Ohio Supreme Court Finds Insured’s Ransomware Payment Not Covered Under Business Owners Policy

In EMOI Services LLC v. Owners Insurance Co., No. 2021-1529 (Ohio Dec. 27, 2022), the Ohio Supreme Court found that there was no coverage for a ransomware attack because there was no direct physical loss as required under the business owners insurance policy, reinstating the trial court’s summary judgment ruling in favor of the insurer.

The insured, a computer software company whose software provided certain administrative services for medical offices, was a victim of a ransomware attack that targeted the insured’s computer systems and files. The hacker encrypted the insured’s files, promising to restore them after payment of three bitcoin, the equivalent of $35,000 at that time. Upon the insured’s payment of the ransom, the majority of the files were restored as promised, but at least one phone software system remained encrypted because of the hacker’s error. The insured tendered the claim under its business owners insurance policy.

In denying coverage, the insurer identified two potentially applicable policy provisions, but ultimately concluded that neither applied to provide coverage. The first provision — the data-compromise endorsement — very plainly excluded coverage for “ransom payments.” The second provision — the electronic-equipment endorsement — provided coverage only for direct physical loss or damage to media. Because there was no direct physical loss to the phone software system, rather the system was simply inaccessible due to encryption, the insurer concluded that there was no coverage.

The insured instituted a coverage action. The trial court granted the insurer’s motion for summary judgment based on its coverage determination, but the appeals court reversed, finding that a genuine issue of material fact existed as to whether there was actual damage to the software under the language of the electronic equipment endorsement. In reinstating the trial court’s decision, the Ohio Supreme Court began by relying on one of the most basic tenants of contract interpretation — when contractual language is clear, courts will look “no further than the writing itself to determine the parties’ intent.” The court then found the language of the electronic equipment endorsement “to be clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment or media before the endorsement is applicable.” Turning to “[t]he most natural reading of the phrase 'direct physical loss of or damage to,'” the court held that “'direct' and 'physical' modify both 'loss' and 'damage.'” As such, there could be no coverage because “[c]omputer software cannot experience 'direct physical loss or physical damage' because it does not have a physical existence.”