A local Maryland embroidery and silk-screening company is suing its insurance carrier due to a Locked-In ransomware attack.
In July, National Ink and Stitch, LLC, filed a lawsuit against State Auto Insurance Companies in the District Court of Maryland. National Ink alleges that in December 2016, it discovered that its computer system was infected with the Locked-In ransomware. The ransomware completely shut down the company's computer system and destroyed software and data, including hundreds of thousands of dollars of artwork and other proprietary data.
National Ink hired eTrepid to eradicate the ransomware. Considering the cost of wiping the system and the chances that the virus could lay dormant, eTrepid recommended that National Ink replace its computer system. The cost for eTrepid to replace the computer system and business data exceeded $310,000.
National Ink had a business owners insurance policy through State Auto that had liability limits of $310,000 for covered losses to "Business Personal Property." National Ink claims that the ransomware damaged its business personal property.
State Auto denied National Ink's claim for insurance, with the exception of a $5000 payment under the Data Compromise Plus Coverage Form of the Policy. State Auto's reason for denial was that the computer system, even if still infected with the ransomware "is fully operational, therefore replacing the equipment is a preventative measure and not the result of direct, physical damage to the computer hardware."
My 2 Cents
Based on the allegations in the Complaint, the Data Compromise Plus Coverage Form was designed and intended to cover a ransomware event, but it provided a sub-limit (not good). National Ink probably paid a lower premium for the sub-limit never thinking about the prospect of a ransomware attack.
Now, having suffered a ransomware attack, National Ink is unhappy with the sub-limit and is seeking insurance under a traditional general liability, or business owners, policy. Additionally, it appears that National Ink is seeking insurance for intellectual property losses and damage to digital property.
Insurance companies have generally obtained favorable results in these types of claims under general liability policies. These types of insurance policies were not designed or intended to cover losses resulting from ransomware.
It will be interesting to see the outcome of this case. Will it end in a settlement or a court decision leading to an appeal by the losing party?