Ohio Supreme Court Upholds Denial of Coverage for Ransomware Attack Losses

The Ohio Supreme Court recently reversed the decision of an appellate court and reinstated the trial court’s grant of summary judgment in favor of an insurer and against an insured company on the company’s claim for breach of contract and bad faith denial of insurance coverage relating to damages arising from a ransomware attack.

In so ruling, the Ohio Supreme Court held that because a ransomware attack caused no “direct physical loss of or damage to” the company’s software — a requirement for coverage under the policy at issue — the insurer was not responsible for covering the resulting loss.

A copy of the opinion in EMOI Servs., L.L.C. v. Owners Ins. Co. is available at: Link to Opinion.

As background, the insured company became the target of a ransomware attack when a hacker illegally gained access to the company’s computer systems and encrypted files needed for using its software and database systems. After looking into the timing and financial feasibility of recovering the files through the assistance of a third-party company, the insured company decided to pay the ransom.

At the time of the ransomware attack, the company was insured under a businessowners insurance policy issued by the defendant insurer. Thus, the insured company’s general manager contacted the insurer to file an insurance claim within a day of the attack. However, the insurer denied coverage because, among other reasons, there was no “direct physical loss of or damage to ‘media’,” as defined in the electronic-equipment endorsement in the policy.

The policy’s electronic-equipment endorsement provided:

When a limit of insurance is shown in the Declarations under ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct physical loss of or damage to “media” which you own, which is leased or rented to you or which is in your care, custody or control while located at the premises described in the Declarations. We will pay for your costs to research, replace or restore information on “media” which has incurred direct physical loss or damage by a Covered Cause of Loss. Direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.

Furthermore, the…