Ransomware attacks have emerged as one of the most significant cyber threats to businesses worldwide, causing financial losses, operational disruptions, and regulatory complications. As companies seek insurance protection against these risks, the legal landscape governing ransomware-related claims remains unsettled. A key case that highlights these challenges is Emoi Services LLC v. Owners Insurance Company, where the Ohio Supreme Court ruled that ransomware encryption does not constitute “direct physical loss or damage” under a standard property insurance policy. This decision underscores a major limitation in traditional insurance coverage for cyber incidents and raises important questions about how different jurisdictions interpret such claims.
The Emoi case involved a ransomware attack that encrypted Emoi Services’ software, rendering its systems inoperable. The company paid a ransom of approximately $35,000 to regain access to its data and subsequently filed a claim under its business insurance policy. However, the insurer denied coverage, arguing that the policy required physical loss or damage to trigger payment. The Ohio Supreme Court agreed, stating that software is intangible and cannot experience direct physical damage, setting a precedent that restricts coverage under standard business insurance policies. This decision aligns with similar rulings in the United States, such as Sentinel Insurance Co. v. Prince & Sons Inc., where a court ruled that electronic data loss did not meet the definition of physical damage. However, not all U.S. cases have followed this logic. In National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Co., a federal court in Maryland took a broader approach, ruling that data corruption could be considered physical loss. This inconsistency has led to uncertainty in the cyber insurance market.
Internationally, courts and insurers have taken diverse approaches to ransomware coverage. In the United Kingdom, insurance policies have been interpreted more favorably for policyholders in cases involving digital losses. The Financial Conduct Authority (FCA) test case during the COVID-19 pandemic demonstrated that business interruptions, even in non-physical scenarios, could trigger insurance coverage. While this case focused on pandemic-related losses, it suggests that U.K. courts may adopt a more expansive view when considering cyber insurance claims. Additionally, many insurers in the U.K. offer standalone cyber insurance policies that explicitly cover ransomware incidents, reducing reliance on traditional property insurance.
In Europe, particularly in Germany and France, insurance policies are often structured to recognize software damage and data encryption as legitimate losses. Unlike in the U.S., where courts debate whether software damage qualifies as “physical,” European insurers have adapted their policies to explicitly cover cyber risks. Regulatory frameworks such as the General Data Protection Regulation (GDPR) also play a role, incentivizing companies to secure comprehensive cyber insurance due to potential fines for data breaches. The result is a more policyholder-friendly approach where businesses are less likely to face coverage disputes over ransomware-related claims.
Asia is also experiencing an evolving cyber insurance market. In Singapore and Japan, cyber insurance policies are increasingly including business interruption due to ransomware, even when there is no tangible damage to hardware. Insurers in these countries recognize that modern business operations rely on digital assets, and the loss of access to these assets can be as damaging as physical destruction. China, while still developing its cyber insurance sector, has strong regulatory oversight that mandates robust cybersecurity measures, which in turn influences how insurers structure their policies.
One global trend that emerges from these cases is the shift towards dedicated cyber insurance policies. As courts in jurisdictions like the U.S. restrict coverage under traditional business and property insurance, insurers are increasingly offering standalone cyber policies tailored to ransomware and other digital threats. At the same time, insurers are tightening policy exclusions, explicitly stating that cyber incidents will not be covered under general business policies unless a separate cyber endorsement is purchased. Furthermore, some insurers are limiting ransomware coverage or requiring companies to implement stringent cybersecurity protocols before qualifying for insurance.
The Emoi ruling reflects a broader debate on whether ransomware attacks should be classified as causing physical damage or merely digital disruptions. While some courts maintain a strict interpretation requiring tangible harm, others recognize that loss of functionality and access to data can be just as financially devastating. This divergence creates challenges for businesses operating internationally, as the likelihood of a successful claim depends on jurisdictional differences in legal interpretation.
To navigate these challenges, businesses should carefully review their insurance policies to understand coverage limitations, consider investing in specialized cyber insurance, and implement robust cybersecurity measures to mitigate risks. As cyber threats continue to evolve, so too must the legal and insurance frameworks that govern them. Companies must remain proactive in securing adequate coverage and adapting to shifting legal landscapes. The Emoi case serves as a reminder that not all ransomware damages are insurable under standard policies, reinforcing the importance of specialized coverage and legal clarity.
References
Financial Conduct Authority. “Business Interruption Insurance Test Case: The Supreme Court Judgment.” January 15, 2021.
National Ink and Stitch, LLC v. State Auto Property and Casualty Insurance Co., No. 1:18-cv-00206 (D. Md. Jan. 23, 2020).
Sentinel Insurance Co. v. Prince & Sons Inc., No. 1:20-cv-00090 (D.N.H. Dec. 4, 2020).
Emoi Services, LLC v. Owners Insurance Co., 2024 Ohio Supreme Court.
“Takeaways from Ohio Court Ruling on Ransomware and Insurance Exclusions.” IAPP News, March 2025.
Glossary
Business Interruption Insurance – A type of insurance that covers lost income and expenses when a business is unable to operate due to an insured event.
Cyber Insurance – A specialized insurance policy designed to cover losses resulting from cyber incidents such as ransomware attacks, data breaches, and system disruptions.
General Data Protection Regulation (GDPR) – A European Union regulation that sets strict data protection and privacy requirements for businesses handling personal data.
Physical Damage Requirement – A standard insurance principle that requires tangible harm to property before coverage is triggered.
Ransomware – A type of malware that encrypts data or locks users out of their systems until a ransom is paid.
Standalone Cyber Policy – A dedicated insurance policy that specifically covers cyber risks, including ransomware attacks, data breaches, and cyber extortion.
This comparison of the Emoi case with global trends highlights the evolving nature of ransomware insurance coverage. While the U.S. courts remain divided, international markets are increasingly recognizing the importance of explicit coverage for digital losses, signaling a shift toward more comprehensive cyber risk management.
Leave a Reply