(Article from Insurance Law Alert, April 2021)
For more information, please visit the Insurance Law Alert Resource Center.
The Indiana Supreme Court reversed an appellate court decision that granted an insurer’s summary judgment motion, holding that issues of fact existed as to whether the policyholder’s ransomware payment was covered under a commercial policy’s Computer Fraud provision. G&G Oil Co. of Indiana, Inc. v. Continental Western Ins. Co., 165 N.E.3d 82 (Ind. 2021).
G&G Oil, the victim of a ransomware attack, paid approximately $35,000 to regain access to its computer systems. Continental denied coverage for the loss, noting that G&G Oil declined computer hacking coverage. G&G Oil sued Continental and the parties cross-moved for summary judgment. The trial court granted Continental’s motion and an appellate court affirmed. (See April 2020 Alert). The Indiana Supreme Court reversed.
The Computer Fraud provision covered loss “resulting directly from the use of any computer to fraudulently cause a transfer of that property.” The Indiana Supreme Court ruled that “fraudulently cause a transfer” was unambiguous and means “to obtain by trick.” Applying this interpretation, the court held that factual disputes existed as to whether G&G Oil’s computer systems were accessed “by trick.” While G&G Oil alleged that a targeted spear-phishing email was the source of attack, the factual record was not conclusive as to the manner in which the hackers obtained access to the company’s computer system. As such, the court ruled that summary judgment was inappropriate.
Furthermore, the court held that factual issues existed as to whether G&G Oil’s losses “resulted directly from the use of a computer.” The Indiana Supreme Court held that the trial court erred in ruling as a matter of law that G&G Oil’s voluntary payment of ransom was an intervening cause that severed the causal chain of events. Instead, the Indiana Supreme Court held that “resulting directly” requires loss that resulted either “immediately or proximately without significant deviation from the use of a computer” and that G&G Oil’s loss satisfied that standard.