The insured was held to be covered for “direct physical damage”, being loss/corruption of electronic data and software, and for a reduction of efficiency in the computer system caused by a ransomware attack. This was largely due to the wording of the policy in question and what data corruption involves at the atomic level.

National Ink & Stitch, LLC v. State Auto Property & Casualty Insurance Company, 2020 U.S. Dist. LEXIS 11411 (U.S.Dist. Ct., Maryland) per Gallagher, J.

Facts + Issues

The Plaintiff insured National Ink & Stitch operated an embroidery and screen printing business, in which it employed computers. It stored art, logos and designs on its computer server. The server also contained software for graphic arts, shop management, embroidery and website management.

In December 2016, the insured’s server and networked computer were victims of a ransomware attack, which prevented the insured from accessing the data software (except for the embroidery software) on its server until the bitcoin ransom was paid.

The insured’s security company was able to replace and reinstall the program, along with new protective software. The protective software reduced the system’s efficiency, slowing down the computer’s operations. They were unable to restore the art files, requiring the insured to recreate them. 

Expert evidence established that there were likely dormant remains of the ransomware software left on the insured’s server that could re-infect the entire system. This issue could be remedied by either wiping the whole system and reinstalling all software and date or to purchase a new server and components.

National Ink & Stitch had an insurance policy from State Auto Property & Casualty Insurance Co. ECF 35-3 at 61 of the policy provided that State Auto:

will pay for direct physical loss of or damage to Covered Property at the premises described in the Declarations caused by or resulting from any Covered Cause of Loss.

ECF 35-2 at 35 was The Businessowners Special Form Computer Coverage Endorsement. The Endorsement defined “Covered Property” to include “Electronic Media and Records (Including Software)”. It further defined the term “Electronic Media and Records” to include:

1. Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells;
2. Data stored on such media

State Auto denied the claim for the cost of replacing the insured’s system. It argued that the insured had not sustained “direct physical loss of or damage to” its computer system. State Auto also argued that the computer system had been slowed down by the installation of protective software and was subject to a risk of reinfection from dormant ransomware did not eliminate the system’s ability to function, and thus also did not qualify for coverage.

The Insured applied for summary judgement regarding its claim.

HELD: For the insured; application granted. 

The Court held that in Maryland, the standard principles of contractual interpretation are to be employed in determining whether or not the insured's loss qualified as "direct physical loss or damage". It relied on Long v. State, 371 Md. 72, 84, 807 A.2d 1 (2002), which held that "the written language embodying the terms of an agreement will govern the rights and liabilities of the parties, irrespective of the intent of the parties at the time they entered the contract" and "the written language embodying the terms of an agreement will govern the rights and liabilities of the parties, irrespective of the intent of the parties at the time they entered the contract." 

The Court held that the insured's losses did qualify as "direct physical loss or damage" because data and software, as well as electronic storage media they were stored on, fell within the coverage definitions of the policy.

1. The Court held as follows (at p. 7):

Here, the Policy expressly lists "data" as an example of Covered Property under its definition of "Electronic Media and Records (Including Software)." ECF 35-2 at 61. While the term "data" is qualified with the phrase "stored on such media," if the Policy intended to require physical loss or damage to the media itself, as opposed to just the data, it could have stopped at subsection (a), which describes the covered media. Id. Instead, the Policy includes "data stored on such media" as a separate subcategory of Covered Property in subsection (b). Id. The Policy also contains the phrase "Including Software" in its heading describing covered property. Id. Thus, the plain language of the Policy contemplates that data and software are covered and can experience "direct physical loss or damage."

2. It was also noted that the insured was not solely seeking indemnity for the costs of replacing the data but also a "fully functioning computer system not (1) slowed by the necessary remedial and protective measures, or (2) at risk of reinfection from a dormant virus". It was held that the plain language of the policy "protects against not only "physical loss" but also "damage to" both the media and the data. While Plaintiff's computer system retains certain functionality, it has been rendered slow and inefficient, and its storage capability was damaged such that its contents (namely the data and software) cannot be retrieved." (at p. 11)
    
3. The Court distinguished cases cited by the insurer, which denied coverage where "direct physical loss" was defined as relating to "tangible property", which is not what is provided for in the insurance policy under consideration in this case.
    
4. The Court also considered the consequences of corruption of data at the atomic level to support the proposition that there had been "direct physical loss" here. It cited NMS Servs. v. The Hartford, 62 Fed. Appx. 511, 512 (4th Cir. 2003) which held that "a computer stores information by the rearrangement of the atoms or molecules of a disc or tape to affect the formation of a particular order of magnetic impulses, and a meaningful sequence of magnetic impulses cannot float in space."

The Court also held that the less than total loss of functionality of the insured's system did not render the loss uncovered.

1. The Court held that "[i]n addition to Plaintiffs' data and software constituting covered property under the Policy's terms, Plaintiff has also demonstrated damage to the computer system itself, despite its residual ability to function" (pp. 13 – 14). It held that "physical damage" includes a loss of reliability.
    
2. The Court held that "physical damage" "is not restricted to the physical destruction or harm of computer circuitry but includes loss of access, loss of use, and loss of functionality." (p. 14)
    
3. The Court concluded on this point as follows (at pp. 16 – 17):

In the instant case, State Auto seems to equate "physical loss or damage" to Plaintiff's computer system to require an utter inability to function. The Policy language, and the relevant case law, impose no such prerequisite. The more persuasive cases suggest that loss of use, loss of reliability, or impaired functionality demonstrates the required damage to a computer system, consistent with the "physical loss or damage to" language in the Policy (emphasis added). Indeed, in many instances, a computer will suffer "damage" without becoming completely inoperable. Here, not only did Plaintiff sustain a loss of its data and software, but Plaintiff is left with a slower system, which appears to be harbouring a dormant virus, and is unable to access a significant portion of the software and stored data. Because the Policy's plain language provides coverage for such losses and damage, summary judgment will be granted in favour of the Plaintiff's interpretation of the Policy terms.

COMMENTARY

The issue of whether or not “physical damage” in a property policy covers losses to data and software is currently a hot issue. This case is particularly instructive on two points:

1. This case underscores the basic principle that coverage in any particular case depends on the wording of the policy under review. It is imperative to begin one’s coverage analysis with an examination of the terms of the policy. 
    
2. The description of data corruption at the atomic level is an interesting way of looking at it: since the data exists on a computer system as matter, i.e. atoms, the destruction or rearrangement of those atoms involves “physical damage”.