Recent Maryland Ruling | Property Insurance and Cyber Policies Can Cover Damages Relating to Ransomware Attacks

A Federal Judge in Maryland recently ruled that an embroidery company’s property insurance provides coverage for the replacement of the company’s computer hardware and software following a ransomware attack. The embroidery company was hit with a ransomware attack that prevented it from accessing files and nearly all computer programs on its system. The company paid the ransom, but the hackers would not return access to the computers. The company brought in a computer security company to replace its computer system and restore as much data as it could. The insurance company refused to pay the costs of replacing the computer system and the software under the property insurance policy, asserting that there was no physical damage to the computers. The Federal Court disagreed, finding that the policy language requiring the insurance company to pay for “physical loss or damage” to a computer does not require physical damage to the computer rendering it unable to function. Instead, the Court held that “physical loss or damage” to a computer would include loss of use, loss of reliability, or impaired functionality. While this case, like all insurance coverage matters, was decided based on the language of the policy at issue, the broader takeaway from the ruling is that policyholders should notify not only their cyber insurance carrier but also their property policy insurer whenever there is a loss resulting from a computer hack.