When deciding coverage for a ransomware event, insurers should take note of the Ohio Supreme Court’s ruling that an electronic-equipment endorsement to a business owners policy (BOP) does not provide coverage for losses incurred from a ransomware attack if there was no “direct physical loss of or damage to” software, as required by the policy.
EMOI Services, LLC (EMOI), a computer-software company that provides medical offices with back-office services, was the target of a ransomware attack when a cyber attacker gained access to its computer systems and encrypted files needed for using its software system. As a result of the attack, its files were encrypted and, therefore, unavailable. Ultimately, EMOI chose to pay the ransom. After payment, EMOI received an email from the cyber attacker with a link to download a program to decrypt the files. A majority of the system files were returned to normal following the decryption process and there was no hardware or equipment damage as a result of the ransomware attack.
At the time of the ransomware attack, EMOI was insured under a BOP policy. The BOP had an electronic-equipment endorsement which provided:
When a limit of insurance is shown in the Declarations under ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct physical loss of or damage to “media” which you own, which is leased or rented to you or which is in your care, custody or control while located at the premises described in the Declarations. We will pay for your costs to research, replace or restore information on “media” which has incurred direct physical loss or damage by a Covered Cause of Loss.
Direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.
The electronic-equipment endorsement defined “media” as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards.” The definition section further stated that “media” included “computer software and reproduction of data contained on covered media.”
EMOI filed an insurance claim for the payment of the ransom and the costs associated with investigating and remediating the attack, as well as upgrading its security systems. The insurer denied the claim on the grounds that the BOP did not cover the type of losses suffered by EMOI. After the coverage denial, EMOI filed a lawsuit alleging that the insurer breached the insurance policy. EMOI’s claims ultimately made their way to the Ohio Supreme Court for a decision addressing the language contained in the BOP’s electronic-equipment endorsement.
Ohio Supreme Court’s Analysis
As framed by the Court, the claims turned on the legal interpretation of the electronic-equipment endorsement to EMOI’s BOP.
The electronic-equipment endorsement stated that the insurer would cover the “direct physical loss of or damage to ‘media’ which [EMOI] owns.” It further indicated that “direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.” The BOP Special Property Coverage Form attached to the policy stated that “covered causes of loss” are “risks of direct physical loss.” The electronic-equipment endorsement defined “media” as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards” and stated that “media” included “computer software and reproduction of data contained on covered media.”
Applying Ohio contract principles, the Court found the language in the endorsement clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment before the endorsement was applicable. The Court also held that “covered media” meant media that had a physical existence and that the policy required direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy.
Drawing extensively from a California appellate court decision, the Court found that computer software cannot experience “direct physical loss or physical damage” because it does not have a physical existence. As described by the Court, software was essentially nothing more than a set of instructions that a computer follows to perform specific tasks. And, while a computer or other electronic medium has physical electronic components that are tangible in nature, the information stored there was intangible, as it had no physical presence. The Court held that the endorsement did not apply because software is intangible and cannot suffer direct physical loss or damage.
Because the BOP did not cover the type of loss EMOI experienced, the insurer did not breach its contract with EMOI. As a result, the Ohio Supreme Court reversed the judgment of the intermediate appellate court and reinstated the trial court’s grant of summary judgment in favor of the insurer.
This decision highlights the distinction between physical damage to electronic equipment and nonphysical damage, such as data compromise, which may be excluded from coverage. The clear language of the BOP’s electronic-equipment endorsement required direct physical loss of or damage to electronic equipment or media before coverage would apply. Given the Court’s ruling that software, as an intangible item, cannot incur direct physical loss or damage, EMOI was not eligible for coverage under the policy for the ransomware event.
A copy of the EMOI Services, LLC v. Owners Insurance Co., No. 2021-1529, 2022 WL 17905839 (Ohio Dec. 27, 2022) decision is available here.
The post No Direct Physical Damage, No Coverage For A Ransomware Event Under A Business Owners Policy appeared first on CIPA.