Last week, the Ohio Supreme Court ruled in EMOI Services, L.L.C. v. Owners Ins. Co., 2022 WL 17905839 (Ohio, Dec. 27, 2022), that a policyholder did not suffer direct physical loss of or damage to computer media that was encrypted and rendered unusable.  The Court reached its ruling even though “media” was defined in the policy to include “computer software,” concluding that software does not have a “physical existence.” The Supreme Court’s decision reverses an Ohio appellate court’s earlier ruling that the cyberattack triggered coverage under a commercial property insurance policy and builds upon plainly distinguishable rulings in COVID-19 business interruption cases, such as Santo’s Italian Café, L.L.C. v. Acuity Ins. Co., 15 F.4th 398, 402 (6th Cir. 2021), where the Sixth Circuit found that government orders issued in response to the COVID-19 pandemic did not physically alter insured property.

The appeal arose from EMOI’s breach of contract and bad faith action against its insurer, Owners Insurance, after Owners denied coverage for loss sustained by EMOI when it was forced to replace its telephony systems following a ransomware attack. The issue on appeal was whether a business property policy that included coverage for “direct physical loss of or damage to ‘media’,” applied where the policy specifically defined “media” to include “computer software,” but the only impact on the insured’s systems was its inability to decrypt the systems after receipt of the decryption key.^[1] Siding with the insurer and despite the policy’s clear definition of “media,” the Court found that software is an intangible item incapable of experiencing direct physical loss or direct physical damage.

The Court reasoned that “the most natural reading” of “direct physical loss of or damage” was that the policy insured against direct physical loss of media and direct physical damage to media. As for the inclusion of “computer software” in its definition of “media,” the Court noted that “although the term ‘computer software’ is included within the definition of ‘media,’ it is included only insofar as the software is ‘contained on covered media.’” (emphasis in original). In justification of this argument, the court noted examples of covered media from the policy’s definition section—all of which are materials of a physical nature. Accordingly, the Court held that there must be physical loss or physical damage of the covered media containing the computer software for software to be included under the policy.

The Ohio Supreme Court is the first state high court to rely on inherently flawed^[2] decisions from COVID-19 business interruption litigation to denying coverage for a non-COVID-19 insurance loss. Given the pervasiveness of those decisions, policyholders must be extra vigilant to guard against their use in other contexts, such as occurred in EMOI, and be prepared to exploit their flawed underpinnings and distinguish their narrow fact-specific holdings. Experienced coverage counsel can help navigate these issues during policy procurement and renewal as well as after a loss has occurred to ensure that coverage is afforded in a manner consistent with policy wording and the parties’ expectations of coverage.

FOOTNOTES

^[1] The Ohio Supreme Court reversed the judgment on the first issue, and thus, it did not analyze the second issue on whether a court can read a ransomware coverage into a businessowners all risk property policy by reading key ransomware exclusions out. The third issue, concerning the requirement of experts for either coverage determinations or avoiding bad faith claims, is not relevant to the purpose of this discussion.

^[2] See, e.g., Richard P. Lewis, Lorelie S. Masters, et al., Couch’s “Physical Alteration” Fallacy: Its Origins and Consequences, 56 Tort Trial & Ins. Practice Law J. 621, 622 (2021); Greg Gotwald & Michael S. Levine, The Insurance Industry’s COVID Sin, Law.com (Dec. 14, 2022).