Ohio Supreme Court Rules No Coverage For Ransomware Attack Under BOP Policy Because Computer Software Sustained No Direct Physical Damage

The Ohio Supreme Court waited until the last week of the year to issue what may be the most important silent coverage decision of 2022. Direct physical injury is a fundamental requirement of first-party property policies. The absence of direct physical loss has produced loss after loss in cases across the country for policyholders in Covid-19 business interruption cases. The absence of direct physical loss also is responsible for the Ohio high court's ruling that the policyholder is not entitled to coverage for a ransomware attack.

In EMOI Servs., L.L.C. v. Owners Ins. Co., Slip Opinion No. 2022-Ohio-4649 (Ohio Dec. 27, 2022), the Ohio Supreme Court ruled that because a ransomware attack did not cause direct physical loss or damage to software, there was no coverage for the loss. The court reversed the intermediate appellate court's decision and reinstated the trial court's grant of summary judgment in favor of the insurer on the policyholder's breach of contract and bad faith claims. 

EMOI, a computer-software company for medical offices, was the target of a ransomware attack in September 2019 when an unknown "hacker" illegally gained access to EMOI's computer systems and encrypted files needed for using its software and database systems. As a result of the attack, when a computer file was opened, a ransom note appeared notifying the user that the files were encrypted but that the files could be restored to normal by a decryption key the hacker would provide in exchange for the payment of three bitcoins—which was valued at approximately $35,000 at the time. EMOI paid the ransom. After making payment, EMOI received an email from the hacker with a link to download a program to decrypt the files. Most system files returned to normal following the decryption process, but one automated phone system did not. There was no hardware or equipment damage due to the ransomware attack. EMOI upgraded its software systems and took other steps to protect its systems from future attacks.

EMOI was insured under a businessowners insurance policy (BOP) issued by Owners. Owners denied the claim. First, it advised EMOI that the data-compromise endorsement excluded coverage for "any threat, extortion or blackmail," including but not limited to "ransom payments." Second, Owners maintained the electronic-equipment endorsement did not apply because of the absence of direct physical loss.

The electronic-equipment endorsement at issue provides:

[w]e will pay for direct physical loss of or damage to "media" which you own, which is leased or rented to you or which is in your care, custody or control while located at the premises described in the Declarations. We will pay for your costs to research, replace or restore information on "media" which has incurred direct physical loss or damage by a Covered Cause of Loss. Direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.

The electronic-equipment endorsement defines "media" as "materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards." The definition section further states that "media" includes "computer software and reproduction of data contained on covered media.

EMOI instituted a coverage action. The trial court granted summary judgment to Owners, concluding "this is a data compromise situation rather than a situation involving physical damage to electronic equipment." The appellate court reversed, ruling that the language of the electronic-equipment endorsement potentially applied to EMOI's claim if EMOI could prove that its media (software) was in fact, damaged by the encryption. The appellate court determined that genuine issues of material fact existed as to whether there was actual damage to the software based on the affidavits and deposition transcripts submitted by EMOI in its brief in opposition to Owners' motion for summary judgment. The appellate court also noted that EMOI submitted expert testimony indicating that Owners did not thoroughly review EMOI's claim that the software was damaged before it denied the claim and concluded that there were genuine issues of material fact whether Owners honored its duty of good faith.  

The Ohio Supreme Court accepted the appeal and noted the BOP requires "direct physical loss of or damage to" property and, therefore, does not cover losses from a ransomware attack. It recognized a court cannot read ransomware coverage into a BOP by reading key policy requirements out.

According to the court:

We find the language in the electronic-equipment endorsement to be clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment or media before the endorsement is applicable. Since software is an intangible item that cannot experience direct physical loss or direct physical damage, the endorsement does not apply in this case. . . The most natural reading of the phrase "direct physical loss of or damage to" is that EMOI is insured for direct physical loss of its media and insured for direct physical damage to its media. See Ward Gen. Ins. Servs., Inc. v. Emps. Fire Ins. Co., 114 Cal.App.4th 548, 554, 7 Cal.Rptr.3d 844 (2003) (construing the phrase "direct physical loss of or damage to" to require direct physical damage, as opposed to indirect or nonphysical damage, to the covered property, because "[m]ost readers expect the first adjective in a series of nouns or phrases to modify each noun or phrase in the following series unless another adjective appears"); see also Santo's Italian Café, L.L.C. v. Acuity Ins. Co., 15 F.4th 398, 402 (6th Cir.2021) (construing identical language as containing a requirement of "direct physical loss" or "direct physical damage" to the covered property). In other words, the adjectives "direct" and "physical" modify both "loss" and "damage." Accord Kingray, Inc. v. Farmers Group, Inc., 523 F.Supp.3d 1163, 1173 (C.D.Cal.2021). Similarly, although the term "computer software" is included within the definition of "media," it is included only insofar as the software is "contained on covered media." We hold that "covered media" means media that has a physical existence. Indeed, all examples of covered media in the definition section are materials of a physical nature, i.e., "film, magnetic tape, paper tape, disks, drums, and cards." And we also hold that the policy requires that there must be direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy.

The Ohio Supreme Court reversed the intermediate appellate court and reinstated the trial court's grant of summary judgment in favor of Owners on EMOI's breach of contract and bad faith claims.