Summary
finding "direct physical loss" where a computer needed to be replaced because of damage sustained in a ransomware attack
Summary of this case from Tapestry, Inc. v. Factory Mut. Ins. Co.Opinion
Civil Case No. SAG-18-2138
2020-01-23
NATIONAL INK AND STITCH, LLC, Plaintiff, v. STATE AUTO PROPERTY AND CASUALTY INSURANCE COMPANY, Defendant.
Kathleen M. McDonald, Kerr McDonald LLP, Baltimore, MD, for Plaintiff. Matthew Malamud, William Owen Krekstein, Pro Hac Vice, Timoney Knox, LLP, Fort Washington, PA, for Defendant.
Kathleen M. McDonald, Kerr McDonald LLP, Baltimore, MD, for Plaintiff.
Matthew Malamud, William Owen Krekstein, Pro Hac Vice, Timoney Knox, LLP, Fort Washington, PA, for Defendant.
MEMORANDUM OPINION
Stephanie A. Gallagher, United States District Judge
Plaintiff National Ink & Stitch, LLC ("Plaintiff") filed this case against its businessowners' insurance carrier, State Auto Property and Casualty Insurance Company ("State Auto"), seeking coverage for damage alleged to have been sustained to its computer system in a ransomware attack. The parties have filed cross-motions for summary judgment, ECF 35 ("State Auto's Motion"), ECF 36 ("Plaintiff's Motion"), and oppositions to the respective motions, ECF 37, 38. I have reviewed the filings, and no hearing is necessary. See Loc. R. 105.6 (D. Md. 2018). For the reasons that follow, I will grant Plaintiff's Motion and deny State Auto's Motion.
I. FACTUAL BACKGROUND
The facts in this case are largely undisputed. Plaintiff's embroidery and screen printing business was covered by a State Auto businessowner's insurance policy, number BOP2870198, between March 31, 2016 and March 31, 2017 ("the Policy"). ECF 35-2. Plaintiff stored art, logos, and designs for its business on its computer server. ECF 35-3 at 22-23. The server also housed graphic arts software, shop management software, embroidery software, and webstore management software. Id. at 42-45.
In December, 2016, Plaintiff's computer server and networked computers experienced a ransomware attack, which prevented Plaintiff from accessing all of the art files and other data contained on the server, and all of its software, except for the embroidery software. Id. at 54-55. The attacker demanded payment of a bitcoin to release access to the software and data. Id. at 58, 69. Although Plaintiff made the requested payment, the attacker demanded further payment and refused to release the software and data. Id. at 69-76 (stating "we got the executable file but now we needed to pay another Bitcoin if we wanted the configuration file."). Plaintiff employed a security company to replace and reinstall its software, and to install protective software on its computer system. Id. at 79-81. In the end, although Plaintiff's computers still functioned, the installation of protective software slowed the system and resulted in a loss of efficiency. Id. at 80-81 (describing the system as "a lot slower than it was because of all the protective measures they put in place"). The art files formerly stored on the server cannot be accessed, and Plaintiff either has or will have to recreate them. Id. at 82. The computer experts testified that there are likely dormant remnants of the ransomware virus in the system, that could "re-infect the entire system." ECF 35-3 at 61 (Interrogatory Response #3). The options, to eliminate the risk of further infection, would be to "wipe" the entire system and reinstall all of the software and information, or to purchase an entirely new server and components. Id.
The Policy provides, in relevant part, that State Auto:
will pay for direct physical loss of or damage to Covered Property at the premises described in the Declarations caused by or resulting from any Covered Cause of Loss.
ECF 35-2 at 35. The Businessowners Special Form Computer Coverage endorsement expressly defines "Covered Property" to include "Electronic Media and Records (Including Software)," and defines "Electronic Media and Records" to include:
(a) Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells;
(b) Data stored on such media
Id. at 61.
Plaintiff presented a claim to State Auto on December 16, 2016, regarding the ransomware attack. ECF 35-1 at 5. However, State Auto denied coverage for the cost of replacing Plaintiff's computer system. Id. The parties dispute whether Plaintiff experienced "direct physical loss of or damage to" its computer system, to justify reimbursement of the replacement cost for the entire system under the Policy.
II. LEGAL STANDARD
Under Rule 56(a) of the Federal Rules of Civil Procedure, summary judgment is appropriate only "if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." The moving party bears the burden of showing that there is no genuine dispute of material facts. See Casey v. Geek Squad , 823 F. Supp. 2d 334, 348 (D. Md. 2011) (citing Pulliam Inv. Co. v. Cameo Props. , 810 F.2d 1282, 1286 (4th Cir. 1987) ). If the moving party establishes that there is no evidence to support the non-moving party's case, the burden then shifts to the non-moving party to proffer specific facts to show a genuine issue exists for trial. Id. The non-moving party must provide enough admissible evidence to "carry the burden of proof in [its] claim at trial." Id. at 349 (quoting Mitchell v. Data Gen. Corp. , 12 F.3d 1310, 1315-16 (4th Cir. 1993) ). The mere existence of a scintilla of evidence in support of the non-moving party's position will be insufficient; there must be evidence on which the jury could reasonably find in its favor. Id. at 348 (citing Anderson v. Liberty Lobby, Inc. , 477 U.S. 242, 251, 106 S.Ct. 2505, 91 L.Ed.2d 202 (1986) ). Moreover, a genuine issue of material fact cannot rest on "mere speculation, or building one inference upon another." Id. at 349 (quoting Miskin v. Baxter Healthcare Corp. , 107 F. Supp. 2d 669, 671 (D. Md. 1999) ).
Additionally, summary judgment shall be warranted if the non-moving party fails to provide evidence that establishes an essential element of the case. Id. at 352. The non-moving party "must produce competent evidence on each element of [its] claim." Id. at 348-49 (quoting Miskin , 107 F. Supp. 2d at 671 ). If the non-moving party fails to do so, "there can be no genuine issue as to any material fact," because the failure to prove an essential element of the case "necessarily renders all other facts immaterial." Id. at 352 (quoting Celotex Corp. v. Catrett , 477 U.S. 317, 322-23, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986) ; Coleman v. United States , 369 F. App'x 459, 461 (4th Cir. 2010) (unpublished)). In ruling on a motion for summary judgment, a court must view all of the facts, including reasonable inferences to be drawn from them, "in the light most favorable to the party opposing the motion." Matsushita Elec. Indus. Co. v. Zenith Radio Corp. , 475 U.S. 574, 587-88, 106 S.Ct. 1348, 89 L.Ed.2d 538 (1986) (quoting United States v. Diebold, Inc. , 369 U.S. 654, 655, 82 S.Ct. 993, 8 L.Ed.2d 176 (1962) ).
III. ANALYSIS
The parties agree that Maryland law governs their dispute. See, e.g. , ECF 35-1 at 6, 36-1 at 9 (discussing Maryland precedent). Accordingly, this Court will apply standard principles of contractual interpretation to decide whether Plaintiff suffered "direct physical loss of or damage to" its computer system. See People's Ins. Counsel Div. v. State Farm Fire & Cas. Ins. Co., 214 Md. App. 438, 453, 76 A.3d 517 (2013) (explaining that interpretation of an insurance policy is subject to principles of contract interpretation); see also United Services Auto. Ass'n v. Riley , 393 Md. 55, 78, 899 A.2d 819 (2006) ("Contract interpretation is undoubtedly a question of law that may be properly determined on summary judgment."). State Auto contends that because Plaintiff only lost data, an intangible asset, and could still use its computer system to operate its business, it did not experience "direct physical loss" as covered by the Policy. ECF 35-1. Plaintiff counters that the Policy's language contemplates computer data and software to be property subject to "direct physical loss," ECF 36-1 at 2, and that its computer system itself sustained damage, in the form of impaired functioning. ECF 36-1 at 5-6, ECF 38 at 2. As detailed below, Plaintiff can recover based on either (1) the loss of data and software in its computer system, or (2) the loss of functionality to the computer system itself.
A. Loss of Data and Software
As always, the analysis of a contract begins with its plain language. "Maryland follows the law of objective contract interpretation." Sy-Lene of Washington, Inc. v. Starwood Urban Retail II, LLC, 376 Md. 157, 166, 829 A.2d 540 (2003). Under that standard, "the written language embodying the terms of an agreement will govern the rights and liabilities of the parties, irrespective of the intent of the parties at the time they entered the contract." Long v. State, 371 Md. 72, 84, 807 A.2d 1 (2002). Here, the Policy expressly lists "data" as an example of Covered Property under its definition of "Electronic Media and Records (Including Software)." ECF 35-2 at 61. While the term "data" is qualified with the phrase "stored on such media," if the Policy intended to require physical loss or damage to the media itself, as opposed to just the data, it could have stopped at subsection (a), which describes the covered media. Id. Instead, the Policy includes "data stored on such media" as a separate subcategory of Covered Property in subsection (b). Id. The Policy also contains the phrase "Including Software" in its heading describing covered property. Id. Thus, the plain language of the Policy contemplates that data and software are covered and can experience "direct physical loss or damage."
This interpretation of the Policy's plain language comports with the interpretations reached by the majority of courts interpreting similar policies. Although Maryland courts have not expressly decided whether data or software can be susceptible to physical loss or damage, the various cases cited by the parties are instructive.
For its part, State Auto relies almost entirely on Ward Gen. Ins. Servs., Inc. v. Employers Fire Ins. Co. , 114 Cal. App. 4th 548, 7 Cal.Rptr.3d 844 (2003). In Ward , an employee of an insurance company inadvertently caused its computer database to "crash," resulting in the loss of electronically stored client data. Id. at 550, 7 Cal.Rptr.3d 844. The plaintiff was able to restore and reconstruct the database, but incurred substantial consulting costs, extra payroll cost, and loss of business income due to the disruption. Id. at 550-51, 7 Cal.Rptr.3d 844. The plaintiff sought coverage under its business insurance policy, which, like the Policy in this case, required "direct physical loss of or damage to" its property. Id. at 551, 7 Cal.Rptr.3d 844. The Ward Court noted, "Plaintiff did not claim the replacement or repair cost for any item of hardware or the storage medium," instead seeking only extra labor expenses and lost business income. Id. at 553, 7 Cal.Rptr.3d 844. Thus, the issue presented in Ward was whether the policy's coverage of "direct physical loss" included "the loss of electronically stored data, without any loss or damage to the storage media or to any other property." Id. at 555, 7 Cal.Rptr.3d 844. The Ward court concluded that it did not. Id.
The instant case is readily distinguishable from Ward . The costs sought by Plaintiff are the replacement costs for its hardware and software — in other words, its entire computer system. State Auto's contention that Plaintiff's only loss or damage is to its data, like the situation in Ward , is unpersuasive. Plaintiff does not seek solely the costs of replacing its customer data. It seeks a fully functioning computer system not (1) slowed by the necessary remedial and protective measures, or (2) at risk of reinfection from a dormant virus.
State Auto also cites State Auto Prop. and Cas. Ins. Co. v. Midwest Comp. & More , 147 F. Supp. 2d 1113 (W. D. Okla. 2001). That case interpreted markedly different policy language requiring, "[p]hysical injury to tangible property, including all resulting loss of use of that property" or "loss of use of tangible property that is not physically injured." Id. at 1114. The court concluded that because computer data "cannot be touched, held, or sensed by the human mind; it has no physical substance. It is not tangible property." Id. at 1116. The court went on to state, though, "Because a computer clearly is tangible property, an alleged loss of use of computers constitutes ‘property damage’ within the meaning of plaintiff's policy." Id.
The instant Policy does not limit coverage to "tangible property." To the contrary, as noted above, the Policy expressly includes "data" and "software" as categories of "covered property." ECF 35-2 at 61. The facts presented, then, are more similar to a line of cases holding, in plaintiffs' favor, that the type of damage suffered by Plaintiff constitutes "direct physical loss or damage." In one such case, Lambrecht & Assocs., Inc. v. State Farm Lloyds , 119 S.W.3d 16, 19 (Tx. Ct. App. 2003), a hacker infected Lambrecht's business computer system with a virus. Lambrecht lost all of the information that had been stored on its system, and was unable to load any new information. Id. Accordingly, Lambrecht "had to replace its server, purchase a new operating system and other pre-packaged software, and manually re-enter much of its data." Id. State Farm, like State Auto here, argued that "the loss of information on Lambrecht's computer systems was not a ‘physical’ loss because the data on Lambrecht's computers did not exist in physical or tangible form." Id. at 23-24. The court disagreed, noting that the policy defined "electronic media and records" as "electronic data processing, recording or storage media such as films, tapes, discs, drums or cells; data stored on such media; or programming records used for electronic data processing or electronically controlled equipment." Id. at 25. The court reasoned that "the server falls within the definition of ‘electronic media and records’ because it contains a hard drive or ‘disc’ which could no longer be used for ‘electronic data processing, recording, or storage.’ " Id. Further, the data was protected because it was the "data stored on such media." Id.
Despite the direct parallels with this case, State Auto suggests that Lambrecht supports its position, because the server in the Lambrecht case was fully incapacitated, while Plaintiff's server still functions, albeit more slowly, to conduct new business. ECF 37 at 5-6. That argument neglects the plain language of the Policy, which protects against not only "physical loss" but also "damage to" both the media and the data. While Plaintiff's computer system retains certain functionality, it has been rendered slow and inefficient, and its storage capability was damaged such that its contents (namely the data and software) cannot be retrieved. Case law cited by State Auto does not suggest that, for damage to be covered, a computer system must be completely and permanently inoperable. Further, as the Lambrecht court recognized, there is an inherent contradiction between the language of the Policy and the position State Auto espouses. The Policy refers to "Electronic Media and Records (and Software)." By State Auto's definition, damage to software, and the data stored within it, could never be covered, because software is not physical. Just as the Lambrecht court concluded, "The plain language of the policy's provisions and definitions dictates that such property is capable of sustaining a ‘physical’ loss." Lambrecht, 119 S.W. 3d at 26.
Similarly, in an unpublished Fourth Circuit case, NMS Servs. Inc. v. The Hartford , 62 F. App'x. 511, 512 (4th Cir. 2003), the Fourth Circuit found insurance coverage to exist for "erasure of vital computer files and databases necessary for the operation of the company's manufacturing, sales, and administrative systems." The loss was sustained after a former employee and computer hacker installed hacking programs on the network during his employment. Id. The company's insurance policy provided coverage for lost business income sustained as a result of "direct physical loss of or damage to property." Id. at 514. The Court stated, "There is no question that NMS suffered damage to its property, specifically, damage to the computers it owned." Id. at 514. In a concurring opinion, Judge Widener explained that "when the employee erased the data on NMS's computers, this erasure was in fact a ‘direct physical loss’ under the requirements of the policy." Id. at 515 ("Indeed, a computer stores information by the rearrangement of the atoms or molecules of a disc or tape to effect the formation of a particular order of magnetic impulses, and a meaningful sequence of magnetic impulses cannot float in space.") (internal citation omitted).
Finally, while not squarely on point, the rationale of the Maryland Court of Appeals in Comptroller of the Treasury v. Equitable Trust Co. , 296 Md. 459, 464 A.2d 248 (1983) suggests that Maryland would align with Lambrecht , instead of with Ward . In Equitable Trust Co ., the Court considered whether computer software programs constituted tangible property subject to Maryland's Sales Tax Act. Id. at 461-62, 464 A.2d 248. The Court found that, although the intended use of the software might sever it from the tangible form in which it was originally transmitted, the act of copying the software to computer memory did not render it intangible. Id. at 485, 464 A.2d 248. It concluded, "that the statute does not sever copies of computer programs from the tangible carriers employed in the subject sales." Id. By that logic, Maryland courts would find physical damage to Plaintiff's computer software, despite its installation on Plaintiff's computer system, because the software was rendered entirely unusable by the ransomware attack.
B. Loss of Functionality
In addition to Plaintiffs' data and software constituting covered property under the Policy's terms, Plaintiff has also demonstrated damage to the computer system itself, despite its residual ability to function. Again, the parties' cited cases are instructive. In American Guarantee & Liab. Ins. Co. v. Ingram Micro, Inc. , Civ. No. 99-185-TUC ACM, 2000 WL 726789, at *1 (D. Ariz. April 18, 2000), a power outage rendered Ingram's computer systems inoperable. After the event, all of the programming information disappeared from the system's random access memory, and Ingram's custom configurations were altered. Id. at *2. Ingram had to reprogram the custom configurations in order to restore functionality. Id. The insurance company argued that, because the computer system and matrix switch still had the "capability to perform their intended functions" after reprogramming, they were not "physically damaged." Id. The Court reasoned, however, that " ‘physical damage’ is not restricted to the physical destruction or harm of computer circuitry but includes loss of access, loss of use, and loss of functionality." Id. Thus, the Court found that Ingram had suffered physical damage to its computer system during the period prior to the restorative work, and that coverage therefore existed under its policy. Id. at *3. State Auto attempts to distinguish Ingram Micro by contending that the computer system was "inoperable" ECF 35-1 at 9. But the Court specifically noted that "the power outage did not adversely affect the equipment's inherent ability to accept and process data and configuration settings." 2000 WL 726789, at *2. Thus, the mere fact that the system retained some limited functions did not prevent the Court from finding that Ingram had suffered physical damage.
Likewise, in Southeast Mental Health Ctr., Inc. v. Pacific Ins. Co., LTD , 439 F. Supp. 2d 831, 833-34 (W.D. Tenn. 2006), a hurricane led to a power outage in a pharmacy, which resulted in the loss of data from the pharmacy's computer. The insurance carrier argued that Plaintiff's lost business income was not recoverable because the "losses were not caused by direct physical loss of or damage to the insured property." Id. at 834. However, the Court found "that the corruption of the pharmacy computer constitutes ‘direct physical loss of or damage to property’ under the business interruption policy." Id. at 838. The Court cited Ingram for the proposition that "loss of access, loss of use, and loss of functionality" fall within the definition of direct "physical damage." Id. at 838.
Finally, in Ashland Hospital Corp. v. Affiliated FM Ins. Co. , 2013 WL 4400516, at *1 (E.D. Ky Aug. 14, 2013), a hospital's air conditioning equipment malfunctioned in its data center, causing its computer data storage network to overheat and fail. Some data was corrupted, and needed to be restored from a backup system. Id. Although the unit remained functional, the hospital's technology expert recommended replacement "due to the long term reliability and data integrity issues" resulting from the overheating. Id. The defense expert opined that the system "had not sustained any damage or loss of reliability." Id. at *2. However, the Ashland court concluded that "direct physical loss or damage" includes a loss of reliability. Id. at *4. The Court specifically declined to adopt a definition of "direct physical loss or damage" that requires proof of a permanent loss in the ability to function. Id. at *6. Instead, it concluded that the value in a system is its reliability, and a plaintiff therefore need not await total failure in order to avail itself of coverage for the damage the system had sustained. Id.
In the instant case, State Auto seems to equate "physical loss or damage" to Plaintiff's computer system to require an utter inability to function. The Policy language, and the relevant case law, impose no such prerequisite. The more persuasive cases are those suggesting that loss of use, loss of reliability, or impaired functionality demonstrate the required damage to a computer system, consistent with the "physical loss or damage to " language in the Policy (emphasis added). Indeed, in many instances, a computer will suffer "damage" without becoming completely inoperable. Here, not only did Plaintiff sustain a loss of its data and software, but Plaintiff is left with a slower system, which appears to be harboring a dormant virus, and is unable to access a significant portion of software and stored data. Because the plain language of the Policy provides coverage for such losses and damage, summary judgment will be granted in favor of Plaintiff's interpretation of the Policy terms.
CONCLUSION
For the reasons set forth above, Plaintiff's Motion for Summary Judgment, ECF 36, will be GRANTED as to liability, and State Auto's Motion for Summary Judgment, ECF 35, will be DENIED. A separate Order follows, which directs the parties to confer and advise the Court, on or before January 31, 2020, whether a status hearing will be needed to address the appropriate remedy.