Court Ruling Expands Liability for Ransomware Data Loss in Landmark Cybersecurity Case A Massachusetts Superior Court judge has ruled that the economic loss doctrine does not bar negligence claims in a case involving a 2023 ransomware attack that destroyed a tech company’s critical data. The decision in Calvary Design Team, Inc. v. Wasabi Technologies, LLC, et al. marks a significant shift in how courts may treat cybersecurity failures, particularly when electronic data is permanently erased. ### Key Details of the Incident - Who: Calvary Design Team, a New York-based automation and robotics firm, sued Winslow Technology Group (a Massachusetts IT services provider) and Wasabi Technologies (a cloud storage vendor) after a LockBit 3.0 ransomware attack in September 2023. - What Happened: A hacker infiltrated Calvary’s systems, deleted all cloud-stored data, and demanded a $4 million ransom for restoration. The attack exploited weak security controls, including the absence of multi-factor authentication (MFA) a feature Wasabi offered but Calvary had not enabled. - Legal Claims: Calvary alleged negligence, gross negligence, breach of contract, fraudulent misrepresentation, and violations of Massachusetts’ consumer protection law (Chapter 93A). ### Court’s Ruling: Data Destruction Qualifies as Property Damage Judge Christopher K. Barry-Smith denied the defendants’ motion to dismiss, finding that: - The economic loss doctrine does not apply because the complete deletion of Calvary’s data constituted property damage, not just economic loss. Unlike prior data breach cases (where courts barred claims over unauthorized access or financial fraud), this attack involved permanent destruction of business-critical data. - Contract and negligence claims survive, though the fraudulent misrepresentation claim was dismissed for lack of evidence of intent. - A limitation of liability clause in Winslow’s contract may still restrict damages, but the judge ruled it did not warrant dismissal at this stage. ### Expert Reactions: A Double-Edged Sword for Cybersecurity Liability - B. Stephanie Siegmann (cybersecurity attorney): Supported the ruling, arguing that data is property with economic value, and its destruction should not be shielded by the economic loss doctrine. However, she noted Calvary’s failure to implement MFA a basic security measure could undermine its negligence claims at trial. - Colin J. Zick (data security attorney): Criticized the decision, warning it could increase costs for IT service providers and lead to higher prices or business closures. He questioned whether temporary data loss (restored after ransom payment) truly qualifies as property damage. - Michael P. Burke (cybersecurity attorney): Agreed with the ruling, stating that gross negligence claims should override contractual liability limits when data is wiped out. ### Broader Implications The case sets a precedent that ransomware attacks resulting in data destruction may expose IT vendors and cloud providers to negligence lawsuits, even when contracts limit liability. However, the ruling also highlights the shared responsibility between businesses and service providers in implementing security measures like MFA. The decision is expected to influence future cybersecurity litigation, particularly in cases where data loss rather than mere exposure is the primary harm.