Privacy & Information Security Law Blog

As previously posted on our Hunton Insurance Recovery blog, a Maryland federal court awarded summary judgment to policyholder National Ink in National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Company, finding coverage for a cyber attack under a non-cyber insurance policy after the insured’s server and networked computer system were damaged as a result of a ransomware attack. This is significant because it demonstrates that insureds can obtain insurance coverage for cyber attacks even if they do not have a specific cyber insurance policy.The decision also is significant because it shows that an insured’s business does not need to be completely shut down in order to get insurance coverage. A slow-down of functionality should be sufficient to trigger coverage.

The insured, National Ink, is an embroidery and screen printing business covered by a State Auto Business owner’s insurance policy. National Ink’s server and networked computers experienced a ransomware attack, which prevented National Ink from accessing the logos, designs and software that are stored on these servers. National Ink paid the ransom, but the attacker then demanded further payment and refused to release the software and data. In response, National Ink hired a security company to replace its software and to install protective software.

National Ink’s computers still functioned, but the protective software “slowed the system and resulted in loss of efficiency.” Further, the art files formerly stored on the server could not be accessed. Computer experts also testified that “there are likely dormant remnants of the ransomware virus in the system, that could ‘re-infect the entire system’. . . The options, to eliminate the risk of further infection, would be to ‘wipe’ the entire system and reinstall the software and information or purchase an entirely new server and component.”

National Ink presented a claim to State Auto regarding the ransomware attack. State Auto denied coverage for the cost of replacing the computer system.

The State Auto policy provides coverage for “direct loss of or damage to Covered Property . . . caused by or resulting from any covered Cause of Loss.” Covered Property is defined “to include ‘Electronic Media and Records (Including Software),’ and defines ‘Electronic Media and Records’ to include: (a) Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells; (b) Data stored on such media.”

State Auto argued that National Ink did not experience “direct physical loss of or damage to” its Covered Property to justify reimbursement for the replacement cost of the entire system because National Ink only lost data and could still use its computer system.

In contrast, National Ink argued that the policy language contemplates computer data and software to be property subject to “direct physical loss,” and that its computer system sustained damage in the form of impaired functioning.

The court agreed with National Ink. First, the court held that National Ink could recover based on the loss of data and software because the policy includes “data stored on such media” as a separate category of Covered Property, “[t]hus, the plain language of the Policy contemplates that data and software are covered and can experience ‘direct physical loss or damage.’”

Second, the court held that National Ink “demonstrated damage to the computer system itself, despite its residual ability to function.” The court rejected State Auto’s position that “physical loss or damage” to National Ink’s computer system required an “utter inability to function.” Instead, the court found, “[t]he Policy language, and the relevant case law, impose no such prerequisite. The more persuasive cases are those suggesting that loss of use, loss of reliability, or impaired functionality demonstrate the required damage to a computer system, consistent with the ‘physical loss or damage to’ language in the Policy” (emphasis in original).

This case is significant for multiple reasons. First, this case recognizes that a computer system can be damaged without being rendered completely inoperable. This is important because having a functioning computer system after a ransomware attack can cost policyholders substantial amounts of money. Second, because the State Auto policy was not specifically a cyber policy, it shows that a business does not have to purchase a cyber policy to get coverage for cyber loss. Therefore, policyholders experiencing a cyber attack should carefully review and consider making a claim under all potential insurance policies.