Ohio Supreme Court Rules on Silent Cyber Coverage Case Under First Party Property Policy

On December 27, 2022, the Supreme Court of Ohio found that a property insurance policy requiring “direct physical loss of or damage to” property does not cover a ransomware attack where malware infects the insured’s computer and prevents the insured from accessing stored files and data. EMOI Services, LLC v. Owners Ins. Co., 2022-Ohio-4649 (Ohio Dec. 27, 2022) (PDF).

EMOI is a computer software company that was the victim of a ransomware attack on September 12, 2019. The hacker gained access to EMOI’s systems, encrypted its files, and left a ransom note demanding three bitcoins (valued at approximately $35,000.00 at the time) in exchange for the decryption key. EMOI paid the ransom and received the key. The key restored all but one phone system to normal function. Notably, the ransomware event did not physically damage EMOI’s hardware (i.e., computers, phones, and related tangible systems).
The Supreme Court of Ohio found the policy’s electronic-equipment endorsement to be unambiguous and determinative of coverage. The endorsement stated:

When a limit of insurance is shown in the Declarations under ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct physical loss of or damage to “media” which you own, which is leased or rented to you or which is in your care, custody or control while located at the premises described in the Declarations. We will pay for your costs to research, replace or restore information on “media” which has incurred direct physical loss or damage by a Covered Cause of Loss.

Direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.

The applicable policy further defined “media” as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards” and includes “computer software and reproduction of data contained on covered media”.

The court reasoned that software can be contained within “media,” but is an intangible item incapable of experiencing a direct physical loss. Accordingly, the policy provided no potential coverage for computer software damage without “physical damage” to the hardware containing the software.

Because the policy at issue only offered coverage for “direct physical loss or damage,” and computer software is incapable of physical damage, the Ohio Supreme Court reversed the appellate court and reinstated summary judgment in favor of the insurer on EMOI’s claims for breach of contract and bad-faith denial of coverage.

This decision is particularly important to insurers, as it shows that courts may not be willing to read “silent cyber” liability into a standard first party property policy.  Walker Wilcox will continue to monitor similar decisions.