(Article from Insurance Law Alert, March 2022)
For more information, please visit the Insurance Law Alert Resource Center.
Our November 2021 Alert reported on an Ohio appellate court decision which held that issues of fact existed as to whether a ransomware attack on a policyholder’s computer system triggered coverage under a business owner’s policy. EMOI Services, LLC v. Owners Ins. Co., 180 N.E.3d 683 (Ohio Ct. App. 2021). When EMOI was the victim of a ransomware attack, it paid the hacker and then sought coverage from Owners. The insurer denied coverage, noting that a Data Compromise endorsement explicitly precluded coverage for ransomware payments and that an Electronic Equipment endorsement did not apply because it required “direct physical loss or damage.” A trial court agreed and dismissed the suit. The trial court reasoned that there was no physical loss because, even assuming that EMOI’s software was damaged while it was encrypted by the hackers, it became fully functional once the ransom payment was made.
An appellate court reversed, noting that the Electronic Equipment endorsement covered “direct physical loss of or damage to ‘media’” and defined “media” as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards,” including “computer software and reproduction of data contained on covered media.” Viewing the evidence in a light most favorable to EMOI, the appellate court ruled that computer servers may be “media” under the policy because they “constituted materials on which EMOI’s information was recorded.” The appellate court also ruled that EMOI had raised an issue of fact as to whether its software incurred “direct physical damage” because the record established that portions of the software remained unusable even after decryption.
This month, the Ohio Supreme Court agreed to review the appellate court decision. We will keep you apprised of developments in this matter.