Payment and Costs Associated with Ransomware Attack Are Not Covered by Policy Requiring Direct Physical Loss or Damage

December 2022 • Source: Gary L. Nicholson, Gallagher Sharp LLP

In EMOI Servs., L.L.C. v. Owners Ins. Co., 2022-Ohio-4649, the Supreme Court of Ohio reinstated the grant of summary judgment in favor of an insurer relative to a claim by an insured for a ransomware attack. In particular, the Supreme Court concluded that ransom payment and costs associated with investigating and remediating the ransomware attack and upgrading its security systems were not covered by an electronic equipment endorsement in the insured’s business owners insurance policy. In so doing, the Supreme Court rejected the lower appellate court’s conclusion that such payment and costs may be covered absent any damage to hardware. Focusing on the language of the endorsement, the Supreme Court found that it clearly and unambiguously required that there be direct physical loss of, or direct physical damage to, electronic equipment or media.

The Supreme Court noted that all examples of covered media in the definition section of the endorsement were materials of a physical nature, i.e., “film, magnetic tape, paper tape, disks, drums, and cards”; and that “computer software” was included within the endorsement’s definition of “media” only insofar as it was “contained on covered media”. The Supreme Court held that the most natural reading of “direct physical loss of or damage to” in the endorsement therefore was that the insured was covered “for direct physical loss of its media and insured for direct physical damage to its media”; and that computer software could not experience “direct physical loss or physical damage” because it does not have a physical existence. (Emphasis in original.) Software is essentially nothing more than a set of instructions that a computer follows to perform specific tasks.