If an insurance contract is based on “physical damage”, an intangible product such as software is not protected according to a US Supreme Court judgement.
In the case of ransomware attacks that only affect software, traditional insurance cover generally does not apply. This was decided by the Ohio Supreme Court in a decision that has now been published on December 27th. Thus, if a policy only covers “direct physical damage” or loss, it does not cover computer software because it “has no physical existence”. At most, damage to tangible data carriers on which relevant programs are running is insured.
With its decision , the Supreme Court of Ohio overturned the contrary decision of an appellate court from November 2021 . The case stems from a lawsuit by the US service provider Electronic Medical Office Integration (EMOI), a manufacturer of medical billing software, against its insurance provider Owners Insurance. The appellate court had come to the conclusion that the injured party can sue the insurance company – contrary to the original announcement by a federal court at the district level. You have failed to properly examine “the various types of damage that can occur on data carriers such as software”.
Property insurance not sufficient
Owners argued in the Supreme Court that “everything from personal phones and computers to automobiles, voting machines and pipeline control systems has been ‘hacked’ or ransomed with encryption Trojans . ” The increasing use of and dependence on digital information and services have opened up new areas of attack. Therefore, a special form of insurance protection has been developed to insure digital ransom demands or other “cyber damage”.
“The reason is that traditional commercial or business property insurance does not provide such coverage,” Owners pointed out. In the aftermath, EMOI would obviously have wished to have taken out a cyber policy. However, the company did not do this.
The US specialist legal service points out that courts have repeatedly ruled in favor of the insurance company in similar cases of damage. The trend is towards excluding cyber attacks from liability insurance. At the same time, interest in special cyber policies is increasing, but they often have hefty premiums. Even then, online attacks in connection with wars would often be ruled out.
The US government therefore commissioned a study in September to find out whether IT attacks with catastrophic effects can still be insured at all. The CEO of the Swiss insurance company Zurich, Mario Greco, has just answered this question in the negative : according to him, damage in cyberspace can no longer be covered.
US Federal Court: Insurance policy does not cover ransomware attack
