(Article from Insurance Law Alert, January 2023)
For more information, please visit the Insurance Law Alert Resource Center.
The Ohio Supreme Court ruled that an insurance policy that requires “direct physical loss of or damage to” property does not cover losses stemming from a ransomware attack. EMOI Services, L.L.C. v. Owners Ins. Co., 2022 WL 17905839 (Dec. 27, 2022).
EMOI was the victim of a ransomware attack. The company ultimately paid the hacker and sought coverage from Owners, which denied coverage based on an Electronic Equipment endorsement that required “direct physical loss or damage.” A trial court dismissed the suit, reasoning that there was no physical loss, and additionally, even assuming that EMOI’s software was damaged while it was encrypted by the hackers, most system files became fully functional once the ransom payment was made.
An intermediate appellate court reversed, ruling that issues of fact existed as to whether the attack resulted in direct physical loss. (See November 2021 Alert). The appellate court noted that the Electronic Equipment endorsement covered “direct physical loss of or damage to ‘media’” and that “media” was defined as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards.” The policy further stated that “media” included “computer software and reproduction of data contained on covered media.” Viewing the evidence in a light most favorable to EMOI, the appellate court ruled that the company’s computer servers may be considered “media” because they “constituted materials on which EMOI’s information was recorded.” Additionally, the court ruled that EMOI had raised an issue of fact as to whether its software incurred “direct physical damage” because the record established that portions of the software remained unusable even after decryption.
The Ohio Supreme Court reversed and reinstated the trial court’s grant of summary judgment in the insurer’s favor. The court held that under the “clear and unambiguous” language of the Electronic Equipment endorsement, there must be direct physical loss of or damage to property, which does not include damage to software. Although the term “computer software” was included within the definition of “media,” the court explained that “it is included only insofar as the software is ‘contained on covered media’ . . . [which] means media that has a physical existence.” As the court emphasized, all examples of media in the definition of that term are of a physical nature (“film, magnetic tape paper tape, disks, drums, and cards”). The court stated: “[T]he policy requires that there must be direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy.” Because EMOI did not incur damage to its physical media, any loss or damage to software was not covered. Rejecting the notion that software itself could sustain direct physical loss or damage, the court explained that software is “essentially nothing more than a set of instructions” and lacks a “physical existence.”