(Article from Insurance Law Alert, January 2020)
For more information, please visit the Insurance Law Alert Resource Center.
A Maryland federal district court ruled that the loss of data and impairment of a computer system resulting from a ransomware attack constituted “direct physical loss” under a businessowner’s policy. Nat’l Ink & Stitch, LLC v. State Auto Prop. & Cas. Ins. Co., 2020 WL 374460 (D. Md. Jan. 23, 2020).
National Ink, an embroidery and screen printing business, was the victim of a ransomware attack that prevented the company from accessing its art files, server data and software programs. National Ink hired a security company to replace and reinstall its software, along with new protective measures, on its computer system. Thereafter, although the computers still functioned, computer processing was slower, resulting in a loss of efficiency. In addition, art files could not be retrieved. The security company opined that remnants of the virus could potentially re-infect the system and that purchasing an entirely new system would eliminate that risk.
National Ink filed a claim with State Farm for replacement of the entire computer system. State Farm denied coverage, arguing that there was no “direct physical loss or damage,” as required by the policy. More specifically, State Farm claimed that because National Ink only lost data, an intangible asset, and could still use its computer system, there was no physical loss. The court disagreed and granted National Ink’s summary judgment motion.
The policy covers “direct physical loss of or damage to Covered Property,” which is defined to include “Electronic Media and Records (Including Software).” Electronic Media and Records, in turn, is defined to specifically include: “(a) Electronic data processing, recording, or storage media such as films, tapes, discs, drums or cells; [and] (b) Data stored on such media.” The court concluded that this language squarely placed National Ink’s loss of data and software within the scope of coverage. In addition, the court ruled that the loss of efficiency to and reliability of the computer system constituted covered damage, notwithstanding that the computer was still operable. Rejecting State Farm’s assertion that physical loss requires an “utter inability to function,” the court stated that “[t]he policy language, and the relevant case law, impose no such prerequisite.”