Ohio’s state Supreme Court has ruled that ransomware is not physical damage and is therefore not covered under a property insurance policy held by EMOI, an Ohio medical billing company. The court overturned a lower court ruling, finding in favor of Owners Insurance Company.
- Fully understand your cyber insurance limitations, including scheduling regular reviews of your coverage to make sure updates haven’t changed it. In this case the policy explicitly excluded coverage for “any threat, extortion or blackmail” including ransom payment. If you have questions, such as what constitutes physical damage, get clarification long before you file a claim. Review assumptions with your legal team, don’t assume your team is better than the insurance companies’ team.
- We continue to see enterprises prefer to assign the risk of ransomware rather than preventing it. It is not clear that the underwriters know how to write coverage that addresses the risk at a cost their customers are willing to pay and on which they can make a secure and adequate return. It may well be an over-constrained problem.
Read more in