We hope you had a cybersafe holiday!  Ransomware continues to pose a cyberthreat. The Ohio Supreme Court recently reversed a decision of the Second District Court of Appeals in its decision EMOI Services, L.L.C. v. Owners Insurance Company, Slip Opinion No. 2022-Ohio-4649, holding that a businessowners insurance policy did not cover losses which resulted from a ransomware attack on the computer-software systems of the policyholder.

EMOI is a computer-software company that provides medical offices with appointment, record keeping and billing services and support. It experienced a ransomware attack when a hacker illegally accessed its computer systems and encrypted its files. After assessing options to recover the files that were held hostage, EMOI elected to pay the ransom of three bitcoins (valued at approximately $35,000). The decryption key given in exchange for the ransom restored access to a majority of the files in question. No hardware or equipment damage occurred as a result of the ransomware attack. After the attack, EMOI upgraded its software systems and implemented steps to protect from future attacks.

EMOI filed an insurance claim within a day of the attack seeking reimbursement of the paid ransom, the costs of investigating and remediating the attack, and costs to upgrade its security systems. The claim was denied by its insurer based on a “Data Compromise” endorsement which excluded coverage for “any threat, extortion or blackmail” including but not limited to “ransom payments.” The denial was also based on an “Electronic Equipment” endorsement which required direct physical loss or damage to covered property caused by a covered cause of loss.

In its analysis, the Supreme Court stated that the case turned on a legal interpretation of the electronic-equipment endorsement. The Court found the language in the endorsement to be clear and unambiguous in the requirement that there be a direct physical loss of, or direct physical damage to, electronic equipment or media before coverage is applicable.

The Court stated that since software is an intangible item that cannot experience direct physical loss, the endorsement did not apply to provide coverage. In response to the argument that computer software was “media” covered under the policy which could be damaged despite nonphysical damage, the Court held that “covered media” under the policy means media that has a physical existence. The Court also held that the policy required that there must be direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy.