David, J.
In this dispute, G&G Oil Company of Indiana (“G&G Oil”) purchased an insurance policy (“Policy”) from Continental Western Insurance Company (“Continental”). One provision of the Policy’s Commercial Crime Coverage Part—the “Computer Fraud” provision—covered loss “resulting directly from the use of any computer to fraudulently cause a transfer of money.” Thereafter, G&G Oil suffered losses from a ransomware attack and filed a claim with Continental. Continental denied the claim, the trial court granted summary judgment in favor of Continental, and the Court of Appeals affirmed.
Our Court is now asked to determine whether the ransomware attack “fraudulently caused a transfer of money” and whether the loss “resulted directly from the use of a computer.” Although we find that G&G Oil’s losses resulted directly from the use of a computer, we find neither party has demonstrated it is entitled to summary judgment. We therefore reverse the trial court’s grant of summary judgment in favor of Continental, affirm its denial of G&G Oil’s motion for summary judgment, and remand this matter for further proceedings.
….
G&G Oil raises the same issues on transfer as it has below: Whether the ransomware attack constitutes “fraudulent” conduct under the terms of the Continental Policy and whether its loss “result[ed] directly from the use of a computer.” G&G Oil answers both questions in the affirmative while Continental argues the trial court and Court of Appeals properly applied principles of insurance contract interpretation to affirm its own decision to deny coverage.
….
We proceed then with the understanding that “insurance policy provisions are ambiguous only if they are ‘susceptible to more than one reasonable interpretation.’” Id. (quoting Holiday Hosp. Franchising, Inc. v. AMCO Ins. Co., 983 N.E.2d 574, 578 (Ind. 2013)) (emphasis in original). Whether two or more reasonable interpretations for a term exist is viewed “from the perspective of … ordinary policyholder[s] of average intelligence.” Id. (quoting Allgood v. Meridian Sec. Ins. Co., 836 N.E.2d 243, 246-47 (Ind. 2005)). “If reasonably intelligent policyholders would honestly disagree on the policy language’s meaning,” the term is ambiguous and subject to judicial construction. Id. (citation omitted). “Conversely, if reasonably intelligent policyholders could not legitimately disagree as to what the policy language means, we deem the term unambiguous and apply its plain ordinary meaning.” Id.
With these rules of construction in mind, we now analyze each of the disputed Policy terms.
I. The Policy phrase “fraudulently cause a transfer” is unambiguous, but neither party is entitled to summary judgment.
…..
We start with G&G Oil’s motion for summary judgment. Resolving all questions and construing this evidence in the light most favorable to Continental, Alldredge, 9 N.E.3d at 1259, we cannot say with confidence G&G Oil has designated reliable evidence to entitle it to summary judgment. We do not think every ransomware attack is necessarily fraudulent. For example, if no safeguards were put in place, it is possible a hacker could enter a company’s servers unhindered and hold them hostage. There would be no trick there. G&G Oil’s belief of a spear-phishing campaign does not entitle it to summary judgment.
Nor is summary judgment appropriate for Continental. Applying the same in-the-light-most-favorable standard to Continental’s motion, we think—as above—there is a question as to whether G&G Oil’s computer systems were obtained by trick. Though little is known about the hack’s initiating event, enough is known to raise a reasonable inference the system could have been obtained by trick. Resolving this question in G&G Oil’s favor precludes summary judgment for Continental. Id.; see also Hughley v. State, 15 N.E.3d 1000, 1004 (Ind. 2014) (finding “Indiana consciously errs on the side of letting marginal cases proceed to trial on the merits”); Warner Trucking, Inc. v. Carolina Cas. Ins. Co., 686 N.E.2d 102, 104 (Ind. 1997).
This result is consistent with the trial court’s own analysis that seemingly hedges toward finding that the computer hackers obtained access to G&G Oil’s computers by trick, finding “the hacker inserted himself into G&G Oil’s system. That may have involved some sort of deception, but no more than [a house burglar climbing through a window or a car thief using a stolen key].” App. Vol. 2 at 10 (emphasis added). Based on the above definition of this term, we find the trial court construed this term too narrowly. Accordingly, we cannot grant either party’s motion for summary judgment on this point.
This does not end our inquiry. We must still examine whether G&G Oil’s loss “resulted directly from the use of a computer.” If the answer is no, Continental is entitled to summary judgment overall and coverage was properly denied.
II. There is sufficient causal connection between the alleged fraud and G&G Oil’s loss such that the loss resulted directly from the use of a computer.
…..
These definitions inform our understanding of the Policy term “resulting directly from the use of a computer.” In order to obtain coverage under this provision, G&G Oil must demonstrate that its loss resulted either “immediately or proximately without significant deviation from the use of a computer.” We think that G&G Oil has satisfied that definition.
Analyzing G&G Oil’s actions in this case, its transfer of Bitcoin was nearly the immediate result—without significant deviation—from the use of a computer. Though certainly G&G Oil’s transfer was voluntary, it was made only after consulting with the FBI and other computer tech services. The designated evidence indicates G&G Oil’s operations were shut down, and without access to its computer files, it is reasonable to assume G&G Oil would have incurred even greater loss to its business and profitability. These payments were “voluntary” only in the sense G&G Oil consciously made the payment. To us, however, the payment more closely resembled one made under duress. Under those circumstances, the “voluntary” payment was not so remote that it broke the causal chain. Therefore, we find that G&G Oil’s losses “resulted directly from the use of a computer.”
Conclusion
Although G&G Oil’s losses resulted directly from the use of a computer, we find neither party is entitled to summary judgment. We therefore reverse the trial court’s grant of summary judgment in favor of Continental, affirm its denial of G&G Oil’s motion for summary judgment, and remand this matter for further proceedings.
Rush, C.J., and Massa, Slaughter, and Goff, JJ., concur