EHD Technologies LLC v. Cincinnati Indemnity Company

EHD Technologies, a manufacturing technology company, was hit by a ransomware attack that encrypted its computer data and systems, causing operational shutdown. It paid a ransom and incurred substantial restoration costs. EHD filed a claim with its insurer, Cincinnati Indemnity Company, under a commercial property policy, arguing the data loss and system inoperability constituted "direct physical loss or damage." The insurer denied coverage, asserting that computer data is not tangible property and the absence of physical alteration to hardware meant no covered loss. EHD sued for breach of contract and bad faith.

The U.S. District Court for the Southern District of Indiana granted summary judgment for Cincinnati Indemnity, ruling that data loss without physical change to the storage media is not direct physical loss. The U.S. Court of Appeals for the Seventh Circuit affirmed, holding that the policy unambiguously required tangible, physical harm. EHD’s claims were dismissed with prejudice.

Whether the loss of use and access to computer data and systems caused by a ransomware attack amounts to "direct physical loss or damage" to property under a commercial property insurance policy.

The ruling underscored the limitation of traditional property insurance in covering cyber incidents. It highlighted the necessity for businesses to obtain standalone cyber insurance policies. The case became a reference point for insurers in denying ransomware-related property claims and influenced policy wording revisions and the cyber insurance market growth.