The Matrix

Details on the appellate court decision can be found here.

The Ohio Supreme Court disagreed with the appellate court.  In holding that the “Electronic Equipment” endorsement did not provide coverage for the insured’s losses following a ransomware attack, the court focused on the policy’s “direct physical loss or damage” language.  The court concluded that “[s]ince software is an intangible item that cannot experience direct physical loss or direct physical damage, the endorsement does not apply in this case.”  The court further explained that, in its opinion, “computer software cannot experience ‘direct physical loss or physical damage’ because it does not have a physical existence.” 

The holding in EMOI Services parts with decisions from other courts which have held that data and software “can experience ‘direct physical loss or damage.’”  See, e.g., Natl. Ink and Stitch, LLC v. State Auto Property and Cas. Ins. Co., 435 F.Supp.3d 679 (D. Md. 2020) (the “more persuasive cases are those suggesting that loss of use, loss of reliability, or impaired functionality demonstrate the required damage to a computer system, consistent with the ‘physical loss or damage to’ language in the Policy.”).  See also Landmark Am. Ins. Co. v. Gulf Coast Analytical Laboratories, Inc., CIV.A. 10-809, 2012 WL 1094761, at *4 (M.D. La. Mar. 30, 2012) (because electronic data “has physical existence, takes up space on the tape, disc, or hard drive, makes physical things happen, and can be perceived by the senses,” electronic data is susceptible to “’direct, physical loss or damage.’”).

Even after the EMOI Services decision, policyholders should still carefully review and consider their property, liability, crime and other “traditional” policies in the event of a cyber-incident, and provide notice under those non-cyber policies to ensure that all avenues for potential coverage are exhausted.