Court Defines “Direct Physical Loss”
Close
 

Court Defines “Direct Physical Loss”

A Maryland federal district court ruled an insurer must indemnify its insured under its businessowner’s policy for costs incurred in a ransomware attack. The insured’s server stores art, logos and designs, graphic arts, shop management, embroidery and webstore management software. A ransomware attack locked down access to its art files and other data contained on the server, and nearly all of its software. After paying the ransom in bitcoin, the hacker still refused to release the software and data. The company hired a security company to replace and reinstall the software and install protective software which slowed the system and resulted in an efficiency loss. Its art files were permanently lost. The insurer argued there was no coverage because the insured only lost data, an intangible asset, and could still use its computer system to operate its business, thus it did not experience “direct physical loss” as covered by the policy. The court rejected this argument holding the plain language of the policy contemplates that data and software are covered and can experience “direct physical loss or damage.”

National Ink and Stitch LLC v State Auto Property and Casualty Insurance Company