EMOI Servs., L.L.C. v. Owners Ins. Co. ( 2022 )

[Until this opinion appears in the Ohio Official Reports advance sheets, it may be cited as
EMOI Servs., L.L.C. v. Owners Ins. Co., Slip Opinion No. 2022-Ohio-4649.]
NOTICE
This slip opinion is subject to formal revision before it is published in an
advance sheet of the Ohio Official Reports. Readers are requested to
promptly notify the Reporter of Decisions, Supreme Court of Ohio, 65
South Front Street, Columbus, Ohio 43215, of any typographical or other
formal errors in the opinion, in order that corrections may be made before
the opinion is published.
SLIP OPINION NO. 2022-OHIO-4649EMOI SERVICES, L.L.C., APPELLEE, v. OWNERS INSURANCE COMPANY,
APPELLANT.
[Until this opinion appears in the Ohio Official Reports advance sheets, it
may be cited as EMOI Servs., L.L.C. v. Owners Ins. Co., Slip Opinion No.
2022-Ohio-4649.]
Insurance—Contracts—Businessowners insurance policy—When contractual
language is clear, the writing itself determines the parties’ intent—
Electronic-equipment endorsement requires direct physical loss of or
damage to media—Computer software cannot experience direct physical
loss or physical damage, because it does not have a physical existence—
When insurance policy covers “physical damage,” there must be direct
physical loss or physical damage of the covered media containing the
computer software for the software to be covered under the policy.
(No. 2021-1529—Submitted August 2, 2022—Decided December 27, 2022.)
APPEAL from the Court of Appeals for Montgomery County,
No. 29128, 2021-Ohio-3942.
SUPREME COURT OF OHIO
__________________
STEWART, J.
{¶ 1} In this appeal from a judgment of the Second District Court of
Appeals, we are asked to determine whether a businessowners insurance policy
issued by appellant, Owners Insurance Co. (“Owners”), and held by appellee,
EMOI Services, LLC (“EMOI”), covers losses that resulted from a ransomware
attack on EMOI’s computer-software systems. Because the ransomware attack
caused no “direct physical loss of or damage to” the software—a requirement for
coverage under the policy—Owners is not responsible for covering the resulting
loss. Accordingly, we reverse the decision of the Second District and reinstate the
trial court’s grant of summary judgment in favor of Owners and against EMOI on
EMOI’s claim for breach of contract and bad-faith denial of insurance coverage.
Facts and Procedural History
{¶ 2} EMOI is a computer-software company that uses software it has
developed, along with outside software, to provide medical offices with service and
support for setting appointments, record keeping, and billing. On September 12,
2019, EMOI became the target of a ransomware attack when an unknown party,
i.e., a “hacker,” illegally gained access to EMOI’s computer systems and encrypted
files needed for using its software and database systems. As a result of the attack,
when a file was opened, a ransom note appeared notifying the user that the files
were encrypted and therefore unavailable but that the files could be restored to
normal by a decryption key the hacker would provide in exchange for the payment
of three bitcoins—approximately $35,000 at the time.
{¶ 3} After looking into the timing and financial feasibility of recovering
the files through the assistance of a third-party company, EMOI decided to pay the
ransom. Upon payment, EMOI received an email from the hacker with a link to
download a program that would decrypt the files. A majority of the system files
were returned to normal following the decryption process. An automated phone
2
January Term, 2022
system, however, remained encrypted because the decryption key had not worked
on the separate server that attended to that system. There was no hardware or
equipment damage as a result of the ransomware attack. Following the attack,
EMOI upgraded its software systems and took other steps to protect its systems
from future attacks.
{¶ 4} At the time of the ransomware attack, EMOI was insured under a
businessowners insurance policy issued by Owners. EMOI’s general manager
contacted Owners to file an insurance claim within a day of the attack. That claim
was reviewed by Bradley Weaner, a field claims representative for Owners.
Weaner ultimately determined that EMOI’s policy did not cover the type of losses
experienced by EMOI—i.e., EMOI’s payment of the ransom and the costs
associated with investigating and remediating the attack as well as upgrading its
security systems—and denied the claim the same day it was filed.
{¶ 5} In a letter denying the claim, Weaner identified two potentially
applicable provisions in the insurance policy: the “Data Compromise” endorsement
and the “Electronic Equipment” endorsement. Weaner quoted the language from
the data-compromise endorsement that defined “personal data compromise” as well
as the language that excluded coverage for “any threat, extortion or blackmail,”
including but not limited to “ransom payments.” Accordingly, Weaner notified
EMOI that the data-compromise endorsement did not apply to its claim.
{¶ 6} Weaner also explained that the electronic-equipment endorsement did
not apply. The electronic-equipment endorsement provides:
When a limit of insurance is shown in the Declarations under
ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct
physical loss of or damage to “media” which you own, which is
leased or rented to you or which is in your care, custody or control
while located at the premises described in the Declarations. We will
3
SUPREME COURT OF OHIO
pay for your costs to research, replace or restore information on
“media” which has incurred direct physical loss or damage by a
Covered Cause of Loss.
Direct physical loss of or damage to Covered Property must
be caused by a Covered Cause of Loss.
(Capitalization sic.)
{¶ 7} The electronic-equipment endorsement defines “media” as “materials
on which information is recorded such as film, magnetic tape, paper tape, disks,
drums, and cards.” The definition section further states that “media” includes
“computer software and reproduction of data contained on covered media.”
Weaner denied the claim under the electronic-equipment endorsement on the
grounds that there was no “direct physical loss to the ‘media.’ ”
{¶ 8} In December 2019, EMOI filed a lawsuit against Owners, alleging
that Owners breached the insurance policy contract by denying coverage under the
electronic-equipment endorsement and that Owners denied coverage in bad faith.
Owners answered the complaint by denying EMOI’s legal claims and
counterclaimed for a declaratory judgment that “no coverage, payment or
indemnity is owed” to EMOI under the policy. Thereafter, Owners filed a motion
for summary judgment on EMOI’s claims and its counterclaim for declaratory
judgment.
{¶ 9} The trial court granted summary judgment to Owners. The trial court
explained that the evidence showed that the software and database systems were
not damaged by the encryption but that EMOI was prevented from accessing or
using those systems because of the encryption. The trial court also noted: “In
reality, this is a data compromise situation, rather than a situation involving
physical damage to electronic equipment,” and “[u]nfortunately for EMOI, the Data
4
January Term, 2022
Compromise endorsement in its insurance policy expressly excludes coverage for
costs arising from any threat, extortion or blackmail, including ransom payments.”
{¶ 10} EMOI appealed the trial court’s grant of summary judgment, and the
Second District reversed in a two-to-one decision. The appellate court determined
that the language of the electronic-equipment endorsement potentially applied to
EMOI’s claim if EMOI could prove that its media, i.e., its software, was in fact
damaged by the encryption. The appellate court determined that genuine issues of
material fact existed as to whether there was actual damage to the software based
on the affidavits and deposition transcripts submitted by EMOI in its brief in
opposition to Owners’ motion for summary judgment. The Second District also
noted that EMOI submitted expert testimony indicating that Owners did not
thoroughly review EMOI’s claim that the software was damaged before it denied
the claim and held that there were genuine issues of material fact whether Owners
complied with its duty of good faith in denying EMOI’s claim. The appellate court
reversed the trial court’s grant of summary judgment to Owners on the claim for
breach of contract and the claim of bad faith in denying coverage.
{¶ 11} Owners appealed to this court, and we accepted the following
propositions of law for review:
I. A businessowners property policy that requires “direct
physical loss of or damage to” property does not cover losses from
a ransomware attack.
II. A court cannot read a ransomware coverage into a
businessowners all risk property policy by reading key ransomware
exclusions out.
III. Experts are not required for either coverage
determinations or to avoid bad faith claims.
5
SUPREME COURT OF OHIO
See 166 Ohio St.3d 1413, 2022-Ohio-554, 181 N.E.3d 1210. We find merit to
Owners’ first proposition of law, and we reverse the judgment of the court of
appeals on that basis. Our disposition of the first proposition of law renders
Owners’ second and third propositions of law moot.
Analysis
{¶ 12} This case turns on the legal interpretation of the electronic-
equipment endorsement in EMOI’s businessowners insurance policy. “An
insurance policy is a contract.” Westfield Ins. Co. v. Galatis, 100 Ohio St.3d 216,
2003-Ohio-5849, 797 N.E.2d 1256, ¶ 9. When interpreting a contract, “the role of
a court is to give effect to the intent of the parties to the agreement.” Id. at ¶ 11.
We thus “examine the insurance contract as a whole and presume that the intent of
the parties is reflected in the language used in the policy.” Id., citing Kelly v. Med.
Life Ins. Co., 31 Ohio St.3d 130, 509 N.E.2d 411 (1987), paragraph one of the
syllabus. When contractual language is clear, we look no further than the writing
itself to determine the parties’ intent. Alexander v. Buckeye Pipe Line Co., 53 Ohio
St.2d 241, 246, 374 N.E.2d 146 (1978).
{¶ 13} We find the language in the electronic-equipment endorsement to be
clear and unambiguous in its requirement that there be direct physical loss of, or
direct physical damage to, electronic equipment or media before the endorsement
is applicable. Since software is an intangible item that cannot experience direct
physical loss or direct physical damage, the endorsement does not apply in this
case.
{¶ 14} The electronic-equipment endorsement states that Owners “will pay
for direct physical loss of or damage to ‘media’ which [EMOI] own[s].” It also
states: “Direct physical loss of or damage to Covered Property must be caused by
a Covered Cause of Loss.” The Businessowners Special Property Coverage Form
attached to the insurance policy states that “covered causes of loss” are “risks of
direct physical loss.” The electronic-equipment endorsement defines “media” as
6
January Term, 2022
“materials on which information is recorded such as film, magnetic tape, paper tape,
disks, drums, and cards” and states that “media” includes “computer software and
reproduction of data contained on covered media.”
{¶ 15} EMOI argues that computer software is “media” under the policy
and that the policy nevertheless contemplates that software can be damaged, despite
that it is nonphysical. EMOI contends that the policy covers that damage even
when there has been no damage to hardware. We are not persuaded by this
argument. The most natural reading of the phrase “direct physical loss of or damage
to” is that EMOI is insured for direct physical loss of its media and insured for
direct physical damage to its media. See Ward Gen. Ins. Servs., Inc. v. Emps. Fire
Ins. Co., 114 Cal.App.4th 548, 554, 7 Cal.Rptr.3d 844 (2003) (construing the phrase
“direct physical loss of or damage to” to require direct physical damage, as opposed
to indirect or nonphysical damage, to the covered property, because “[m]ost readers
expect the first adjective in a series of nouns or phrases to modify each noun or
phrase in the following series unless another adjective appears”); see also Santo’s
Italian Café, L.L.C. v. Acuity Ins. Co., 15 F.4th 398, 402 (6th Cir.2021) (construing
identical language as containing a requirement of “direct physical loss” or “direct
physical damage” to the covered property). In other words, the adjectives “direct”
and “physical” modify both “loss” and “damage.” Accord Kingray, Inc. v. Farmers
Group, Inc., 523 F.Supp.3d 1163, 1173 (C.D.Cal.2021). Similarly, although the
term “computer software” is included within the definition of “media,” it is
included only insofar as the software is “contained on covered media.” (Emphasis
added.) We hold that “covered media” means media that has a physical existence.
Indeed, all examples of covered media in the definition section are materials of a
physical nature, i.e., “film, magnetic tape, paper tape, disks, drums, and cards.” And
we also hold that the policy requires that there must be direct physical loss or
physical damage of the covered media containing the computer software for the
software to be covered under the policy. This interpretation is supported by the
7
SUPREME COURT OF OHIO
language of the electronic-equipment endorsement, which states that “direct
physical loss of or damage to Covered Property [i.e., media] must be caused by a
Covered Cause of Loss [i.e., risk of direct physical loss].”
{¶ 16} Computer software cannot experience “direct physical loss or
physical damage” because it does not have a physical existence. See Ward at 850.
Software is essentially nothing more than a set of instructions that a computer
follows to perform specific tasks. Fantasy Sports Properties, Inc. v.
Sportsline.com, Inc., 287 F.3d 1108, 1118 (Fed.Cir.2022) (“Software is a set of
instructions, known as code, that directs a computer to perform specified functions
or operations”). It is information stored on a computer or other electronic medium.
See Ward at 850. While a computer or other electronic medium has physical
electronic components that are tangible in nature, the information stored there has
no physical presence. Id. In other words, the information—the software—is
entirely intangible. Focusing on what the parties would have intended, see
Alexander, 53 Ohio St.2d at 246, 374 N.E.2d 146, we are unpersuaded that the
policy covered “physical damage” to computer software (an intangible) without
there also being physical damage to the hardware on which the software was stored.
{¶ 17} Because the insurance policy at issue did not cover the type of loss
EMOI experienced, Owners did not breach its contract with EMOI. Accordingly,
we reverse the judgment of the Second District Court of Appeals and reinstate the
trial court’s grant of summary judgment in favor of Owners on EMOI’s claim of
breach of contract and bad-faith denial of insurance coverage.
Judgment reversed.
O’CONNOR, C.J., and KENNEDY, FISCHER, DEWINE, DONNELLY, and
BRUNNER, JJ., concur.
_________________
Dyer, Garofalo, Mann & Schultz, L.P.A., John A. Smalley, and Kenneth J.
Ignozzi, for appellee.
8
January Term, 2022
Green & Green Lawyers, L.P.A., and Erin B. Moore, for appellant.
Vorys, Sater, Seymour, & Pease, L.L.P, Natalia Steele, and Anthony Spina,
urging reversal for amici curiae Ohio Insurance Institute and American Property
Casualty Insurance Association.
Arnold & Clifford, L.L.P, James E. Arnold, and Gerhardt A. Gosnell II; and
Anderson Kill, P.C., Joshua Gold, Daniel J. Healy, and Dennis J. Nolan, urging
affirmance for amicus curiae United Policyholders.
Rutter & Russin, L.L.C., and Robert P. Rutter, urging affirmance for amicus
curiae Rutter & Russin, L.L.C.
_________________
9