NATIONAL INK AND STITCH, LLC, Plaintiff, v. STATE AUTO PROPERTY AND CASUALTY INSURANCE COMPANY, Defendant.
Civil Case No. SAG-18-2138
IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MARYLAND
January 23, 2020
Stephanie A. Gallagher, United States District Judge
Plaintiff National Ink & Stitch, LLC (“Plaintiff“) filed this case against its businessowners’ insurance carrier, State Auto Property and Casualty Insurance Company (“State Auto“), seeking coverage for damage alleged to have been sustained to its computer system in a ransomware attack. The parties have filed cross-motions for summary judgment, ECF 35 (“State Auto‘s Motion“), ECF 36 (“Plaintiff‘s Motion“), and oppositions to the respective motions, ECF 37, 38. I have reviewed the filings, and no hearing is necessary. See Loc. R. 105.6 (D. Md. 2018). For the reasons that follow, I will grant Plaintiff‘s Motion and deny State Auto‘s Motion.
I. FACTUAL BACKGROUND
The facts in this case are largely undisputed. Plaintiff‘s embroidery and screen printing business was covered by a State Auto businessowner‘s insurance policy, number BOP2870198, between March 31, 2016 and March 31, 2017 (“the Policy“). ECF 35-2. Plaintiff stored art, logos, and designs for its business on its computer server. ECF 35-3 at 22-23. The server also housed graphic arts software, shop management software, embroidery software, and webstore management software. Id. at 42-45.
The Policy provides, in relevant part, that State Auto:
will pay for direct physical loss of or damage to Covered Property at the premises described in the Declarations caused by or resulting from any Covered Cause of Loss.
ECF 35-2 at 35. The Businessowners Special Form Computer Coverage endorsement expressly defines “Covered Property” to include “Electronic Media and Records (Including Software),” and defines “Electronic Media and Records” to include:
- Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells;
- Data stored on such media
Id. at 61.
Plaintiff presented a claim to State Auto on December 16, 2016, regarding the ransomware attack. ECF 35-1 at 5. However, State Auto denied coverage for the cost of replacing Plaintiff‘s computer system. Id. The parties dispute whether Plaintiff experienced “direct physical loss of or damage to” its computer system, to justify reimbursement of the replacement cost for the entire system under the Policy.
II. LEGAL STANDARD
Under
Additionally, summary judgment shall be warranted if the non-moving party fails to provide evidence that establishes an essential element of the case. Id. at 352. The non-moving party “must produce competent evidence on each element of [its] claim.” Id. at 348-49 (quoting Miskin, 107 F. Supp. 2d at 671). If the non-moving party fails to do so, “there can be no genuine issue as to any material fact,” because the failure to prove an essential element of the case “necessarily renders all other facts immaterial.” Id. at 352 (quoting Celotex Corp. v. Catrett, 477 U.S. 317, 322-23 (1986); Coleman v. United States, 369 F. App‘x 459, 461 (4th Cir. 2010) (unpublished)). In ruling on a motion for summary judgment, a court must view all of the facts, including reasonable inferences to be drawn from them, “in the light most favorable to the party opposing the motion.” Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587-88 (1986) (quoting United States v. Diebold, Inc., 369 U.S. 654, 655 (1962)).
III. ANALYSIS
The parties agree that Maryland law governs their dispute. See, e.g., ECF 35-1 at 6, 36-1 at 9 (discussing Maryland precedent). Accordingly, this Court will apply standard principles of contractual interpretation to decide whether Plaintiff suffered “direct physical loss of or damage to” its computer system. See People‘s Ins. Counsel Div. v. State Farm Fire & Cas. Ins. Co., 214 Md. App. 438, 453 (2013) (explaining that interpretation of an insurance policy is subject to principles of contract interpretation); see also United Services Auto. Ass‘n v. Riley, 393 Md. 55, 78 (2006) (“Contract interpretation is undoubtedly a question of law that may be properly determined on summary judgment.“). State Auto contends that because Plaintiff only lost data, an intangible asset, and could still use its computer system to operate its business, it did not experience
A. Loss of Data and Software
As always, the analysis of a contract begins with its plain language. “Maryland follows the law of objective contract interpretation.” Sy-Lene of Washington, Inc. v. Starwood Urban Retail II, LLC, 376 Md. 157, 166 (2003). Under that standard, “the written language embodying the terms of an agreement will govern the rights and liabilities of the parties, irrespective of the intent of the parties at the time they entered the contract.” Long v. State, 371 Md. 72, 84 (2002). Here, the Policy expressly lists “data” as an example of Covered Property under its definition of “Electronic Media and Records (Including Software).” ECF 35-2 at 61. While the term “data” is qualified with the phrase “stored on such media,” if the Policy intended to require physical loss or damage to the media itself, as opposed to just the data, it could have stopped at subsection (a), which describes the covered media. Id. Instead, the Policy includes “data stored on such media” as a separate subcategory of Covered Property in subsection (b). Id. The Policy also contains the phrase “Including Software” in its heading describing covered property. Id. Thus, the plain language of the Policy contemplates that data and software are covered and can experience “direct physical loss or damage.”
This interpretation of the Policy‘s plain language comports with the interpretations reached by the majority of courts interpreting similar policies. Although Maryland courts have not
For its part, State Auto relies almost entirely on Ward Gen. Ins. Servs., Inc. v. Employers Fire Ins. Co., 114 Cal. App. 4th 548 (2003). In Ward, an employee of an insurance company inadvertently caused its computer database to “crash,” resulting in the loss of electronically stored client data. Id. at 550. The plaintiff was able to restore and reconstruct the database, but incurred substantial consulting costs, extra payroll cost, and loss of business income due to the disruption. Id. at 550-51. The plaintiff sought coverage under its business insurance policy, which, like the Policy in this case, required “direct physical loss of or damage to” its property. Id. at 551. The Ward Court noted, “Plaintiff did not claim the replacement or repair cost for any item of hardware or the storage medium,” instead seeking only extra labor expenses and lost business income. Id. at 553. Thus, the issue presented in Ward was whether the policy‘s coverage of “direct physical loss” included “the loss of electronically stored data, without any loss or damage to the storage media or to any other property.” Id. at 555. The Ward court concluded that it did not. Id.
The instant case is readily distinguishable from Ward. The costs sought by Plaintiff are the replacement costs for its hardware and software—in other words, its entire computer system. State Auto‘s contention that Plaintiff‘s only loss or damage is to its data, like the situation in Ward, is unpersuasive. Plaintiff does not seek solely the costs of replacing its customer data. It seeks a fully functioning computer system not (1) slowed by the necessary remedial and protective measures, or (2) at risk of reinfection from a dormant virus.
State Auto also cites State Auto Prop. and Cas. Ins. Co. v. Midwest Comp. & More, 147 F. Supp. 2d 1113 (W. D. Okla. 2001). That case interpreted markedly different policy language requiring, “[p]hysical injury to tangible property, including all resulting loss of use of that
The instant Policy does not limit coverage to “tangible property.” To the contrary, as noted above, the Policy expressly includes “data” and “software” as categories of “covered property.” ECF 35-2 at 61. The facts presented, then, are more similar to a line of cases holding, in plaintiffs’ favor, that the type of damage suffered by Plaintiff constitutes “direct physical loss or damage.” In one such case, Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16, 19 (Tx. Ct. App. 2003), a hacker infected Lambrecht‘s business computer system with a virus. Lambrecht lost all of the information that had been stored on its system, and was unable to load any new information. Id. Accordingly, Lambrecht “had to replace its server, purchase a new operating system and other pre-packaged software, and manually re-enter much of its data.” Id. State Farm, like State Auto here, argued that “the loss of information on Lambrecht‘s computer systems was not a ‘physical’ loss because the data on Lambrecht‘s computers did not exist in physical or tangible form.” Id. at 23-24. The court disagreed, noting that the policy defined “electronic media and records” as “electronic data processing, recording or storage media such as films, tapes, discs, drums or cells; data stored on such media; or programming records used for electronic data processing or electronically controlled equipment.” Id. at 25. The court reasoned that “the server falls within the definition of ‘electronic media and records’ because it contains a hard drive or ‘disc’ which could no longer be used for ‘electronic data processing, recording, or storage.” Id. Further, the data was protected because it was the “data stored on such media.” Id.
Similarly, in an unpublished Fourth Circuit case, NMS Servs. Inc. v. The Hartford, 62 F. App‘x. 511, 512 (4th Cir. 2003), the Fourth Circuit found insurance coverage to exist for “erasure of vital computer files and databases necessary for the operation of the company‘s manufacturing, sales, and administrative systems.” The loss was sustained after a former employee and computer hacker installed hacking programs on the network during his employment. Id. The company‘s insurance policy provided coverage for lost business income sustained as a result of “direct physical loss of or damage to property.” Id. at 514. The Court stated, “There is no question that NMS suffered damage to its property, specifically, damage to the computers it owned.” Id. at 514.
Finally, while not squarely on point, the rationale of the Maryland Court of Appeals in Comptroller of the Treasury v. Equitable Trust Co., 296 Md. 459 (1983) suggests that Maryland would align with Lambrecht, instead of with Ward. In Equitable Trust Co., the Court considered whether computer software programs constituted tangible property subject to Maryland‘s Sales Tax Act. Id. at 461-62. The Court found that, although the intended use of the software might sever it from the tangible form in which it was originally transmitted, the act of copying the software to computer memory did not render it intangible. Id. at 485. It concluded, “that the statute does not sever copies of computer programs from the tangible carriers employed in the subject sales.” Id. By that logic, Maryland courts would find physical damage to Plaintiff‘s computer software, despite its installation on Plaintiff‘s computer system, because the software was rendered entirely unusable by the ransomware attack.
B. Loss of Functionality
In addition to Plaintiffs’ data and software constituting covered property under the Policy‘s terms, Plaintiff has also demonstrated damage to the computer system itself, despite its residual ability to function. Again, the parties’ cited cases are instructive. In American Guarantee & Liab. Ins. Co. v. Ingram Micro, Inc., Civ. No. 99-185-TUC ACM, 2000 WL 726789, at *1 (D. Ariz. April 18, 2000), a power outage rendered Ingram‘s computer systems inoperable. After the event, all of the programming information disappeared from the system‘s random access memory, and
Likewise, in Southeast Mental Health Ctr., Inc. v. Pacific Ins. Co., LTD, 439 F. Supp. 2d 831, 833-34 (W.D. Tenn. 2006), a hurricane led to a power outage in a pharmacy, which resulted in the loss of data from the pharmacy‘s computer. The insurance carrier argued that Plaintiff‘s lost business income was not recoverable because the “losses were not caused by direct physical loss of or damage to the insured property.” Id. at 834. However, the Court found “that the corruption of the pharmacy computer constitutes ‘direct physical loss of or damage to property’ under the business interruption policy.” Id. at 838. The Court cited Ingram for the proposition that “loss of access, loss of use, and loss of functionality” fall within the definition of direct “physical damage.” Id. at 838.
In the instant case, State Auto seems to equate “physical loss or damage” to Plaintiff‘s computer system to require an utter inability to function. The Policy language, and the relevant case law, impose no such prerequisite. The more persuasive cases are those suggesting that loss of use, loss of reliability, or impaired functionality demonstrate the required damage to a computer system, consistent with the “physical loss or damage to” language in the Policy (emphasis added). Indeed, in many instances, a computer will suffer “damage” without becoming completely inoperable. Here, not only did Plaintiff sustain a loss of its data and software, but Plaintiff is left with a slower system, which appears to be harboring a dormant virus, and is unable to access a significant portion of software and stored data. Because the plain language of the Policy provides coverage for such losses and damage, summary judgment will be granted in favor of Plaintiff‘s interpretation of the Policy terms.
For the reasons set forth above, Plaintiff‘s Motion for Summary Judgment, ECF 36, will be GRANTED as to liability, and State Auto‘s Motion for Summary Judgment, ECF 35, will be DENIED. A separate Order follows, which directs the parties to confer and advise the Court, on or before January 31, 2020, whether a status hearing will be needed to address the appropriate remedy.
Dated: January 23, 2020
/s/
Stephanie A. Gallagher
United States District Judge