Ohio Court: Non-physical Software Damage in Ransomware Attack Not Covered Under Insurance
The Ohio Supreme Court overturned a lower court ruling tied to a ransomware attack against EMOI Services, a company which sells record-keeping and medical billing software. This case highlights the severe operational risks facing the healthcare sector, mirroring situations where a ransomware attack delays patient care at hospitals across the U.S.
The court ruled that a ransomware attack against a business should not be covered by insurance because the attack did not physically or directly cause harm to the tangible components of the software programs encrypted in the incident. This distinction is critical as attackers continue to diversify their targets, causing disruptions similar to when a ransomware attack keeps Jackson, Hillsdale County schools closed.
The ruling serves as a warning given the trend of increased ransomware on SMOs (Small and Medium-sized Organizations), who often rely on general liability or property policies rather than dedicated cyber insurance. As courts narrow the definition of “damage,” organizations must prioritize prevention—monitoring for specific threats like the Bitwarden phishing attack—rather than assuming existing insurance policies will cover the fallout of a digital breach.
Read the full article from SC Media.
Key Takeaways
- Legal Precedent: The Ohio Supreme Court ruled that standard property insurance policies do not cover ransomware damage if there is no physical harm to hardware.
- Software vs. Hardware: The court determined that software is non-physical; therefore, data encryption by hackers does not constitute “direct physical loss.”
- Coverage Denial: The decision overturned a lower court’s ruling, denying EMOI Services’ claim for lost business income resulting from a ransomware attack.
Frequently Asked Questions (FAQ)
1. What was the Ohio Supreme Court’s ruling regarding ransomware?
The court ruled that a ransomware attack causing software encryption does not qualify as “direct physical loss” or “physical damage.” Therefore, it is not covered under standard property insurance policies that require physical alteration of property.
2. Why was EMOI Services denied insurance coverage?
EMOI Services was denied coverage because the attackers damaged the software (data/code) but not the physical hardware (servers/computers). The court determined that software is intangible, and standard policies are designed to cover tangible physical damage.
3. Does this ruling apply to all insurance policies?
This ruling specifically applies to general property or business owners’ policies that require “direct physical loss.” It underscores the necessity for businesses to purchase dedicated cyber liability insurance, which is specifically written to cover non-physical digital assets and cyber extortion.
4. What is EMOI Services?
EMOI Services is an Ohio-based company that provides medical billing and record-keeping software. They were the victim of a ransomware attack that encrypted their systems, leading to the insurance dispute.
