The Ohio Supreme Court Tuesday unanimously overruled the Ohio Second District Court of Appeals judgment. It moved that there must be “direct” physical loss or physical damage in the company’s computer software for insurance policy coverage.
In the three-year court proceedings between the greater Dayton medical billing software maker EMOI and its insurance service provider Lansing, Michigan-based Owners Insurance Company, the latter asserted that the insurance contract unambiguously stated only “direct physical loss” or “direct physical damage” to media would be covered under the insurance policy. The court, in its final ruling, gave the rationale that a computer might have physical, electronic components that are “tangible” in nature, but the information stored there has no “physical presence”; thus, a ransomware attack on the company software has no coverage under the company’s insurance policy. The judgment against EMOI concludes that a software developer can’t use its property insurance to cover losses.
So, property insurance doesn’t cover ransomware. That’s why we care. Insurance companies will be defending to ensure payouts are limited as much as possible. While I’m no lawyer, it’s easy enough to see the general implications here.