A recent district court ruling highlights that in the aftermath of a cyberattack, even non-cyberinsurance policies could be required to pay up even if there's no "direct physical loss."

Last week a Maryland federal court judge ruled in National Ink and Stitch v. State Auto Property and Casualty Insurance that State Auto Property and Casualty Insurance Co. must cover the cost to replace National Ink and Stitch's damaged computer systems after a ransomware attack.

State Auto argued there was no "direct physical loss" and its general liability policy didn't apply. However, the court found State Auto's amended policy covering electronic media and case law didn't require physical loss or damage to a computer system to make it unusable.

Courts around the country, however, have differed over finding no direct loss is covered by an insurance policy, lawyers said.

Last May, McDermott Will & Emery published a blog highlighting the courts' evolving approach to cyberinsurance. The firm noted the Ninth Circuit's Pestmaster Servs. v. Travelers Cas. & Sur. of Am. 2016 decision, the Fifth Circuit's 2016 Apache v. Great Am. Insurance decision, and 2018's Interactive Communications Int'l v. Great Am. Insurance in the Eleventh Circuit as rulings that found there were no direct losses in specific cyberattacks that policies had to cover. 

However, in 2018 the U.S. Court of Appeals for the Sixth Circuit ruled that losses after a spear phishing attack were covered under a cyberinsurance computer fraud policy. The Sixth Circuit followed a first-of-its-kind 2017 decision in the U.S. District Court for the Southern District of New York that also found data loss after a phishing attack was covered under a cyberinsurance policy.

Holland & Knight insurance partner Thomas Bentz said courts will likely remain inconsistent as insurance companies' policies vary.

"This is a new issue; it's been inconsistent and it's going to be," Bentz said. "These cases have low precedential values, from one policy to the next you have different forms and carriers."

Instead of waiting for consistency in the court, Bentz said many insurance companies are tightening the wording of their coverage to prevent broad claim requests.

"Most carriers have made changes to their liability claims. Some have made it clearer they won't provide that," Bentz said. He added that insurance providers are attempting to make policies that are "general enough that it makes sense but at the same time keeps it off of the other lines of a policy where appropriate. I don't think we've come up with the right formula yet."

Still, Hunton Andrews Kurth insurance litigation partner Walter Andrews noted National Ink and Stitch was a welcomed decision for insureds. The fact that State Auto's policy wasn't a cyber policy but the policyholder was still able to obtain payment shows a business doesn't need to have a cyber policy to get coverage for cyber loss, he said.

"In fact, this is a prime example of what the insurance industry refers to as 'silent cyber,' meaning that there is cyberinsurance coverage even under insurance policies not specifically designed and marketed for those risks," said Andrews. "It is why insurers need to underwrite and reserve for such exposures as losses from cyber attacks may not be fully accounted for under non-cyber policy lines of coverage."