Cyberattack Damage Is Not Covered Rules Ohio Supreme Court

Last week, the Ohio Supreme Court ruled EMOI Services, LLC v. Owners Ins., 2022 WL 17905839 (Ohio, December 27, 2022) states that policyholders have not suffered direct physical loss or damage to computer media that has been encrypted and rendered unusable. increase. Although the policy defined “media” to include “computer software,” the Supreme Court ruled, concluding that software has no “physical existence.” Supreme Court ruling overturns previous Ohio Court of Appeals ruling that cyberattacks caused coverage under commercial property insurance policies and builds on distinct ruling in COVID-19 business interruption case . Santo’s Italian Café, LLC vs. Acuity Ins.15 F.4th 398, 402 (6th Cir. 2021), Sixth Circuit Court held that government orders issued in response to the COVID-19 pandemic did not physically alter insured assets. discovered.

The appeal is against EMOI’s breach of contract and its insurer, Owners Insurance, after the Owners refused to compensate EMOI for the losses it suffered when it was forced to replace its telephony system following a ransomware attack. Arose out of dishonest lawsuits. The issue of appeal applies to a business property policy that includes compensation for “direct physical loss or damage to ‘media'” that explicitly defines “media” to include “computer software.” However, the only impact on the insured was that the system could not decrypt the system after receiving the decryption key.^[1] Despite the policy’s clear definition of “media,” on the side of insurers, the court held that software is an intangible item incapable of direct physical loss or damage. I judged.

The court held that the “most natural reading” of “direct physical loss or damage” is that the policy is insured against direct physical loss of media and direct physical damage to media. Regarding the inclusion of “computer software” in the definition of “media,” the Court reasoned that “while the term “computer software” is included in the definition of “media,” Said it’s included only if it’s included.upon Target media‘” (emphasis in original). To justify this claim, the court pointed to examples of covered media from the Policy’s Definitions section. These are all materials of a physical nature. Therefore, the court held that there must be physical loss or physical damage to the covered media containing the computer software for the software to be included in the policy.

The Ohio Supreme Court is the first state superior court to rely on an inherently flawed court.^[2] Decisions from COVID-19 business interruption litigation to denial of coverage for non-COVID-19 insurance losses. Given the prevalence of these decisions, policyholders should take extra care to prevent their use in other circumstances. emoi, And be prepared to exploit their flawed foundations and differentiate their narrow fact-specific holdings. We navigate these issues to ensure that coverage is provided in a manner consistent with the policy language and the parties’ expectations of coverage.

footnote

^[1] The Ohio Supreme Court reversed its ruling on the first issue, so reading the main ransomware exclusion raised the second issue of whether courts could read ransomware coverage into a business owner’s all-risk property policy. was not analyzed. A third issue concerns expert requirements for determining coverage or avoiding bad faith claims and is irrelevant for the purposes of this discussion.

^[2] for example, Richard P. Lewis, Laurelie S. Masters, etc. The Couch “Physical Change” Fallacy: Its Origins and Consequences, 56 Tort Trial and Ins. Practice Law J. 621, 622 (2021); Greg Gottwald & Michael S. Levine, COVID sins in the insurance industryLaw.com (December 14, 2022).