Ohio Supreme Court Finds That Insurance Policy Does Not Cover Ransomware Attack, As Computer Software Cannot Experience Direct Physical Loss Or Physical Damage Required Due To The Lack Of A Physical Existence.
In a December 27, 2022 decision, the Ohio Supreme Court, in EMOI Servs., L.L.C. v. Owners Ins. Co., Slip Opinion No. 2022-Ohio-4649, issued a ruling that a businessowners insurance policy does not cover losses that resulted from a ransomware attack on computer software systems. The Ohio Supreme Court found that such a ransomware attack causes no “direct physical loss of or damage to” the software, which is required for coverage under the policy.
There, EMOI, a computer software company that develops software to provide medical offices with service and support to set appointments, keep records, and track billing, became a target of a ransomware attack when a hacker gained access to EMOI’s system and encrypted certain files. The hacker demanded payment of three bitcoins – worth $35,000 at the time – in exchange for a decryption key. EMOI submitted the loss to its insurer, Owners Insurance Company, after EMOI paid the ransom.
The Owners insurance policy included an Electronic-Equipment Endorsement that provided coverage for direct physical loss of or damage to “media” owned by EMOI, as well as the costs to research, replace, or restore information on “media” that incurred direct physical loss or damage. The policy defined “media” to include “computer software and reproduction of data contained on covered media.”
The Court concluded that “software is an intangible item” and it “cannot experience direct physical loss or direct physical damage,” such that the businessowners policy’s Electronic-Equipment Endorsement did not apply. The Ohio Supreme Court specifically rejected EMOI’s arguments that computer software was “media” and that the policy contemplated that software can be damaged, despite the fact that it is nonphysical and even where there is no damage to hardware. The Court recognized that, while “computer software” is included in the definition of “media”, it is included “only insofar as the software is ‘contained on covered media.’” (emphasis original).
The Court held that “covered media” means “media that has a physical existence” and “the policy requires that there must be direct physical loss or damage of the covered media containing the computer software for the software to be covered under the policy.” The Court further stated that, since software does not have a physical existence and is “information stored on a computer or other electronic medium,” it is entirely intangible. Thus, Owners owed no coverage under its policy with EMOI for the ransomware attack or any losses associated with it.
This decision follows the recent Ohio Supreme Court decision, in Neuro-Communication Services, Inc. v. Cincinnati Insurance Company, Slip Opinion No. 2022-Ohio-4379. There, the Ohio Supreme Court similarly found the presence of COVID-19 in the community, on or in business surfaces, or in infected people on the business premises, did not constitute “direct physical loss” or “damage to property” necessary to trigger coverage under similar policies. While the direct physical loss or damage provision in the Neuro-Communication case involved property, the Ohio Supreme Court, in EMOI Servs., L.L.C., similarly recognized that the policy there required direct physical loss of or direct physical damage to, electronic equipment or media.
For questions about this decision, please contact Weston Hurd attorney Patrick M. Cannell, 216.687.3331 or pcannell@westonhurd.com.
Ohio Supreme Court Decisions:
EMOI Servs., L.L.C. v. Owners Ins. Co., Slip Opinion No. 2022-Ohio-4649
Neuro-Communication Services, Inc. V Cincinnati Insurance Company, 2022-Ohio-4379
