Relevantly, the policy provided that State Auto will "pay for direct physical loss of or damage to Covered Property at the premises described in the Declarations caused by or resulting from any Covered Cause of Loss." The Businessowners Special Form Computer Coverage endorsement defined "Covered Property" to include "Electronic Media and Records (Including Software." and defined "Electronic Media and Records" to include "electronic data processing, recording or storage media such as films, tapes, discs, drums or cells; and data stored on such media."

National Ink filed a claim with State Auto in December, 2016, for the ransomware attack. State Auto denied coverage for the cost of replacing the computer system. State Auto argued that National Ink did not experience a "direct physical loss of or damage to" the computer system to justify reimbursement under the policy of a complete replacement of the entire system, because National Ink only lost data and could still use the computer system.

National Ink argued that the policy language contemplated computer data and software to be property subject to "direct physical loss," and that the computer system sustained damage in the form of impaired functioning.

The court agreed with National Ink. The court held that National Ink could recover based on the loss of artwork data and software because the policy included "data stored on such media" as a separate category of Covered Property, so the plain language of the policy contemplated that "data and software are covered and can experience 'direct physical loss or damage.'"  The court also held that National Ink showed that the damage affected the computer system itself, despite its residual ability to function.

The court rejected the insurer's argument that "physical loss or damage" to the system required an "utter inability to function" and instead found that the policy language and relevant case law showed no such requirement, and cited cases that suggested the loss of use, reliability or impaired functionality demonstrated the required damage to a computer system consistent with the policy language.

Editor's Analysis:  Significantly, this case emphasizes that a computer system can be damaged to a point that coverage will apply, without being rendered completely inoperable.

The concept that a traditional insurance policy could be required to provide coverage for losses due to cyberattacks or cybersecurity events really gets to the essence of the "silent-cyber" issue and marks a growing trend in insurance. Although the State Auto policy was not a cyber policy,  but it was still required to pay out what would be considered cyber damages, the case demonstrates that a business does not necessarily have to purchase a cyber policy to have coverage for a cyber loss.