435 F.Supp.3d 679
D. Maryland2020Background
- Plaintiff National Ink & Stitch ran an embroidery/screen-printing business and stored art, logos, and business software on an on‑site server covered by State Auto businessowners’ policy (3/31/16–3/31/17).
- In December 2016 a ransomware attack encrypted Plaintiff’s data and software; attacker demanded bitcoin, Plaintiff paid but attacker refused to restore access.
- Plaintiff hired security consultants to reinstall and protect software; system remained usable but was materially slower and some art files/software remained inaccessible and likely irretrievable without wiping or replacing hardware.
- Plaintiff sought coverage for replacement/repair under the Policy’s clause for "direct physical loss of or damage to Covered Property," which defines Covered Property to include "Electronic Media and Records (Including Software)" and "data stored on such media."
- State Auto denied coverage arguing only intangible data was lost and the computer continued to function; parties filed cross‑motions for summary judgment.
- Court granted Plaintiff’s motion on liability, holding Policy language and precedent support coverage for loss of data/software and impaired functionality.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Whether loss of data/software is "direct physical loss of or damage to" covered property | Data and software are expressly covered under the Policy; loss of stored data/software is physical loss/damage under the Policy | Loss was only to intangible data (not media); because the machines still function, there is no "physical loss" | Court: Covered — Policy expressly lists data/software as covered; loss of data/software can constitute direct physical loss/damage |
| Whether impaired functionality/reliability (slower system, dormant virus risk) constitutes "physical loss or damage" | Impaired functionality, loss of reliability, and risk of reinfection are damage to the system and are covered | Because system retains some functionality, there was no physical damage entitling coverage | Court: Covered — loss of use, loss of reliability, and impaired functionality can constitute physical loss/damage; total inoperability is not required |
Key Cases Cited
- Ward Gen. Ins. Servs., Inc. v. Employers Fire Ins. Co., 114 Cal. App. 4th 548 (Cal. Ct. App. 2003) (held data loss without damage to storage media did not constitute physical loss under that policy)
- Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16 (Tex. Ct. App. 2003) (virus corrupted data and impaired server; court found coverage where policy defined electronic media/data)
- NMS Servs. Inc. v. The Hartford, [citation="62 F. App'x 511"] (4th Cir. 2003) (Fourth Circuit recognized erasure of vital computer files as damage to property for insurance coverage)
- State Auto Prop. & Cas. Ins. Co. v. Midwest Comp. & More, 147 F. Supp. 2d 1113 (W.D. Okla. 2001) (concluded data itself is intangible, but loss of use of computers may constitute property damage under different policy language)
- Southeast Mental Health Ctr., Inc. v. Pacific Ins. Co., 439 F. Supp. 2d 831 (W.D. Tenn. 2006) (corruption of pharmacy computer held to be direct physical loss/damage; loss of access/functionality covered)
- Comptroller of the Treasury v. Equitable Trust Co., 296 Md. 459 (Md. 1983) (Maryland held copies of software remain tied to tangible carriers; supports view that software/data can be treated as tangible for some legal purposes)
