An Ohio appellate court held last month that a cyberattack triggered coverage under a commercial property insurance policy in the case EMOI Services, LLC v. Owners Insurance Company, No. 29128, 2021 WL 5144828 (Ohio Ct. App. Nov. 5, 2021).  This is good news for policyholders in light of widespread cyberattacks over the last two years, and rising premiums in today’s cyber insurance markets. The decision also has wider implications, including in suits seeking coverage for losses caused by COVID-19 under property insurance policies.

Summary

Hackers encrypted all the files on EMOI’s computer system, making them inaccessible to EMOI employees. The hackers demanded a payment of three bitcoins (approximately $35,000 at the time) in exchange for decrypting the files. EMOI paid the ransom, and the hackers provided a key to decrypt the files. EMOI regained access to most of its files but was unable to decrypt some files and its automated phone system. EMOI then transitioned to a new domain with better security, but this change caused problems because the various software systems that EMOI used could no longer communicate with each other.

EMOI filed suit to enforce its property insurance coverage after the insurer, Owners Insurance, denied the claim. The county court granted Owners’ motion for summary judgment, and EMOI appealed. The appellate court reversed and held that the policy covered EMOI’s loss.

EMOI argued that it was entitled to coverage under the policy’s Electronic Equipment endorsement, which read, “we will pay for direct physical loss of or damage to ‘media’ which you own.” Owners disputed that EMOI’s server suffered physical loss or damage. The court disagreed, finding that the “incursion” into the computer system did cause physical loss or damage. EMOI, 2021 WL 5144828, at *8. Citing testimony from EMOI’s IT manager describing the hack, the court explained that “encryption damaged EMOI’s data and software, and that the damage was not merely aesthetic or amounted to loss of use.” Id. at *9. Owners cited several cases that, it said, showed that the policyholder must show some kind of structural damage to “tangible” property. However, focusing, as required, on the specific policy language at issue, the court distinguished those cases on the ground that the policy language at issue was not the same as that analyzed in the cases cited by Owners. Id. at *8.

Implication for Cyberattacks

The court’s decision is obviously good news for policyholders who suffer cyberattacks. Policyholders can bolster their claims by putting forward evidence showing how exactly their computer systems were damaged. There is more likely to be physical loss or damage if hackers changed the computer system to prevent the policyholder from accessing it, compared to merely stealing information.

The court rejected Ward General Ins. Services, Inc. v. Employers Fire Ins. Co., 114 Cal. App. 4th 548 (2003), a favorite of insurance companies. In that case, human error caused the policyholder’s computer database to crash and all its electronically stored data was lost. The Ward court said that there was no physical loss or damage because “information” does not “have a material existence,” and the policyholder “did not lose the tangible material of the storage medium.” Ward, 114 Cal. App. 4th at 556. In contrast, the EMOI court found that EMOI’s policy “contemplated that EMOI’s software and reproduction of data was capable of being physically damaged” because it included the Electronic Equipment endorsement.

As always, the precise policy language at issue will control, so policyholders should carefully read their policies to determine the extent of coverage. Property insurance, once silent on “cyber coverage,” in recent years have begun to explicitly address it. Some property insurance policies include affirmative cyber coverage, sometimes with lower sublimits or separate deductibles, but others explicitly exclude coverage for cyberattacks. As a result, businesses should analyze the policies forms offered carefully, with the aid of experienced advisors, and obtain insurance tailored to cover the cyber risks faced by the company.

Implication for Other Property Claims

The court’s decision also may support claims for coverage for losses stemming from the COVID-19 pandemic. The court recognized that an “incursion” onto covered property can give rise to a claim. The presence of COVID-19 or another virus that renders the property unusable is also an incursion and, under the EMOI analysis, should give rise to coverage. The dissent would have denied coverage based on the reasoning in Santo’s Italian Café LLC v. Acuity Insurance Co., 15 F.4th 398 (6th Cir. 2021), which held that there is no coverage for losses caused by government orders closing businesses in response to the COVID-19 pandemic. EMOI, 2021 WL 5144828, at *13 (Tucker, J., dissenting). The majority opinion distinguished the case at hand from Santos and other COVID-19 cases cited on the basis that EMOI’s claim sought coverage for more than “loss of use.” Id. at *8. On a proper analysis, Santo’s Café involved only allegations that the policyholder’s loss was caused by government orders, and that COVID-19 was not actually present on the policyholder’s property. 15 F.4th at 402. In considering such cases, it is important to note decisions by other courts upholding coverage when the policyholder pleads that a virus was actually present on the policyholder’s property. This is in accord with the EMOI court’s “incursion” rule.

The court also correctly rejected the insurer’s contention that coverage can apply only if there is some kind of a “structural alteration” to “tangible property,” as the insurer characterized it. Unfortunately, many courts have recently accepted this argument even though the “physical [or ‘structural’] alteration” standard was invented whole cloth by a treatise and did not, before COVID-19, represent some kind of “widely held rule.” Although the court did not directly address the insurer’s “structural alteration” argument, it noted that the policy at issue does not include the word “tangible” and the standard advocated by the insurer does not apply to this policy. The court’s rejection of Ward, which rejected coverage under facts which the court there concluded did not constitute “physical damage to tangible property,” further underscores that the insurer’s argument in EMOI focusing on the word “tangible” is the wrong standard.