The court found direct physical loss was established, allowing coverage for a ransomware attack on the insured's computer server and networked computers. Nat'l Ink & Stitch, LLC v. State Auto Prop. & Cas. Ins. Co., 2020 U.S. Dist. LEXIS 11411 (D. Md. Jan. 23, 2020).

    The insured stored art, logos, and designs for its business on its computer server. An ransomware attack prevented the insured from accessing all of the art files and other data contained on the server, and all of its software. The attacker demanded payment of a bitcoin to release access to the software and data. The insured retained a security company to replace and reinstall its software and to install protective software on its computer system. Although the computers still functioned, installation of protective software slowed the system and resulted in a loss of efficiency. The art files could not be accessed, and the insured had to recreate them. 

    The insured submitted its claim to State Auto. The policy provided State Auto:

will pay for the direct physical loss of or damage to Covered Property at the premises described in the Declarations caused by or resulting from any Covered Cause of Loss. 

The Businessowners Special Form Computer Coverage endorsement defined "Covered Property" to include "Electronic Media and Records (Including Software)." "Electronic Media and Records" included,

(a) Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells;

(b) Data stored on such media.

    State Auto denied coverage for the cost of replacing the insured's computer system. State Auto concluded there was no "direct physical loss of or damage to" the computer system to justify the replacement cost for the entire system under the policy.

    State Auto contended that because the insured only lost data, an intangible asset, and could still use its computer system to operate its business, it did not experience "direct physical loss" as covered by the policy. The insured argued that the policy's language contemplated computer data and software to be property subject to "direct physical loss," and that its computer system itself sustained damage, in the form of impaired functioning. 

    The court held that the insured could recover based on either (1) the loss of data and software in its computer system, or (2) the loss of functionality to the computer system itself. The policy expressly listed "data" as an example of Covered Property under its definition of "Electronic Media and Records (Including Software)." Therefore, the plain language of the policy contemplated that data and software were covered and could experience "direct physical loss or damage." 

    The insured also demonstrated damage to the computer system itself, despite its residual ability to function. State Auto equated "physical loss or damage" to the computer system to require an utter inability to function. The policy language and relevant case law imposed no such prerequisite. Loss of use, loss of reliability or impaired functionality demonstrated the required damage to a computer system, consistent with the "physical loss or damage to" language in the policy. Not only did the insured lose its data and software, but was left with a slower system, making it unable to access a significant portion of software and stored data. Because the plain language of the policy provided coverage for such losses and damage, summary judgment was granted in favor of the insured.