In Calvary Design Team, Inc. v. Wasabi Technologies, LLC, a Massachusetts Superior Court ruled that negligence claims stemming from a ransomware attack are not barred by the economic loss doctrine, finding that destruction of electronic data qualifies as property damage. After a threat actor deleted all of Calvary’s cloud-stored data, the company paid a $4 million ransom to recover it.
B. Stephanie Siegmann, Litigation Partner and Chair of the Cybersecurity, Privacy & Data Protection Group, commented on the decision:
“It’s clearly a destruction of property. The judge found very appropriately that, these days, data is property and that data has economic value. As the judge very succinctly said in his opinion, data was destroyed — property was destroyed — and the economic loss doctrine is inapplicable in this type of situation.”
Stephanie also noted that Calvary’s failure to enable multi-factor authentication, which “can block 99 percent of account compromise attacks,” was a key factor in the breach and may undermine the company’s case going forward.
Read the full article here (subscription required).
