Court Rules Digital Assets Damaged During Ransomware Attack Are Covered by Insurance
National Ink & Stitch LLC runs an embroidery and screen printing business. As part of its day-to-day operations, Ink & Stitch stores art, logos and designs for its own business, as well as its clients, on a company-owned computer server.
It also houses graphic arts software, shop management software, embroidery software and webstore management software on its server. Then in 2016, Ink & Stitch was hacked.
The hacker used ransomware to block access to all of the art files and other data contained on the Ink & Stitch server. They also attacked the software on the system. The attacker demanded payment via bitcoin to release the data, but once Ink & Stitch paid up, the attacker demanded more.
Ink & Stitch reached out to a computer security company to help replace and reinstall its software in addition to adding better protective software on its system. As for the art files — Ink & Stitch was told it would need to recreate them if it wanted them back.
Further, the computer security team said that there are likely dormant remnants of the ransomware virus in the system that could “re-infect the entire system.” To eliminate this potential risk, Ink & Stitch was advised to wipe the entire system and reinstall all of its information or purchase an entirely new server.
Ink & Stitch turned to its insurer, State Auto Property and Casualty Insurance Company, seeking coverage under its business owner’s policy. It asked for coverage for the cost of replacing its computer system, but State Auto denied coverage. They went to court.
There, Ink & Stitch argued that the business owner’s policy afforded coverage for “direct physical loss of or damage to Covered Property.”
State Auto argued that there was no physical property loss. The insurer believed the software and data contained on the system were intangible assets, which, under the policy, should not be covered. The exact language stated that the policy “will pay for direct physical loss of or damage to Covered Property at the premises described in the Declarations caused by or resulting from any Covered Cause of Loss.”
Ink & Stitch pointed to the Businessowner’s Special Form Computer Coverage endorsement in the policy, which stated “Covered Property” included “(a) Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells” and “(b) Data stored on such media.”
It argued that, under this clause, its loss of electronic designs, art files and software was indeed a physical property loss
Scorecard: The court ruled in favor of Ink & Stitch. State Auto will pay for the new computer system.
Takeaway: Intangible or tangible, companies want their assets covered. Providing clear policy language can eliminate confusion on where property stands. &