Although it is important these days for businesses to have cyber insurance coverage, sometimes their general liability insurance policy can take care of the problem. This is one of those cases, although the policy holder had to fight to get paid.
Case Background
National Ink & Stitch is an embroidery and screen printing business that stores art, logos, designs for its business on a computer server. Its computer server also contains graphic arts software, shop management software, embroidery software, and website management software.
The company was victimized by a ransomware attack which prevented it from accessing all of its files, all of its data, and all of its software, with the exception of its embroidery software. National Ink made a payment in bitcoin, as ransom for the release of its data and software, but the attacker then demanded a further payment. Rather than make a further payment, National Ink hired a security company to replace and reinstall the software, and to install protective software on its system. The security company was able to replace and reinstall the software but was never able to retrieve the art files, requiring National Ink to re-create them. In addition, the re-creation and reinstallation of the software on the system substantially slowed the system, creating significant inefficiencies.
As a result, National Ink had only two options. They had to either completely “wipe“ the system and reinstall all of the software and information, or purchase an entirely new server with new components.
The Claim
National Ink submitted a claim to its insurance company, who denied the claim upon the grounds that the damage to its computer system was not tangible property. Therefore, according to the insurance company, National Ink did not sustain a “direct physical loss of or damage to Covered Property.” Included in the definition of Covered Property was:
“Electronic Media and Records (including software), defined as:
(a) Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells;
(b) Data stored on such media”
Relying upon the plain meaning of the words contained in the policy, the judge first rejected the insurance company’s argument that the loss of data and information was not a “direct physical loss“ because the policy expressly listed the word “data“ as Covered Property under its definition of Electronic media and records. The court next rejected the insurance company’s arguments that case law interpreting direct physical loss required that this claim be rejected. The judge did not agree, finding that all cases cited in the brief either supported National Ink’s arguments under its policy or were distinguishable. The court granted summary judgment in favor of National Ink, requiring that the insurance company cover the loss in its entirety.
Conclusion
So remember, if your business suffers a cyber loss, that loss may be covered under your general liability policy, whether or not you have cyber insurance.
If your company has suffered a cyber loss and you don’t believe that your insurance company is doing the right thing by your company, please do not hesitate to give us a call.
Evan S. Schwartz
Founder of Schwartz, Conroy & Hack
800-745-1755
ESS@schlawpc.com