Business owners policy doesn’t cover ransomware attack
Reprints
An insurer does not have to provide coverage under a business owners policy for a ransomware attack because there was no physical damage, the Ohio Supreme Court ruled in overturning a lower court decision.
Kettering, Ohio-based EMOI, a medical software company, was the target of a September 2019 ransomware attack, according to Wednesday’s unanimous ruling by the Ohio Supreme Court in EMOI Services LLC v. Owners Insurance Co.
EMOI paid the $35,000 ransom, and most of its system files returned to normal following a decryption process. There was no hardware or equipment damage.
After Lansing, Michigan-based Owners denied coverage, EMOI sued the insurer.
A trial court granted Owners summary judgment but was reversed by a state appeals court, which ruled that an electronic equipment endorsement potentially applied to EMOI’s claim if the company could prove that its software was damaged by the encryption.
The Ohio Supreme Court unanimously overturned the appeals court ruling.
“This case turns on the legal interpretation of the electronic equipment endorsement in EMOI’s business owners insurance policy,” the ruling said.
The language in the endorsement is “clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment or media before the endorsement is applicable,” it said.
“Since software is an intangible item that cannot experience direct physical loss or direct physical damage, the endorsement does not apply in this case,” the high court said, in overturning the state appeals court and ruling in the insurer’s favor.
Attorneys in the case did not respond to requests for comment.
Last month, the Ohio Supreme Court became the eighth state high court to rule that policyholders were not entitled to COVID-19 business interruption coverage, holding there must be physical loss or damage.
