|Court rules in favor of National Ink & Stitch in case of ransomware attack|
By Lonce Lamonte - January 23, 2020
A federal district court in Maryland on January 23rd 2020, Thursday, ruled that State Auto Property and Casualty Insurance Co., based in Ohio, must cover a screen-printing business, National Ink & Stitch, under its business-owner’s policy for costs incurred in a ransomware attack.
Maryland-based National Ink & Stitch LLC had a business-owners’ insurance policy with Ohio-based State Auto Property and Casualty Insurance Co. between March 2016 and March 2017, according to January 23rd’s ruling by the U.S. District Court in Baltimore in National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Co.
The company stores art, logos and designs for its business on its computer server as well as graphic arts, shop management, embroidery and webstore management software.
The January 23rd 2020 ruling read: State Auto (Property And Casualty Insurance Company) contends that because Plaintiff only lost data, an intangible asset, and could still use its computer system to operate its business, it did not experience “direct physical loss” as covered by the Policy.
Plaintiff counters that the Policy’s language contemplates computer data and software to be property subject to “direct physical loss,” and that its computer system itself sustained damage, in the form of impaired functioning.
In December of 2016, National Ink & Stitch’s computer server and networked computers experienced a ransomware attack, which prevented it from accessing all of its art files and other data contained on the server, and all its software, except for the embroidery software.
Although National Ink & Stitch made the demanded bitcoin payment, the attacker demanded further payment and refused to release the software and data. National Ink & Stitch hired a security company to replace and reinstall this software and install protective software on its computer system.
However, although its computer still functioned, the protective software’s installation slowed the system and resulted in an efficiency loss, the ruling said. The art files formerly stored on the server could not be accessed, and National Ink had to recreate them.
Experts testified also that there are likely dormant remnants of the ransomware still present, which could re-infect the entire system. To eliminate the risks, the options would be to wipe the entire system and reinstall all of the stored information or to purchase an entirely new server and components.
The company filed suit after State Auto Property and Casualty refused to pay National Ink’s claim in the matter.
The ruling read: “State Auto contends that because Plaintiff only lost data, an intangible asset, and could still use its computer system to operate its business, it did not experience ‘direct physical loss’ as covered by the policy,” the ruling said.
“Plaintiff counters that the Policy’s language contemplates computer data and software to be property subject to ‘direct physical loss’ ... and that its computer system itself sustained damage, in the form of impaired functioning.”
The ruling also said, “the plain language of the Policy contemplates that data and software are covered and can experience ‘direct physical loss or damage’.
“Plaintiff can recover based on either (1) the loss of data and software in its computer system, or (2) the loss of functionality to the computer system itself.
"While the term 'data' is qualified with the phrase 'stored on such media,' if the Policy intended to require physical loss or damage to the media itself, as opposed to just the data, it could have stopped at subsection (a), which describes the covered media. Instead, the Policy includes 'data stored on such media' as a separate subcategory of Covered Property in subsection (b). The Policy also contains the phrase 'Including Software' in its heading describing covered property. Thus, the plain language of the Policy contemplates that data and software are covered and can experience 'direct physical loss or damage'.”
The ruling concluded in granting summary judgment to National Ink in the case. The parties were directed to confer and advise the court, on or before January 31, 2020, whether a status hearing will be necessary to address the proper remedy.
email@example.com; journalist Lonce Lamonte; copyright by adjustercom and Lonce Lamonte, all rights reserved