Reach Of Ohio Ransomware Ruling Limited To Policy At Hand | Zelle LLP

Law360 Insurance Authority
January 19, 2022

To read this article in PDF form, click here.

We are still in the relatively early stages of jurisprudence addressing the insurability of loss stemming from data breaches.

Compared to the more developed body of case law interpreting coverage provisions and exclusions contained in more traditional property insurance policies, case law exploring coverage issues under so-called silent cyber or stand-alone cyber policies is sparse.

As such, when any new decision does come down in this arena, it sparks commentary.

This was true for the recent Ohio appellate court decision in EMOI Services Inc. v. Owners Insurance Co.,[1] in which the Ohio Court of Appeals’ Second Appellate District reversed the common pleas court’s summary judgment ruling in favor of the insurer and allowed the insured’s silent cyber claim to proceed.

The majority’s decision in EMOI has come under fire by the insurance bar for being results- oriented and ignoring precedent. Conversely, policyholder attorneys have lauded the decision, going so far as to claim that EMOI stands for the proposition that a policy insuring physical loss or damage does not require physical alteration of property.

But are these criticisms and characterizations fair? And what lessons can we take from this rare and candid discussion by a court grappling with the bounds of insurance coverage for data loss?

EMOI’s holding was dependent on very specific policy language.

In EMOI, a medical billing company sustained a ransomware attack, paid the ransom, decrypted most of its data and then sued its property insurer for claimed business interruption losses and alleged damage to computer software.

Careful review of the appellate court’s decision in EMOI indicates that its holding was entirely dependent on the unique language of the Owners’ electronic equipment endorsement contained in the policy at issue.

That endorsement covered “direct physical loss of or damage to ‘media,'” where media was defined as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards.”

Importantly, the definition section goes on to state that “media” includes “computer…