusive arrangements, or those that allow exceptions through affiliated brokerages, wholesalers, or side channels.

Contracts and market placement rules

Producers and agency leaders should know exactly what their agreements require before business is placed outside the primary market. Is there a right of first refusal? Is there an affiliated brokerage channel that must be used first? Are there carveouts for declined risks, specialty products, or personal lines versus commercial lines? Ambiguity here creates the conditions for later conflict.

Data access and export permissions

If a producer can export an entire book of business without triggering immediate review, that is a governance problem, regardless of whether the conduct is ultimately found improper. Agencies should know who can run bulk reports, what fields can be extracted, whether downloads are logged, and who reviews anomalous activity.

Staff movement and parallel operations

A producer departure often involves more than one individual. Customer service representatives, producers, spouses, referral partners, and nearby agencies can all become part of the fact pattern. Management should understand how side ventures, external affiliations, and family relationships interact with compliance obligations.

Resignation and offboarding timing

The most sensitive period is often the weeks immediately before notice is given and the days immediately after. Access rights, device returns, forwarding rules, shared credentials, personal email use, and cloud storage permissions all deserve scrutiny. A well-run offboarding process is not punitive. It is a control function.

Exactly four questions every leadership team should ask

• Can we clearly document which customer data is proprietary and why?
• Would unusual downloads or report generation be flagged the same day?
• Do our contracts match how our producers actually place business?
• Could we execute a clean offboarding process within hours, not days?

Why carriers should see this as a systems issue, not only a legal issue

For carriers, it is tempting to treat a case like this as an enforcement matter after the fact. But the stronger lesson is upstream. If a distribution model depends on exclusive alignment, then compliance, agency management, security, and field leadership need to be working from the same playbook.

That includes more than contract drafting. It means using technology and process to support the contract. For example, carriers should consider whether agency-facing platforms restrict access by role, whether report creation is monitored, whether policyholder information can be mass-exported without layered approval, and whether exception requests for out-of-appetite business are documented in ways that can later be audited.

It also means acknowledging the human side of agency economics. In a difficult rate environment, with customer retention under pressure and appetite shifts creating friction, producers may feel strong incentives to find another path for business. That does not excuse conduct that violates agreements, but it does explain why governance cannot be passive. Distribution pressure is often the spark that tests control design.

A useful checkpoint for insurance data security

The insurance sector has been moving toward a more disciplined data-security posture for years. The NAIC has said that insurers and other licensed entities should develop, implement, and maintain an information security program, investigate cybersecurity events, and notify regulators when required. That language speaks to cyber incidents, but the operational mindset carries over neatly to internal misuse and suspected data exfiltration.

In other words, agencies and carriers should not think only in terms of outside hackers. Internal access misuse, inappropriate exports, and unauthorized retention of customer information can create just as much business disruption, and sometimes more, because the actor already understands the value of the data and how to use it competitively.

“Computer security research is a key driver of improved cybersecurity.”

Lisa O. Monaco, U.S. Department of Justice

That quote was made in a different context, but the principle is still useful here. Insurance organizations improve when they treat access, monitoring, and control testing as a normal discipline rather than an emergency response. The healthiest organizations are the ones willing to examine their weak spots before a resignation, a breach, or a lawsuit does it for them.

Where the legal theories point operationally

The claims reported in the case matter because each one maps to a real business control.

The table is simple, but that is exactly the point. Legal disputes often look complicated because the filings are complicated. Operational fixes usually are not. They are about permissions, process, documentation, and discipline.

What smart organizations will do next

The most practical response is not to wait for more headlines from this case. It is to use the case as a prompt for a short internal review. Carriers should revisit agency appointment language, audit controls around report generation, and escalation protocols when producer alignment appears to be weakening. Agencies should review side-business policies, data handling expectations, and resignation playbooks. Both should examine whether producers and staff truly understand where permitted flexibility ends and prohibited conduct begins.

There is also a culture lesson here. High-performing agencies are built on trust, but trust does not replace structure. In distribution, strong relationships and strong controls are not opposites. They are partners. The better the relationship, the easier it should be to have clear expectations about where business goes, how data is handled, and what happens during transitions.

For an industry built on promises, that is the central takeaway. Customer trust is earned in the marketplace, but it is protected in the details, in contracts, in systems, in supervision, and in the quiet decisions organizations make long before any dispute reaches a courtroom.