Ohio Supreme Court: Ransomware Did Not Cause Direct Physical Loss

A business owner’s insurance policy did not provide coverage for software damaged by a ransomware attack because there was no direct physical damage or loss, the Ohio Supreme Court ruled.

“Computer software cannot experience ‘direct physical loss or physical damage’ because it does not have a physical existence,” the high court’s unanimous opinion says.

It was the second time this month that the Ohio Supreme Court decided that a direct physical damage or loss cannot be intangible. On Dec. 12, the high court ruled against an audiology practice that sought coverage for business income lost because of a shutdown ordered by the state to slow the spread of COVID-19.

“It’s a big one,” said Michael Farley, vice president of governmental affairs and general counsel for the Ohio Insurance Institute. “You couldn’t ask for a better decision.”

EMOI Services, based in Kettering, Ohio, provides software to medical offices for scheduling appointments, recordkeeping and billing. In September 2019, a hacker gained access to the company’s computer system, encrypted files and demanded ransom in the amount of three bitcoins, worth about $35,000 at the time.

EMOI hired a vendor and attempted to debug its system, but eventually decided it was more cost effective to pay the ransom. After the payment was made, the hacker provided EMOI with a decryption key that restored access to most of its data. Its automated telephone system remained encrypted, however, because it was connected to a separate server. The company also lost access to some non-critical files.

EMOI filed a claim against its business owners policy with Owners Insurance Co. The insurer denied the claim, contending that there was no “direct physical loss to media” that was covered by the insurance policy. EMOI filed a lawsuit.

The Court of Common Pleas in Montgomery County ruled that there was no coverage available through either the data compromise endorsement orelectronic equipment endorsement in EMOI’s insurance policy. The data compromise endorsement excludes costs caused by extortion or deficient network security, the court said. The electronic equipment endorsement covered only direct physical loss or damage to media, defined as material on which data is recorded such as “film, magnetic tape, paper tape, disks, drums or cards.”

Topics Cyber Profit Loss Ohio