IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF MARYLAND
*
*
*
*
*
*
*
*
*
*
*

NATIONAL INK AND STITCH, LLC,
Plaintiff,
v.
STATE AUTO PROPERTY AND
CASUALTY INSURANCE COMPANY,
Defendant.
*

*

*

*

*

*

*

Civil Case No. SAG-18-2138

*

*

*

*

*

*

MEMORANDUM OPINION
Plaintiff National Ink & Stitch, LLC (“Plaintiff”) filed this case against its businessowners’
insurance carrier, State Auto Property and Casualty Insurance Company (“State Auto”), seeking
coverage for damage alleged to have been sustained to its computer system in a ransomware attack.
The parties have filed cross-motions for summary judgment, ECF 35 (“State Auto’s Motion”),
ECF 36 (“Plaintiff’s Motion”), and oppositions to the respective motions, ECF 37, 38. I have
reviewed the filings, and no hearing is necessary. See Loc. R. 105.6 (D. Md. 2018). For the
reasons that follow, I will grant Plaintiff’s Motion and deny State Auto’s Motion.
I.

FACTUAL BACKGROUND
The facts in this case are largely undisputed. Plaintiff’s embroidery and screen printing

business was covered by a State Auto businessowner’s insurance policy, number BOP2870198,
between March 31, 2016 and March 31, 2017 (“the Policy”). ECF 35-2.

Plaintiff stored art,

logos, and designs for its business on its computer server. ECF 35-3 at 22-23. The server also
housed graphic arts software, shop management software, embroidery software, and webstore
management software. Id. at 42-45.

 In December, 2016, Plaintiff’s computer server and networked computers experienced a
ransomware attack, which prevented Plaintiff from accessing all of the art files and other data
contained on the server, and all of its software, except for the embroidery software. Id. at 54-55.
The attacker demanded payment of a bitcoin to release access to the software and data. Id. at 58,
69. Although Plaintiff made the requested payment, the attacker demanded further payment and
refused to release the software and data. Id. at 69-76 (stating “we got the executable file but now
we needed to pay another Bitcoin if we wanted the configuration file.”). Plaintiff employed a
security company to replace and reinstall its software, and to install protective software on its
computer system. Id. at 79-81. In the end, although Plaintiff’s computers still functioned, the
installation of protective software slowed the system and resulted in a loss of efficiency. Id. at 8081 (describing the system as “a lot slower than it was because of all the protective measures they
put in place”). The art files formerly stored on the server cannot be accessed, and Plaintiff either
has or will have to recreate them. Id. at 82. The computer experts testified that there are likely
dormant remnants of the ransomware virus in the system, that could “re-infect the entire system.”
ECF 35-3 at 61 (Interrogatory Response #3). The options, to eliminate the risk of further infection,
would be to “wipe” the entire system and reinstall all of the software and information, or to
purchase an entirely new server and components. Id.
The Policy provides, in relevant part, that State Auto:
will pay for direct physical loss of or damage to Covered Property at the premises
described in the Declarations caused by or resulting from any Covered Cause of
Loss.
ECF 35-2 at 35. The Businessowners Special Form Computer Coverage endorsement expressly
defines “Covered Property” to include “Electronic Media and Records (Including Software),” and
defines “Electronic Media and Records” to include:

2

 (a) Electronic data processing, recording or storage media such as films, tapes, discs,
drums or cells;
(b) Data stored on such media
Id. at 61.
Plaintiff presented a claim to State Auto on December 16, 2016, regarding the ransomware
attack. ECF 35-1 at 5. However, State Auto denied coverage for the cost of replacing Plaintiff’s
computer system. Id. The parties dispute whether Plaintiff experienced “direct physical loss of or
damage to” its computer system, to justify reimbursement of the replacement cost for the entire
system under the Policy.
II.

LEGAL STANDARD
Under Rule 56(a) of the Federal Rules of Civil Procedure, summary judgment is

appropriate only “if the movant shows that there is no genuine dispute as to any material fact and
the movant is entitled to judgment as a matter of law.” The moving party bears the burden of
showing that there is no genuine dispute of material facts. See Casey v. Geek Squad, 823 F. Supp.
2d 334, 348 (D. Md. 2011) (citing Pulliam Inv. Co. v. Cameo Props., 810 F.2d 1282, 1286 (4th
Cir. 1987)). If the moving party establishes that there is no evidence to support the non-moving
party’s case, the burden then shifts to the non-moving party to proffer specific facts to show a
genuine issue exists for trial. Id. The non-moving party must provide enough admissible evidence
to “carry the burden of proof in [its] claim at trial.” Id. at 349 (quoting Mitchell v. Data Gen.
Corp., 12 F.3d 1310, 1315-16 (4th Cir. 1993)). The mere existence of a scintilla of evidence in
support of the non-moving party’s position will be insufficient; there must be evidence on which
the jury could reasonably find in its favor. Id. at 348 (citing Anderson v. Liberty Lobby, Inc., 477
U.S. 242, 251 (1986)).

Moreover, a genuine issue of material fact cannot rest on “mere

3

 speculation, or building one inference upon another.” Id. at 349 (quoting Miskin v. Baxter
Healthcare Corp., 107 F. Supp. 2d 669, 671 (D. Md. 1999)).
Additionally, summary judgment shall be warranted if the non-moving party fails to
provide evidence that establishes an essential element of the case. Id. at 352. The non-moving
party “must produce competent evidence on each element of [its] claim.” Id. at 348-49 (quoting
Miskin, 107 F. Supp. 2d at 671). If the non-moving party fails to do so, “there can be no genuine
issue as to any material fact,” because the failure to prove an essential element of the case
“necessarily renders all other facts immaterial.” Id. at 352 (quoting Celotex Corp. v. Catrett, 477
U.S. 317, 322-23 (1986); Coleman v. United States, 369 F. App’x 459, 461 (4th Cir. 2010)
(unpublished)). In ruling on a motion for summary judgment, a court must view all of the facts,
including reasonable inferences to be drawn from them, “in the light most favorable to the party
opposing the motion.” Matsushita Elec. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 587-88
(1986) (quoting United States v. Diebold, Inc., 369 U.S. 654, 655 (1962)).
III.

ANALYSIS
The parties agree that Maryland law governs their dispute. See, e.g., ECF 35-1 at 6, 36-1

at 9 (discussing Maryland precedent). Accordingly, this Court will apply standard principles of
contractual interpretation to decide whether Plaintiff suffered “direct physical loss of or damage
to” its computer system. See People’s Ins. Counsel Div. v. State Farm Fire & Cas. Ins. Co., 214
Md. App. 438, 453 (2013) (explaining that interpretation of an insurance policy is subject to
principles of contract interpretation); see also United Services Auto. Ass’n v. Riley, 393 Md. 55,
78 (2006) (“Contract interpretation is undoubtedly a question of law that may be properly
determined on summary judgment.”). State Auto contends that because Plaintiff only lost data, an
intangible asset, and could still use its computer system to operate its business, it did not experience

4

 “direct physical loss” as covered by the Policy. ECF 35-1. Plaintiff counters that the Policy’s
language contemplates computer data and software to be property subject to “direct physical loss,”
ECF 36-1 at 2, and that its computer system itself sustained damage, in the form of impaired
functioning. ECF 36-1 at 5-6, ECF 38 at 2. As detailed below, Plaintiff can recover based on either
(1) the loss of data and software in its computer system, or (2) the loss of functionality to the
computer system itself.
A. Loss of Data and Software
As always, the analysis of a contract begins with its plain language. “Maryland follows the
law of objective contract interpretation.” Sy-Lene of Washington, Inc. v. Starwood Urban Retail
II, LLC, 376 Md. 157, 166 (2003). Under that standard, “the written language embodying the
terms of an agreement will govern the rights and liabilities of the parties, irrespective of the intent
of the parties at the time they entered the contract.” Long v. State, 371 Md. 72, 84 (2002). Here,
the Policy expressly lists “data” as an example of Covered Property under its definition of
“Electronic Media and Records (Including Software).” ECF 35-2 at 61. While the term “data” is
qualified with the phrase “stored on such media,” if the Policy intended to require physical loss or
damage to the media itself, as opposed to just the data, it could have stopped at subsection (a),
which describes the covered media. Id. Instead, the Policy includes “data stored on such media”
as a separate subcategory of Covered Property in subsection (b). Id. The Policy also contains the
phrase “Including Software” in its heading describing covered property. Id. Thus, the plain
language of the Policy contemplates that data and software are covered and can experience “direct
physical loss or damage.”
This interpretation of the Policy’s plain language comports with the interpretations reached
by the majority of courts interpreting similar policies. Although Maryland courts have not

5

 expressly decided whether data or software can be susceptible to physical loss or damage, the
various cases cited by the parties are instructive.
For its part, State Auto relies almost entirely on Ward Gen. Ins. Servs., Inc. v. Employers
Fire Ins. Co., 114 Cal. App. 4th 548 (2003). In Ward, an employee of an insurance company
inadvertently caused its computer database to “crash,” resulting in the loss of electronically stored
client data. Id. at 550. The plaintiff was able to restore and reconstruct the database, but incurred
substantial consulting costs, extra payroll cost, and loss of business income due to the disruption.
Id. at 550-51. The plaintiff sought coverage under its business insurance policy, which, like the
Policy in this case, required “direct physical loss of or damage to” its property. Id. at 551. The
Ward Court noted, “Plaintiff did not claim the replacement or repair cost for any item of hardware
or the storage medium,” instead seeking only extra labor expenses and lost business income. Id. at
553. Thus, the issue presented in Ward was whether the policy’s coverage of “direct physical loss”
included “the loss of electronically stored data, without any loss or damage to the storage media
or to any other property.” Id. at 555. The Ward court concluded that it did not. Id.
The instant case is readily distinguishable from Ward. The costs sought by Plaintiff are the
replacement costs for its hardware and software — in other words, its entire computer system.
State Auto’s contention that Plaintiff’s only loss or damage is to its data, like the situation in Ward,
is unpersuasive. Plaintiff does not seek solely the costs of replacing its customer data. It seeks a
fully functioning computer system not (1) slowed by the necessary remedial and protective
measures, or (2) at risk of reinfection from a dormant virus.
State Auto also cites State Auto Prop. and Cas. Ins. Co. v. Midwest Comp. & More, 147 F.
Supp. 2d 1113 (W. D. Okla. 2001). That case interpreted markedly different policy language
requiring, “[p]hysical injury to tangible property, including all resulting loss of use of that

6

 property” or “loss of use of tangible property that is not physically injured.” Id. at 1114. The court
concluded that because computer data “cannot be touched, held, or sensed by the human mind; it
has no physical substance. It is not tangible property.” Id. at 1116. The court went on to state,
though, “Because a computer clearly is tangible property, an alleged loss of use of computers
constitutes ‘property damage’ within the meaning of plaintiff’s policy.” Id.
The instant Policy does not limit coverage to “tangible property.” To the contrary, as noted
above, the Policy expressly includes “data” and “software” as categories of “covered property.”
ECF 35-2 at 61. The facts presented, then, are more similar to a line of cases holding, in plaintiffs’
favor, that the type of damage suffered by Plaintiff constitutes “direct physical loss or damage.”
In one such case, Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16, 19 (Tx. Ct.
App. 2003), a hacker infected Lambrecht’s business computer system with a virus. Lambrecht lost
all of the information that had been stored on its system, and was unable to load any new
information. Id. Accordingly, Lambrecht “had to replace its server, purchase a new operating
system and other pre-packaged software, and manually re-enter much of its data.” Id. State Farm,
like State Auto here, argued that “the loss of information on Lambrecht’s computer systems was
not a ‘physical’ loss because the data on Lambrecht’s computers did not exist in physical or
tangible form.” Id. at 23-24. The court disagreed, noting that the policy defined “electronic media
and records” as “electronic data processing, recording or storage media such as films, tapes, discs,
drums or cells; data stored on such media; or programming records used for electronic data
processing or electronically controlled equipment.” Id. at 25. The court reasoned that “the server
falls within the definition of “electronic media and records” because it contains a hard drive or
“disc” which could no longer be used for “electronic data processing, recording, or storage.” Id.
Further, the data was protected because it was the “data stored on such media.” Id.

7

 Despite the direct parallels with this case, State Auto suggests that Lambrecht supports its
position, because the server in the Lambrecht case was fully incapacitated, while Plaintiff’s server
still functions, albeit more slowly, to conduct new business. ECF 37 at 5-6. That argument neglects
the plain language of the Policy, which protects against not only “physical loss” but also “damage
to” both the media and the data. While Plaintiff’s computer system retains certain functionality, it
has been rendered slow and inefficient, and its storage capability was damaged such that its
contents (namely the data and software) cannot be retrieved. Case law cited by State Auto does
not suggest that, for damage to be covered, a computer system must be completely and
permanently inoperable.

Further, as the Lambrecht court recognized, there is an inherent

contradiction between the language of the Policy and the position State Auto espouses. The Policy
refers to “Electronic Media and Records (and Software).” By State Auto’s definition, damage to
software, and the data stored within it, could never be covered, because software is not physical.
Just as the Lambrecht court concluded, “The plain language of the policy’s provisions and
definitions dictates that such property is capable of sustaining a ‘physical’ loss.” Lambrecht, 119
S.W. 3d at 26.
Similarly, in an unpublished Fourth Circuit case, NMS Servs. Inc. v. The Hartford, 62 F.
App’x. 511, 512 (4th Cir. 2003), the Fourth Circuit found insurance coverage to exist for “erasure
of vital computer files and databases necessary for the operation of the company’s manufacturing,
sales, and administrative systems.” The loss was sustained after a former employee and computer
hacker installed hacking programs on the network during his employment. Id. The company’s
insurance policy provided coverage for lost business income sustained as a result of “direct
physical loss of or damage to property.” Id. at 514. The Court stated, “There is no question that
NMS suffered damage to its property, specifically, damage to the computers it owned.” Id. at 514.

8

 In a concurring opinion, Judge Widener explained that “when the employee erased the data on
NMS’s computers, this erasure was in fact a ‘direct physical loss’ under the requirements of the
policy.” Id. at 515 (“Indeed, a computer stores information by the rearrangement of the atoms or
molecules of a disc or tape to effect the formation of a particular order of magnetic impulses, and
a meaningful sequence of magnetic impulses cannot float in space.”) (internal citation omitted).
Finally, while not squarely on point, the rationale of the Maryland Court of Appeals in
Comptroller of the Treasury v. Equitable Trust Co., 296 Md. 459 (1983) suggests that Maryland
would align with Lambrecht, instead of with Ward. In Equitable Trust Co., the Court considered
whether computer software programs constituted tangible property subject to Maryland’s Sales
Tax Act. Id. at 461-62. The Court found that, although the intended use of the software might sever
it from the tangible form in which it was originally transmitted, the act of copying the software to
computer memory did not render it intangible. Id. at 485. It concluded, “that the statute does not
sever copies of computer programs from the tangible carriers employed in the subject sales.” Id.
By that logic, Maryland courts would find physical damage to Plaintiff’s computer software,
despite its installation on Plaintiff’s computer system, because the software was rendered entirely
unusable by the ransomware attack.
B. Loss of Functionality
In addition to Plaintiffs’ data and software constituting covered property under the Policy’s
terms, Plaintiff has also demonstrated damage to the computer system itself, despite its residual
ability to function. Again, the parties’ cited cases are instructive. In American Guarantee & Liab.
Ins. Co. v. Ingram Micro, Inc., Civ. No. 99-185-TUC ACM, 2000 WL 726789, at *1 (D. Ariz.
April 18, 2000), a power outage rendered Ingram’s computer systems inoperable. After the event,
all of the programming information disappeared from the system’s random access memory, and

9

 Ingram’s custom configurations were altered. Id. at *2. Ingram had to reprogram the custom
configurations in order to restore functionality. Id. The insurance company argued that, because
the computer system and matrix switch still had the “capability to perform their intended
functions” after reprogramming, they were not “physically damaged.” Id. The Court reasoned,
however, that “‘physical damage’ is not restricted to the physical destruction or harm of computer
circuitry but includes loss of access, loss of use, and loss of functionality.” Id. Thus, the Court
found that Ingram had suffered physical damage to its computer system during the period prior to
the restorative work, and that coverage therefore existed under its policy. Id. at *3. State Auto
attempts to distinguish Ingram Micro by contending that the computer system was “inoperable”
ECF 35-1 at 9. But the Court specifically noted that “the power outage did not adversely affect
the equipment’s inherent ability to accept and process data and configuration settings.” 2000 WL
726789, at *2. Thus, the mere fact that the system retained some limited functions did not prevent
the Court from finding that Ingram had suffered physical damage.
Likewise, in Southeast Mental Health Ctr., Inc. v. Pacific Ins. Co., LTD, 439 F. Supp. 2d
831, 833-34 (W.D. Tenn. 2006), a hurricane led to a power outage in a pharmacy, which resulted
in the loss of data from the pharmacy’s computer. The insurance carrier argued that Plaintiff’s lost
business income was not recoverable because the “losses were not caused by direct physical loss
of or damage to the insured property.” Id. at 834. However, the Court found “that the corruption
of the pharmacy computer constitutes ‘direct physical loss of or damage to property’ under the
business interruption policy.” Id. at 838. The Court cited Ingram for the proposition that “loss of
access, loss of use, and loss of functionality” fall within the definition of direct “physical damage.”
Id. at 838.

10

 Finally, in Ashland Hospital Corp. v. Affiliated FM Ins. Co., 2013 WL 4400516, at *1 (E.D.
Ky Aug. 14, 2013), a hospital’s air conditioning equipment malfunctioned in its data center,
causing its computer data storage network to overheat and fail. Some data was corrupted, and
needed to be restored from a backup system. Id. Although the unit remained functional, the
hospital’s technology expert recommended replacement “due to the long term reliability and data
integrity issues” resulting from the overheating. Id. The defense expert opined that the system “had
not sustained any damage or loss of reliability.” Id. at *2. However, the Ashland court concluded
that “direct physical loss or damage” includes a loss of reliability. Id. at *4. The Court specifically
declined to adopt a definition of “direct physical loss or damage” that requires proof of a permanent
loss in the ability to function. Id. at *6. Instead, it concluded that the value in a system is its
reliability, and a plaintiff therefore need not await total failure in order to avail itself of coverage
for the damage the system had sustained. Id.
In the instant case, State Auto seems to equate “physical loss or damage” to Plaintiff’s
computer system to require an utter inability to function. The Policy language, and the relevant
case law, impose no such prerequisite. The more persuasive cases are those suggesting that loss of
use, loss of reliability, or impaired functionality demonstrate the required damage to a computer
system, consistent with the “physical loss or damage to” language in the Policy (emphasis added).
Indeed, in many instances, a computer will suffer “damage” without becoming completely
inoperable. Here, not only did Plaintiff sustain a loss of its data and software, but Plaintiff is left
with a slower system, which appears to be harboring a dormant virus, and is unable to access a
significant portion of software and stored data. Because the plain language of the Policy provides
coverage for such losses and damage, summary judgment will be granted in favor of Plaintiff’s
interpretation of the Policy terms.

11

 CONCLUSION
For the reasons set forth above, Plaintiff’s Motion for Summary Judgment, ECF 36, will
be GRANTED as to liability, and State Auto’s Motion for Summary Judgment, ECF 35, will be
DENIED. A separate Order follows, which directs the parties to confer and advise the Court, on
or before January 31, 2020, whether a status hearing will be needed to address the appropriate
remedy.
Dated: January 23, 2020

/s/
Stephanie A. Gallagher
United States District Judge

12