## Facts

- National Ink and Stitch, LLC operated an embroidery and screen-printing business that relied on a computer server, software, and stored artwork files.
- In December 2016, ransomware infected the company’s server, blocking access to data and software.
- National Ink paid the initial bitcoin ransom, but the attacker demanded more and access was not restored; some files and software use were permanently lost and had to be recreated.
- National Ink hired an IT/security firm to remove the ransomware, reinstall software, and add protective software; the system remained slower and less efficient.
- Experts concluded remnants of the ransomware remained, leaving a continuing risk of reinfection; National Ink purchased a new server and related components.
- National Ink held a businessowners’ policy covering “direct physical loss of or damage to Covered Property,” and an endorsement defined covered property to include electronic media and records, including software and data.
- State Auto paid limited amounts for restoration-related items but denied coverage for replacing the computer system, asserting there was no direct physical loss or damage to hardware.
- The parties filed cross-motions for summary judgment on whether the ransomware incident triggered coverage for the replacement costs.

## Issues

1. Whether ransomware that renders insured software/data inaccessible or unreliable, and leaves a system functionally impaired and vulnerable to reinfection, constitutes “direct physical loss of or damage to” covered property.
2. Whether costs to replace the server and related components are covered losses resulting from that direct physical loss or damage.

## Decision

- The court granted National Ink’s motion for summary judgment and denied State Auto’s cross-motion on coverage.
- The court held the ransomware incident caused “direct physical loss of or damage to” covered property because insured data, software, and system functionality were materially impaired and the system remained compromised.
- The court concluded that replacement of the server and related components was a covered consequence of the covered loss, subject to policy terms and limits.

## Legal Principles

- Policy language controls; when a property policy expressly includes electronic media, software, and data as covered property, “physical loss or damage” is not limited to structural alteration of tangible hardware.
- Corruption, loss of access, or alteration of insured data/software that materially impairs usability, reliability, or functionality can qualify as direct physical loss or damage.
- “Physical loss” may exist without total destruction or complete inoperability; significant functional impairment tied to covered property can satisfy the coverage trigger.
- Once direct physical loss or damage is shown, reasonable replacement costs incurred because the insured system remains compromised can fall within covered loss, subject to applicable conditions and limits.

## Conclusion

The court held that a ransomware attack can cause direct physical loss or damage under a commercial property policy that treats electronic media, software, and data as covered property, and it required the insurer to cover replacement system costs attributable to the impairment and continuing compromise of the insured computer system.


Nat’l Ink & Stitch, LLC v. State Auto Prop. & Cas. Ins. Co., 435 F. Supp. 3d 679 (D. Md. 2020)