Before the new year, the Ohio Supreme Court sided with Auto Owners Insurance Company, clarifying that the insurer is not on the hook for ransomware attacks when filed under a Business Owners Policy.
The case came to the Court after an unknown hacker seized access to data and systems of EMOI Services, LLC., a that company provides medical offices with service and support for setting appointments, record keeping, and billing. The hacker demanded three bitcoins, a cryptocurrency worth about $35,000 for the return of the data.
EMOI paid the ransom in order to unencrypt their files, and subsequently filed an insurance claim with Auto Owners. The insurance company determined that EMOI’s policy did not cover payment of the ransom and costs associated with the attack, including upgrading their security systems. EMOI then filed a lawsuit against Auto Owners alleging the denial of coverage breached their insurance policy.
The case made its way to the Ohio Supreme Court, where the justices focused their review on whether the protection against “direct physical loss of or damage to property” includes losses incurred via threats to a product like data, as opposed to damage to physical hardware, such as a computer.
The court, unanimously reversed an appellate court decision, ruling that software is an “intangible item” which cannot experience direct physical loss or damage.
In the decision, Justice Melody Stewart wrote, “We find the language in the electronic-equipment endorsement to be clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment or media before the endorsement is applicable”
“Since software is an intangible item that cannot experience direct physical loss or direct physical damage, the endorsement does not apply in this case…a computer or other electronic medium has physical electronic components that are tangible in nature, the information stored there has no physical presence.”
Justice Stewart further wrote, “Software is essentially nothing more than a set of instructions that a computer follows to perform specific tasks,” she wrote.
This decision is consistent with the ruling from the Ohio Supreme Court on the COVID Business Interruption claims filed against insurers by business owners. In the Neuro Communications case decided in December 2022, the Court again turned to the lack of “direct physical loss of or damage to property” from the virus and therefore was not an insurable claim.
OIA tracks all insurance litigation that makes it to the Supreme Court and occasionally weighs in with amicus briefs (friend of the court). We will keep you posted as more decisions impacting your clients, insurance coverages and insurance companies are decided. For more information on this ruling and more, please reach out to OIA’s Government Affairs team, Lauren Reid at lauren@ohioinsuranceagents.com and Jeff Smith at jeff@ohioinsuranceagents.com.
