Insurance Law Blog
January 17, 2023

Ohio Supreme Court Finds That Ransomware Attack Did Not Result In Direct Physical Loss to Insured’s Software

BY: Jason Taylor

In EMOI Services, LLC v. Owners Ins. Co., 2022-Ohio-4649 (Ohio Dec. 27, 2022), the Ohio Supreme Court was asked to determine whether a businessowners insurance policy issued by Owners Insurance Co. (“Owners”) to EMOI Services, LLC (“EMOI”), covered losses that resulted from a ransomware attack on EMOI’s computer-software systems. Because the ransomware attack caused no “direct physical loss of or damage to” EMOI’s software—a requirement for coverage under the policy—Owners were not responsible for covering the resulting loss.  Accordingly, the Ohio Supreme Court reversed the decision of the Second District and reinstated the trial court’s grant of summary judgment in favor of Owners and against EMOI.

EMOI is a computer-software company that uses software it has developed, along with outside software, to provide medical offices with service and support for setting appointments, record keeping, and billing. On September 12, 2019, EMOI became the target of a ransomware attack when an unknown hacker illegally gained access to EMOI’s computer systems and encrypted files required to use its software and database systems. As a result of the attack, when a file was opened, a ransom note appeared notifying the user that the files were encrypted and therefore unavailable but that the files could be restored to normal by a decryption key the hacker would provide in exchange for the payment of three bitcoins (approximately $35,000 at the time).

EMOI decided to pay the ransom. Upon payment, EMOI received an email from the hacker with a link to download a program that would decrypt the files. A majority of the system files were returned to normal following the decryption process. An automated phone system, however, remained encrypted because the decryption key had not worked on the separate server that attended to that system. No hardware or equipment damage occurred as a result of the ransomware attack.  Following the attack, EMOI upgraded its software systems and took other steps to protect its systems from future attacks.

At the time of the ransomware attack EMOI was insured under a business owners insurance policy issued by Owners. Owners ultimately determined that EMOI’s policy did not cover the type of losses experienced by EMOI—i.e., EMOI’s payment of the ransom, the costs associated with investigating and remediating the attack, and upgrading security systems—and denied the claim the same day it was made.  The carrier identified two potentially applicable provisions in the insurance policy:  a “Data Compromise” endorsement and an “Electronic Equipment” endorsement.

The court’s analysis primarily focused on the “Electronic Equipment” endorsement, which provided that Owners would pay for direct physical loss of or damage to “media” which [EMOI] own[s], which is leased or rented to [EMOI] or which is in [EMOI’s] care, custody or control while located at the premises described in the Declarations. The endorsement also provided that Owners would pay for EMOI’s costs to research, replace or restore information on “media” that has incurred direct physical loss or damage by a Covered Cause of Loss. The appellate court determined that the language of the Electronic Equipment endorsement potentially applied to EMOI’s claim if EMOI could prove that its media, i.e., its software, was in fact damaged by the encryption. The appellate court determined that genuine issues of material fact existed as to whether there was actual damage to the software based on the affidavits and deposition transcripts submitted by EMOI in its brief in opposition to Owners’ motion for summary judgment.

The Ohio Supreme Court reversed, finding the language in the Electronic-Equipment endorsement to be clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment or media before the endorsement applies.  According to the Court, because software is an intangible item that cannot experience direct physical loss or direct physical damage, the endorsement did not apply.  More specifically, the Court noted that the Electronic Equipment endorsement stated that Owners “will pay for direct physical loss of or damage to ‘media’ which [EMOI] own[s].” It also stated that “Direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.”  The Businessowners Special Property Coverage Form attached to the insurance policy also provided that “covered causes of loss” are “risks of direct physical loss.”  

The Court rejected EMOI’s argument that computer software is “media” under the policy and that the policy nevertheless contemplated that software can be damaged, despite that it is nonphysical. EMOI contended that the policy covered damage to its software even when there had been no damage to hardware. The Court disagreed, reasoning that the most natural reading of the phrase “direct physical loss of or damage to” is direct physical loss of EMOI’s media or direct physical damage to its media, as opposed to indirect or non-physical damage to covered property. Similarly, although the term “computer software” was included within the definition of “media,” the Ohio Supreme Court reasoned that it was included only insofar as the software is “contained on covered media.” Thus, “covered media” meant media that has a physical existence.  Indeed, all examples of covered media in the definition section of the Policy were materials of a physical nature, i.e., “film, magnetic tape, paper tape, disks, drums, and cards.” The Court found that computer software cannot experience “direct physical loss or physical damage” because it does not have a physical existence. Software is essentially nothing more than a set of instructions that a computer follows to perform specific tasks.  In other words, the information—the software—is entirely intangible. Accordingly, the Court held that the policy required that there must be direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy.   

Because the insurance policy at issue did not cover the type of loss EMOI experienced, Owners did not breach its contract with EMOI. The Ohio Supreme Court reversed the judgment of the Second District Court of Appeals and reinstated the trial court’s grant of summary judgment in favor of Owners on EMOI’s claim of breach of contract and bad-faith denial of insurance coverage.