HNRK Coverage Corner

On December 27, 2022, the Ohio Supreme Court issued a decision in EMOI Servs., LLC. v. Owners Ins. Co., 2022-Ohio-4649 (Ohio 2022), holding that losses resulting from damage to an insured’s software were not covered under the “Electronic Equipment” endorsement of a property insurance policy.

The insured, EMOI Services, is a computer software company whose product “provide[s] medical offices with service and support for setting appointments, record keeping, and billing.”  EMOI fell victim to a ransomware attack and was forced to pay a $35,000 ransom in exchange for decryption keys that ultimately enabled it to restore the majority of its systems and files.  EMOI sought coverage under the “electronic equipment” endorsement to its property insurance policy, which required the insurer (Auto-Owners Insurance Group) to reimburse EMOI for direct physical loss of or damage to “media” that it owned, leased or controlled, as a result of the covered event. The term “media” was defined in the endorsement as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards,” and includes “computer software and reproduction of data contained on covered media.”

Reversing the Court of Appeals, the Ohio Supreme Court held that loss of or damage to computer software did not qualify for coverage under the insured’s policy, explaining:

We find the language in the electronic-equipment endorsement to be clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment or media before the endorsement is applicable. Since software is an intangible item that cannot experience direct physical loss or direct physical damage, the endorsement does not apply in this case.

. . . The most natural reading of the phrase “direct physical loss of or damage to” is that EMOI is insured for direct physical loss of its media and insured for direct physical damage to its media.  In other words, the adjectives “direct” and “physical” modify both “loss” and “damage.”  Similarly, although the term “computer software” is included within the definition of “media,” it is included only insofar as the software is “contained on covered media.”  We hold that “covered media” means media that has a physical existence. Indeed, all examples of covered media in the definition section are materials of a physical nature, i.e., “film, magnetic tape, paper tape, disks, drums, and cards.” And we also hold that the policy requires that there must be direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy. . . . 

Computer software cannot experience “direct physical loss or physical damage” because it does not have a physical existence. Software is essentially nothing more than a set of instructions that a computer follows to perform specific tasks. It is information stored on a computer or other electronic medium. While a computer or other electronic medium has physical electronic components that are tangible in nature, the information stored there has no physical presence.  In other words, the information—the software—is entirely intangible. Focusing on what the parties would have intended, we are unpersuaded that the policy covered “physical damage” to computer software (an intangible) without there also being physical damage to the hardware on which the software was stored.

The degree to which insureds may be entitled to coverage for cyber-related losses under traditional insurance policies—so-called “silent cyber coverage”—remains controversial.  In contrast to the Ohio Supreme Court’s ruling, Courts in other jurisdictions have held that an insured can suffer a “direct physical loss” of or “direct physical damage” to computer software.  See, e.g., Nat’l Ink and Stitch, LLC v. State Auto Property & Cas. Ins. Co., 435 F. Supp. 3d 679 (D. Md. 2020) (“more persuasive cases are those suggesting that loss of use, loss of reliability, or impaired functionality demonstrate the required damage to a computer system, consistent with the ‘physical loss or damage to’ language in the Policy”); Landmark Am. Ins. Co. v. Gulf Coast Analytical Lab’ys, Inc., 2012 WL 1094761, at *4 (M.D. La. Mar. 30, 2012) (holding that “electronic data is physical in nature under Louisiana law” and therefore could be subject to “direct physical loss or damage”); SouthEast Mental Health Center, Inc. v. Pac. Ins. Co., Ltd., 439 F. Supp. 2d 831, 837 (W.D. Tenn. 2006) (holding that “corruption” of insured’s computer data resulting from a power outage constituted “direct physical loss of or damage to property”); Am. Guar. & Liab. Ins. Co. v. Ingram Micro, Inc., 2000 WL 726789, at *2 (D. Ariz. Apr. 18, 2000) (holding that “‘physical damage’ is not restricted to the physical destruction or harm of computer circuitry but includes loss of access, loss of use, and loss of functionality”).

The takeaway here is that, while express cyber insurance policies have become an important component of a company’s insurance portfolio, in the event of a cyber loss, insureds should investigate potential coverage under other policies, as well.