Ransomware Attack Results in Covered Physical Loss or Damage

As cyberattacks increase and coverage lawsuits make their way through the judicial system, policyholders have increasingly asked courts to broadly construe policy language to provide coverage for such events. In January 2020, a federal district court in Maryland found that the loss of data and software, as well as impaired functionality of a computer system due to a ransomware attack, qualified as direct physical loss or damage under a businessowners policy.¹ It remains to be seen whether the insurer will appeal the novel ruling and if other courts will follow suit.

National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Company

At issue in this coverage dispute was whether the insured had experienced “direct physical loss of or damage” to its computer system following a ransomware attack. The insured, National Ink and Stitch, operated an embroidery and screen-printing business that used a computer server to store art and designs for its products, as well as different types of software.

In December 2016, National Ink’s server and network computers were subject to a ransomware attack that blocked the insured’s access to data on the server and most of the software programs. The hacker demanded payment in exchange for releasing the software and data. After receiving payment, however, the hacker refused to release the system and demanded more. National Ink hired a security company to replace the original software and install protective software that resulted in a slower and less efficient system. Despite these efforts, a residual, dormant ransomware virus likely remained in the system. Given the risk of further infection, National Ink purchased an entirely new server and related components.

National Ink brought a claim under its businessowners policy with State Auto Property and Casualty Company for the cost of replacing its computer system. The policy provided coverage for “direct physical loss of or damage to Covered Property . . . caused by or resulting from any Covered Cause of Loss.” The policy also included a Special Form Computer Coverage Endorsement that defined “Covered Property” to include “Electronic Media and Records (Including Software). This endorsement further defined “Electronic Media and Records” as:

(a)   Electronic data processing, recording, or storage media such as films, tapes, discs, drums or cells; and

(b)   Data stored on such media.²

State Auto denied the claim on the basis that National Ink did not experience “direct physical loss” to covered property. State Auto reasoned that National Ink could still operate its computer system and had only lost data, an intangible asset. National Ink argued that: (1) the policy language includes data and computer software as property that may be subject to “direct physical loss,” and (2) the computer system itself was damaged by the loss of functionality.

The district court granted National Ink’s motion for summary judgment, finding that the policy did not limit coverage to “tangible property” and instead “contemplates that data and software are covered and can experience ‘direct physical loss or damage.’”³ Separately, the court rejected State Auto’s argument that the repaired computer system was not damaged because it continued to function, noting that the policy language covers both “physical loss” and “damage to” the software and data. The court concluded that the impaired functionality of the slower and likely still infected computer system was sufficient, by itself, to trigger coverage under the policy.⁴

Why It Matters

Ransomware attacks are on the rise and increasingly target organizations and municipalities, causing widespread and substantial damage. According to a report from Cybersecurity Ventures, the estimated damage from ransomware attacks was to exceed $11.5 billion in 2019.⁵  A “Cyber Threat Landscape Report” by Deep Instinct found that the average estimated cost of an attack was $141,000, a substantial increase from the $46,800 average in 2018.⁶ As reported by the New York Times, the FBI’s Cybersection Chief views ransomware attacks as “one of the most serious cybercriminal problems we face right now.”⁷

Against this backdrop, policyholders may increasingly seek coverage following ransomware attacks under policies that were not intended to provide such coverage. Depending on the circumstances, insureds may view National Ink as providing a path forward for their claims. It remains to be seen whether State Auto will appeal and if other courts will find the decision compelling and follow suit. The opinion may, however, be limited in its application given the specific language in the policy’s computer coverage endorsement.