Court Rules Digital Assets Damaged During Ransomware Attack Are Covered by Insurance

A debate over intangible asset coverage is decided in court.
By: | March 2, 2020

National Ink & Stitch LLC runs an embroidery and screen printing business. As part of its day-to-day operations, Ink & Stitch stores art, logos and designs for its own business, as well as its clients, on a company-owned computer server.

It also houses graphic arts software, shop management software, embroidery software and webstore management software on its server. Then in 2016, Ink & Stitch was hacked.

The hacker used ransomware to block access to all of the art files and other data contained on the Ink & Stitch server. They also attacked the software on the system. The attacker demanded payment via bitcoin to release the data, but once Ink & Stitch paid up, the attacker demanded more.

Ink & Stitch reached out to a computer security company to help replace and reinstall its software in addition to adding better protective software on its system. As for the art files — Ink & Stitch was told it would need to recreate them if it wanted them back.

Advertisement


Further, the computer security team said that there are likely dormant remnants of the ransomware virus in the system that could “re-infect the entire system.” To eliminate this potential risk, Ink & Stitch was advised to wipe the entire system and reinstall all of its information or purchase an entirely new server.

Ink & Stitch turned to its insurer, State Auto Property and Casualty Insurance Company, seeking coverage under its business owner’s policy. It asked for coverage for the cost of replacing its computer system, but State Auto denied coverage. They went to court.

There, Ink & Stitch argued that the business owner’s policy afforded coverage for “direct physical loss of or damage to Covered Property.”

State Auto argued that there was no physical property loss. The insurer believed the software and data contained on the system were intangible assets, which, under the policy, should not be covered. The exact language stated that the policy “will pay for direct physical loss of or damage to Covered Property at the premises described in the Declarations caused by or resulting from any Covered Cause of Loss.”

Ink & Stitch pointed to the Businessowner’s Special Form Computer Coverage endorsement in the policy, which stated “Covered Property” included “(a) Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells” and “(b) Data stored on such media.”

It argued that, under this clause, its loss of electronic designs, art files and software was indeed a physical property loss

Scorecard: The court ruled in favor of Ink & Stitch. State Auto will pay for the new computer system.

Takeaway: Intangible or tangible, companies want their assets covered. Providing clear policy language can eliminate confusion on where property stands. &

Autumn Heisler is the digital producer at Risk & Insurance®. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

Risk Matrix: Presented by Liberty Mutual Insurance

9 Trends that Are Driving Rate Increases

The market was optimistically cautious entering 2020, but thanks to COVID-19, growing liability challenges and other risk factors, we’re seeing more hardening.
By: | September 1, 2020




The R&I Editorial Team can be reached at [email protected]