Cyber Coverage By Any Other Name Can Smell As Sweet: Maryland Court Rules Traditional Property Policy Covers Loss Of Data And Impaired Computer Equipment After Ransomware Attack

Cyberattacks are an increasingly frequent and costly risk faced by almost every business today. While the availability and scope of cyber-specific insurance has developed exponentially over the past few years, it is important to remember that more traditional policies (such as general liability and first-party property insurance) can still be a source for coverage in connection with cyber incidents, as a recent court decision demonstrates.

In National Ink & Stitch, LLC v. State Auto Property & Casualty Insurance Co., the U.S. District Court for the District of Maryland ruled that lost data and the compromised operability of a computer system resulting from a cyberattack qualify as "direct physical loss" under a first-party property policy. The decision is described as "first-of-its-kind," finding coverage for costs associated with a ransomware infection of a computer system.

The case stems from a 2016 ransomware attack on National Ink and Stitch, an online screen printing and embroidery company. The attack prevented the company from accessing almost all of its software applications and art files on its servers. After the ransom demand was paid, the hacker still did not remove the malware and demanded another payment. Instead of paying more, National Ink hired a security company to reinstall its software and install a protection program on the system. National Ink was never able to recover its art files and had to recreate them.

After installing the protection program, National Ink experienced a significant slow-down of its systems and discovered that remnants of the ransomware were still present and threatened re-infection. National Ink decided to scrap the system entirely and replace it with a new server and computers. National Ink then sought coverage for the replacement costs under its business owners' property insurance policy. Its property insurer, State Auto Property & Casualty Insurance Company, denied coverage for the replacement costs and National Ink filed suit. Both parties filed for summary judgment on the issue of whether National Ink's loss of data and the impairment of its system constituted "direct physical loss" within the coverage...