EMOI Servs., L.L.C. v. Owners Ins. Co.

[Cite as EMOI Servs., L.L.C. v. Owners Ins. Co., 2021-Ohio-3942.]
IN THE COURT OF APPEALS OF OHIO
SECOND APPELLATE DISTRICT
MONTGOMERY COUNTY
EMOI SERVICES, LLC :
:
Plaintiff-Appellant : Appellate Case No. 29128
:
v. : Trial Court Case No. 2019-CV-5979
:
OWNERS INSURANCE COMPANY : (Civil Appeal from
: Common Pleas Court)
Defendant-Appellee :
:
...........
OPINION
Rendered on the 5th day of November, 2021.
...........
JOHN A. SMALLEY, Atty. Reg. No. 0029540, 131 North Ludlow Street, Suite 1400,
Dayton, Ohio 45402
Attorney for Plaintiff(s)-Appellant
ERIN B. MOORE, Atty. Reg. No. 0061638, 800 Performance Place, 109 North Main
Street, Dayton, Ohio 45402
Attorney for Defendant(s)-Appellee
.............
-2-
EPLEY, J.
{¶ 1} EMOI (Electronic Medical Office Integration) Services, LLC, appeals from a
judgment of the Montgomery County Court of Common Pleas, which granted summary
judgment to Owners Insurance Company on EMOI’s breach of contract and bad faith
claims. For the following reasons, the trial court’s judgment will be reversed, and the
case will be remanded for further proceedings.
I. Facts and Procedural History
{¶ 2} The underlying facts are largely undisputed. EMOI provides “medical billing
services and application services and support” to medical providers. The company
obtains necessary information from patients and medical providers for medical services
rendered and formulates it into a fillable billing claims form to the third-party payer
network. EMOI also sends invoices to patients for balances due.
{¶ 3} EMOI employees have two computer logins. They first must provide login
information to access their work computers. Employees then use a second login to
access Medics, the system that allows customers to input billing data, scheduling, and
other applications offered to them. In addition to Medics, EMOI has its own proprietary
software that is the preferred method for customers to enter patient charges, procedure
codes, and diagnosis codes.
{¶ 4} On September 12, 2019, after logging into her workstation, an EMOI
employee, Ruth Ross, discovered that she was unable to access the Medics system.
She contacted Vernon Glaser, the general manager of EMOI, who contacted Dan Glaser-
Garbrick, EMOI’s software developer and information technology (IT) manager.
{¶ 5} Glaser-Garbrick “could not log in the way [he] normally [did]” but was able to
-3-
access the system using VPN access. When he did, he saw that all of the files on the
affected servers had “weird extensions.” Glaser-Garbrick recognized that EMOI’s
system had been hacked and the files encrypted. A ransom note was “in every single
folder on all the computers that were affected.” Glaser-Garbrick informed Glaser of what
had occurred. At this point, Glaser was receiving phone calls from several clients, all of
whom reported that they could not access the system.
{¶ 6} According to Glaser-Garbrick, the ransom note stated that the files were
encrypted and currently unavailable, but the company could get them back. The hacker
indicated that the company should respond by email with the provided personal code and
that the company could decrypt one file for free. Per the hacker’s instructions, Glaser-
Garbrick sent the hacker an encrypted file and the personal code indicated on the ransom
note, and the hacker responded with the contents of the file. Glaser-Garbrick indicated
that the returned file could be opened and operated normally. The hacker further
indicated that the remaining files could be decrypted for three bitcoins, which at that time
cost a total of approximately $35,000.
{¶ 7} EMOI started investigating data recovery companies that could decrypt its
files without paying the hacker. It selected a company from Australia, but the estimated
cost was approximately $55,000, and the data recovery company was not certain that all
of the data could be recovered. Ultimately, EMOI decided to pay the hacker. Within
about an hour of sending the bitcoin, EMOI received an email with a link to download a
program that would decrypt the files. Glaser-Garbrick stated that, once the decryption
program operated and decrypted the files, “the files would open and functioned the way
they were intended.” A few files did not get decrypted, “but they weren’t super critical.”
-4-
{¶ 8} Soon after the decryption was completed, the encryption program re-ran on
the Medics server. Glaser-Garbrick was able to decrypt the files again with the same
decryption key previously provided by the hacker.
{¶ 9} In response to the ransomware attack, EMOI upgraded the Medics software,
transitioned from remote access to using VPN software, and moved its computer access
to a new domain. EMOI also changed how it backed up its system. The system still
had a few residual problems: the interface between EMOI’s website and Medics could not
communicate and the program that auto-generated remittances did not function due to
being moved to the new server, and the automated phone call system had not been
decrypted because the key did not work.
{¶ 10} When the ransomware attack occurred, EMOI was covered by a
businessowner’s insurance policy issued by Owners. At approximately 8:03 a.m. on
September 13, 2019 (the day after the attack), Glaser called his insurance agent to report
the incident and file a claim. EMOI’s claim was assigned to Bradley Weaner, a field claim
representative for Auto-Owners Insurance, the parent company of Owners. Weaner
reviewed the written loss notification in the computer system, reviewed EMOI’s policy,
and then spoke with Glaser. Glaser reported that the situation was discovered when an
employee could not log into her computer system. Glaser told Weaner that the data was
not physically damaged, but was inaccessible due to being encrypted and held for
ransom. While reviewing the claim, Weaner spoke with his branch manager and home
office commercial lines manager.
{¶ 11} Weaner concluded that there was no coverage under any of the potentially
applicable provisions of the insurance policy, including the Data Compromise
-5-
endorsement and the Electronic Equipment endorsement. The Data Compromise
endorsement addresses the compromise of an individual’s “personal data.” The
exclusion portion of the Data Compromise endorsement precludes coverage for “[a]ny
threat, extortion or blackmail. This includes, but is not limited to, ransom payments and
private security assistance[.]” The Electronic Equipment endorsement includes a
provision addressing “direct physical loss or damage to ‘media.’ ”
{¶ 12} Weaner again spoke with Glaser and informed him that the claim would be
denied. He also sent a coverage position letter outlining the bases for the lack of
coverage. The letter identified the two potentially applicable endorsements and
explained that neither provision provided coverage, reasoning:
As cited in the policy language above, paying ransom is excluded. Since
the data belongs to another party that is not your customer it does not meet
the definition of “affected individual”. Furthermore, there is no direct
physical loss to the “media”. * * *
The letter indicated that EMOI should contact Owners with any additional information.
EMOI did not provide additional information to Owners following the denial.
{¶ 13} In December 2019, EMOI filed suit in the common pleas court, alleging that
Owners breached its contract by denying coverage under the Electronic Equipment
provision and that Owners denied coverage in bad faith. Owners denied the claims and
counterclaimed for a declaratory judgment that “no coverage, payment or indemnity is
owed” to EMOI under the policy.
{¶ 14} On January 21, 2021, Owners moved for summary judgment on EMOI’s
claims and its counterclaim for declaratory judgment. In its motion, Owners highlighted
-6-
the Businessowners Special Property Coverage form, the Data Compromise
endorsement, and the Electronic Equipment endorsement in the policy and argued,
primarily, that no direct physical loss or damage had occurred, as required by the Special
Property Coverage Form and Electronic Equipment endorsement. Owners further
argued that the Data Compromise endorsement did not extend to the type of loss incurred
by EMOI, as it did not involve “affected persons” or “personally identifying information.”
Finally, Owners asserted that, in the absence of a breach of contract, there can be no
basis for a bad faith claim. Owners supported its motion with depositions from Glaser,
Glaser-Garbrick, and Weaner, as well as an affidavit from Weaner and accompanying
documents.
{¶ 15} In response, EMOI focused on the Electronic Equipment endorsement.
The company indicated that it was “not seeking merely to recover for lost data,” which it
acknowledged was not covered by the policy. Rather, it argued that it was seeking
coverage for “the damage to the media, not the information or data contained on the
media.” EMOI explained that the software, a computer program, “was damaged by a
computer hacker who manipulated the computer software program, encrypting the
program to prevent EMOI’s use of the software and access to the data. Both the Medics
software and EMOI’s own software was not accessible or usable. Thus, the computer
software was damaged.” EMOI further asserted that, even after it obtained the
decryption key, the software was still damaged, as it became encrypted again. EMOI
stated it that also suffered several other problems with software it was running.
{¶ 16} EMOI supported its motion with an affidavit from an expert witness, Chris
Johnson, who had over 35 years of experience and training in the insurance industry.
-7-
Johnson discussed deficiencies in Weaner’s investigation and opined both that Owners
failed in its duties to EMOI and that EMOI’s claim should have been granted. Owners
sought to strike Johnson’s affidavit. We find no indication that the trial court addressed
the motion to strike, but it did not reference Johnson’s affidavit in its decision on the motion
for summary judgment.
{¶ 17} In granting summary judgment to Owners, the trial court found EMOI’s
arguments unconvincing. It reasoned:
Garbrick testified that he considered EMOI’s “whole database” to be
damaged because the encryption prevented EMOI from accessing or using
it. (Garbrick Dep. 47.) However, Garbrick admitted that once he decrypted
it, he could use the database and that it does what it did before it was
encrypted. Id. Assuming arguendo that the software was “damaged”
while it was encrypted, given the fact that EMOI has all the data it did before
the ransomware attack, and that its software is now fully-functional, the
Court finds that the “media” is no longer damaged.
In reality, this is a data compromise situation, rather than a situation
involving physical damage to electronic equipment. The hacker gained
unauthorized access to EMOI’s computer systems as a result of a
vulnerability within the system, and EMOI ultimately had to pay a ransom in
order to regain control of [its] software and data. Unfortunately for EMOI,
the Data Compromise endorsement in its insurance policy expressly
excludes coverage for costs arising from any threat, extortion or blackmail,
including ransom payments. The Data Compromise endorsement also
-8-
excludes costs arising from correcting any deficiency in its “systems,
procedures or physical security that may have contributed to a ‘personal
data compromise.’ ” In other words, the cost endured by EMOI to upgrade
its systems to cure the deficiency that left it vulnerable to attack is expressly
excluded under the Data Compromise endorsement.
The Court suspects that EMOI is attempting to interpret the language
in the Electronic Equipment endorsement in a way that provides coverage
because the Data Compromise endorsement, which is the applicable
endorsement, clearly excludes coverage in this situation. However, the
Court cannot logically conclude that EMOI sustained direct physical loss of
or damage to its “media” when EMOI’s computer systems are now fully-
functional with all the data it had before the ransomware attack.
The trial court thus granted summary judgment to Owners on all of EMOI’s claims and
entered judgment in favor of Owners.
{¶ 18} EMOI appeals from the trial court’s judgment, claiming that the trial court
erred in granting Owners’ motion for summary judgment.
II. Summary Judgment Standard
{¶ 19} Pursuant to Civ.R. 56(C), summary judgment is proper when (1) there is no
genuine issue as to any material fact, (2) the moving party is entitled to judgment as a
matter of law, and (3) reasonable minds, after construing the evidence most strongly in
favor of the nonmoving party, can only conclude adversely to that party. Zivich v. Mentor
Soccer Club, Inc., 82 Ohio St.3d 367, 369-370, 696 N.E.2d 201 (1998). The moving
party carries the initial burden of affirmatively demonstrating that no genuine issue of
-9-
material fact remains to be litigated. Mitseff v. Wheeler, 38 Ohio St.3d 112, 115, 526
N.E.2d 798 (1988). To this end, the movant must be able to point to evidentiary materials
of the type listed in Civ.R. 56(C) that a court is to consider in rendering summary
judgment. Dresher v. Burt, 75 Ohio St.3d 280, 292-293, 662 N.E.2d 264 (1996). The
substantive law of the claim or claims being litigated determines whether a fact is
“material.” Perrin v. Cincinnati Ins. Co., 2020-Ohio-1405, 153 N.E.3d 832, ¶ 29 (2d
Dist.).
{¶ 20} Once the moving party satisfies its burden, the nonmoving party may not
rest upon the mere allegations or denials of the party’s pleadings. Dresher at 293; Civ.R.
56(E). Rather, the burden then shifts to the nonmoving party to respond, with affidavits
or as otherwise permitted by Civ.R. 56, setting forth specific facts that show that there is
a genuine issue of material fact for trial. Dresher at 293. Throughout, the evidence
must be construed in favor of the nonmoving party. Id.{¶ 21} We review the trial court’s ruling on a motion for summary judgment de
novo. Schroeder v. Henness, 2d Dist. Miami No. 2012-CA-18, 2013-Ohio-2767, ¶ 42.
De novo review means that this court uses the same standard that the trial court should
have used, and we examine all the Civ.R. 56 evidence, without deference to the trial court,
to determine whether, as a matter of law, no genuine issues exist for trial. Ward v. Bond,
2d Dist. Champaign No. 2015-CA-2, 2015-Ohio-4297, ¶ 8.
III. Breach of Contract Claim
{¶ 22} EMOI first claims that summary judgment was improper on its breach of
contract claim because genuine issues of material fact exist as to whether EMOI suffered
damage to its media and whether the damage was covered under the terms of the
-10-
Electronic Equipment endorsement.
{¶ 23} The interpretation of a contract is a question of law. St. Marys v. Auglaize
Cty. Bd. of Commrs., 115 Ohio St.3d 387, 2007-Ohio-5026, 875 N.E.2d 561, ¶ 38;
Nationwide Mut. Fire Ins. Co. v. Guman Bros. Farm, 73 Ohio St.3d 107, 108, 652 N.E.2d
684 (1995). When reviewing a contract, the court’s primary role is to ascertain and give
effect to the intent of the parties. Hamilton Ins. Serv., Inc. v. Nationwide Ins. Cos., 86
Ohio St.3d 270, 273, 714 N.E.2d 898 (1999). “We presume that the intent of the parties
to a contract is within the language used in the written instrument.” DiPasquale v.
Costas, 186 Ohio App.3d 121, 2010-Ohio-832, 926 N.E.2d 682, ¶ 36 (2d Dist.), quoting
Saunders v. Mortensen, 101 Ohio St.3d 86, 2004-Ohio-24, 801 N.E.2d 452.
{¶ 24} A contract that is, by its terms, clear and unambiguous requires no real
interpretation or construction and will be given the effect called for by the plain language
of the contract. Aultman Hosp. Assn. v. Community Mut. Ins. Co., 46 Ohio St.3d 51, 55,
544 N.E.2d 920 (1989). Where terms in an insurance contract are not defined, courts
will give them their plain and ordinary meaning. E.g., Westfield Ins. Co. v. Galatis, 100
Ohio St.3d 216, 2003-Ohio-5849, 797 N.E.2d 1256, ¶ 11; Colter v. Spanky’s Doll House,
2d Dist. Montgomery No. 21111, 2006-Ohio-408, ¶ 29. “[A]mbiguous language in an
insurance contract is construed against the insurance company.” Dominish v.
Nationwide Ins. Co., 129 Ohio St.3d 466, 2011-Ohio-4102, 953 N.E.2d 820, ¶ 7.
{¶ 25} The parties’ arguments on appeal mirror those raised in the trial court.
EMOI disputes the trial court’s conclusion that EMOI’s software was not damaged. The
company argues that Glaser-Garbrick’s deposition testimony created a genuine issue of
material fact as to whether EMOI’s software was damaged, and it asserts that the damage
-11-
was covered under the Electronic Equipment endorsement in its policy with Owners.
EMOI adds that in reaching the conclusion that its software was not damaged, the court
failed to construe the evidence in the light most favorable to EMOI.
{¶ 26} Owners responds that the policy requires direct physical loss or damage,
and because EMOI’s software was intangible, it was not covered by the Electronic
Equipment endorsement. Owners cites to numerous cases addressing the application
of “direct physical loss or damage” under a variety of circumstances. Owners further
claims that EMOI misconstrues the definition of “media,” emphasizing that the
endorsement contemplates tangible items that are subject to physical damage.
{¶ 27} The Electronic Equipment endorsement reads, in relevant part:
1. COVERAGE
Covered Property
***
(2) Unscheduled Equipment
***
(b) When a limit of insurance is shown in the Declarations under
ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct physical loss of
or damage to “media” which you own, which is leased or rented to you or
which is in your care, custody or control while located at the premises
described in the Declarations. We will pay for your costs to research,
replace or restore information on “media” which has incurred direct physical
loss or damage by a Covered Cause of Loss.
Direct physical loss of or damage to Covered Property must be caused by
-12-
a Covered Cause of Loss.
The endorsement defines “media” as “materials on which information is recorded such as
film, magnetic tape, paper tape, disks, drums, and cards. The definition section further
states that “media” includes “computer software and reproduction of data contained on
covered media.”
{¶ 28} As an initial matter, there is no apparent dispute that EMOI was insured
against damage to media. The policy’s coverage page indicates that EMOI paid a
premium of $161.91 for media coverage and had a coverage limit of $100,000. We
therefore begin with whether EMOI’s claim concerns “media.”
A. Media
{¶ 29} The policy initially provides a broad definition of the term “media”: “materials
on which information is recorded.” The sentence then provides examples of tangible
“materials” that meet that definition: “film, magnetic tape, paper tape, disks, drums, and
cards.” By the policy’s express language, the list is illustrative, not exhaustive.
Accordingly, by its terms, other devices may satisfy the definition of “media.”
{¶ 30} Similar to statutory construction, we must read the policy’s broad definition
of media (“materials on which information is recorded”) in light of the representative
examples provided. Accord Stiner v. Amazon.com, Inc., 162 Ohio St.3d 128, 2020-Ohio-
4632, 164 N.E.3d 394, ¶ 32 (“the canon of ejusdem generis requires us to limit a broad
phrase that follows specific examples to items similar to those specific examples”). In
this case, the specific examples (“film, magnetic tape, paper tape, disks, drums, and
cards”) appear to encompass a wide array of data storage devices, including paper data
storage, magnetic data storage, optical storage, and solid-state/flash memory storage.
-13-
While the specific examples also may have common characteristics that would limit
“media” to specific types of devices, those limiting characteristics are not apparent on this
record.
{¶ 31} The parties have not directed us to cases addressing whether a server
meets the definition of “media.” However, at least one court has held that a company’s
server fell within the definition of “electronic media and records.” See Lambrecht &
Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16, 25, 2003 WL 21078083 (Tex.App.)
(“Based on Ashley's affidavit, the server falls within the definition of ‘electronic media and
records’ because it contains a hard drive or ‘disc’ which could no longer be used for
‘electronic data processing, recording, or storage.’ ”). At oral argument, counsel for
Owners indicated that a server could be “media,” although counsel asserted that it would
need to be physically damaged.
{¶ 32} We repeat that the definitional provision of the Electronic Equipment
endorsement further provides that “computer software and reproduction of data contained
on covered media” also fall within the definition of “media.” Giving this provision its plain
and ordinary meaning, computer software must be contained on another medium for the
provision to apply.
{¶ 33} In his deposition, Glaser-Garbrick described how EMOI’s system was
designed. He stated that EMOI had a physical server that operated as a host server for
the Medics database; clients communicated with the database via an application installed
on their computers. The host server was configured as a virtualization server, which
allowed EMOI to run additional virtual servers “on top of it.” (“Server virtualization is the
process of dividing a physical server into multiple unique and isolated virtual servers by
-14-
means of a software application. Each virtual server can run its own operating systems
independently.” vmware, Server Virtualization Definition, https://www.vmware.com/
topics/glossary/content/server-virtualization (accessed Oct. 26, 2021).
{¶ 34} At the time of the ransomware attack, EMOI also had a backup virtual host
server, which connected to the other server through a protocol called iSCSI (internet small
computer systems interface). Glaser-Garbrick stated that the backup virtual host server
functioned as an extra hard drive to save backups. Glaser-Garbrick explained that, prior
to the ransomware attack, EMOI would run automatic backups every night and a full file
copy of the Medics database would be saved on the backup server that was connected
to the network.
{¶ 35} Glaser-Garbrick did not expressly address whether any components of
EMOI’s system constituted “media.” Owners did not provide evidence from an IT
specialist to address what constitutes media.
{¶ 36} Viewing the evidence in the light most favorable to EMOI, the company’s
servers constituted materials on which EMOI’s information was recorded and thus
arguably met the policy’s definition of “media.” Glaser’s and Glaser-Garbrick’s
deposition testimony established that the servers contained the Medics software and
EMOI’s proprietary software, as well as the Medics database. Glaser-Garbrick also
specifically identified a backup server that operated as an extra hard drive on which the
Medics information was saved nightly.
{¶ 37} In its appellate brief, Owners contends that there is no coverage for
computer software and reproduction of data in this case, because “[n]o film, magnetic
tape, disc, drum, card, etc., has been identified as physically damaged in this claim.”
-15-
(Emphasis sic.) Owners’ argument appears to stem from the policy’s statement that
media includes computer software and reproduction of data that is contained on “covered
media.” Consistent with the use of the term “covered” throughout the policy, we read
“covered media” to mean media that is insured under the endorsement. See Black’s Law
Dictionary 365 (6th Ed.1990) (“Cover. To protect by means of insurance[.]”) We do not
find it reasonable to interpret the phrase to mean only media that has incurred a covered
loss, as Owners suggests. In this case, because the computer software and
reproduction of data was contained on EMOI’s servers, i.e., “covered media”, those items
also met the definition of media.
{¶ 38} Owners’ reading of the definitional section renders meaningless the
sentence defining media to include “software and reproduction of data on covered media.”
Without that sentence, the definition of media reasonably would be restricted to tangible
electronic storage media, and the policy already includes a provision stating “We will pay
for your costs to research, replace or restore information on ‘media’ which has incurred
direct physical loss or damage by a Covered Cause of Loss.” In other words, without the
definitional sentence regarding software and reproduction of data, the policy provides
coverage for physical loss or damage to tangible media and to replace information – which
would include software and reproduction of data – contained on that tangible media.
Owners’ interpretation of the media provision does not adequately account for the
additional statement defining “media” to include software and reproduction of data on
covered media.
B. Damage
{¶ 39} In granting summary judgment to Owners, the trial court concluded that
-16-
EMOI’s software was not damaged. The court focused on the fact that, after employing
the decryption program, EMOI’s software again became operational. Construing the
evidence in the light most favorable to EMOI, as we are required to do, we conclude that
EMOI’s evidence supports a conclusion that its software was, in fact, damaged by the
malicious encryption.
{¶ 40} According to Glaser’s deposition testimony, EMOI’s system was functioning
normally at the end of business on September 11, 2019. Glaser-Garbrick testified that
when he accessed the system on September 12, he saw that “all the files had weird
extensions,” and there were approximately nine or ten different extensions. (Glaser-
Garbrick Depo. at 14.) Glaser-Garbrick clarified that each computer on the network was
encrypted, but with a different extension. (Id. at 14.) Because the backup server was
connected to EMOI’s network, it also was encrypted.
{¶ 41} When asked during his deposition whether anything was damaged by the
encryption, Glaser-Garbrick and Owners’ attorney had the following exchange:
Q. * * * Did you find anything that you would consider damaged as a result
of the encryption by the hacker?
A. Our whole database.
Q. And why do you consider it damaged?
A. We couldn’t use it at all.
Q. While it was encrypted?
A. Yes.
(Glaser-Garbrick Depo. at 47.) Although Glaser-Garbrick at times referred to the
database’s being encrypted, he testified that the hacker involuntarily encrypted all of the
-17-
digital information, which is “basically what runs the whole software – * * * the system.”
(Id. at 25.) Glaser-Garbrick further testified that ransom notes had been added “in all the
folders and stuff, too. * * * It was just in every single folder on all the computers that were
affected.” (Id. at 16.) When Glaser-Garbrick attempted to open a file, the ransom note
would appear instead.
{¶ 42} Glaser-Garbrick further testified that portions of the software remained
damaged even after decryption. He stated that a program that generated remittances
continued not to function after the decryption. In addition, the automated phone call
system was contained on one of the virtual hard drives that did not get decrypted because
the key did not work. (Id. at 44-45.) Glaser-Garbrick further stated that, even after he
obtained the decryption key, the software was still damaged, as it became encrypted
again. Construing the evidence in EMOI’s favor, Glaser-Garbrick’s testimony indicated
that the hacker did not simply make EMOI’s software inaccessible, and not all of EMOI’s
software was restored following EMOI’s receipt of the decryption key. Genuine issues
of material fact thus exist as to whether EMOI’s software was damaged.
C. Direct Physical Damage
{¶ 43} We next turn to another significant area of dispute: whether the damage to
EMOI’s software constituted “direct physical loss of or damage” to covered property.
Owners cites to numerous cases addressing the phrase “direct physical loss of or
damage” in insurance policies to support three general propositions: (1) the policy covers
only items with a physical existence, i.e., tangible items; (2) “physical loss or damage”
does not occur when the insured merely loses access or use; and (3) “physical loss or
damage” does not occur when the item can be restored by cleaning. Owners claims that
-18-
EMOI’s alleged damage is not covered by its policy because the software and data have
no physical existence and thus are not susceptible to physical loss or damage; EMOI
merely lost access to its data and software due to the ransomware attack, and the data
and software were readily restored with the decryption program. We find Owners’ cases
distinguishable.
{¶ 44} First, Owners cites several cases in which the policy at issue required direct
physical loss or damage to “tangible” property. EMOI’s businessowners policy does not
include the term “tangible,” and we find that distinction significant. Owners also cites to
several cases, some of which stemmed from the COVID-19 pandemic, in which a
business was unable to operate due to governmental mandates, curfews, or prohibitions.
Other cited cases involved events such power outages that prevented operation of the
business. Those circumstances are not analogous to an incursion into EMOI’s computer
system.
{¶ 45} We highlight two cases cited by Owners. In Mastellone v. Lightning Rod
Mut. Ins. Co., 175 Ohio App.3d 23, 2008-Ohio-311 (8th Dist.), homeowners brought suit
against their insured for refusing to provide coverage for mold found on the exterior and
interior of their house and for water damage to their basement. With respect to the
exterior mold on the home’s cedar siding, the court agreed with the insurer that the
homeowners provided no evidence to show that the mold on the siding of the house
constituted “physical damage.” The trial court construed “physical injury” to mean “a
harm to the property that adversely affects the structural integrity of the house.” Id. at
¶ 61, citing 10A Couch on Insurance (3d Ed.1998), Section 148:46 (the requirement that
a loss be “physical” is “widely held” to preclude claims based on “a detrimental economic
-19-
impact unaccompanied by a distinct, demonstrable, physical alteration of the property”).
{¶ 46} Although there was evidence of mold staining on the exterior siding of the
house, the court concluded that the staining did not rise to level of “physical injury,”
because it was only temporary and did not affect the structure of the wood. The court
noted that the homeowners’ expert had testified that the mold could be cleaned, although
the staining would reoccur. There was no evidence that the wood needed to be
replaced. The insurer’s experts stated that the primary concern about the mildew was
aesthetic. The Eighth District thus concluded that the trial court erred in failing to direct
a verdict in the insurer’s favor. See Mama Jo’s, Inc. v. Sparta Ins. Co., 11th Cir. No. 18-
12887 (Aug. 18, 2020) (need for cleaning does not satisfy “direct physical” loss).
{¶ 47} Glaser-Garbrick’s description of the “damage” caused by the encryption
went beyond aesthetic. Glaser-Garbrick stated in his deposition that all of the files had
“weird extensions” that prevented access to the files. When he tried to open the
encrypted files, a ransom note appeared. As a result of the encryption, EMOI and its
clients were unable to access EMOI’s system for a significant period of time.
{¶ 48} Owners contends that the EMOI’s system was not physically damaged
because once the decryption program was run, EMOI’s files opened and operated the
way they were intended to, as Glaser-Garbrick testified. In essence, Owners argues that
EMOI’s system merely needed to be cleaned, like the mold in Mastellone.
{¶ 49} The record contains minimal information about how encryption occurs and
its effects on computer data. When asked during his deposition to describe how
encryption worked, Glaser-Garbrick responded, “I’m trying to think about the best way to
explain this. It’s a mathematical function that’s been designed so it’s hard to find a
-20-
solution for it, but if you know the answer to the problem, you would be able to basically
undo the encryption.” (Glaser-Garbrick at 23.) Glaser-Garbrick agreed that “once you
get the code, you can unlock it to read it or use the information that’s being sent.” (Id. at
24.) Glaser-Garbrick indicated that encryption and decryption is often “handled without
people realizing it.” (Id.) Glaser-Garbrick did not describe, in technical terms, how
encryption and decryption occurs and the effects on the item being encrypted. No other
evidence regarding encryption was offered by the parties. Accordingly, construing the
evidence in EMOI’s favor, the evidence supports a conclusion that the encryption
damaged EMOI’s software and data, and that the damage was not merely aesthetic or
amounted to loss of access or use.
{¶ 50} Owners also relies on Ward Gen. Ins. Servs., Inc. v. Employers Fire Ins.
Co., 7 Cal.Rptr.3d 844, 114 Cal.App.4th 548 (2003), a computer-related case, to support
its contention that there can be no “direct physical” loss or damage to software, an
intangible object. In that case, the plaintiff was in the process of updating its Oracle
computer database when human error caused the system to “crash,” resulting in the loss
of its electronically-stored data used to service its clients’ insurance policies. Id. at 846.
The insured incurred expenses to restore its data and suffered loss of business income
from the disruption. The plaintiff sought coverage under its businessowners policy,
which was denied due to the lack of “direct physical loss of or damage to property,” and
the trial court agreed.
{¶ 51} In affirming the trial court’s judgment, the California appellate court noted
that the loss was not covered unless it resulted from a risk of direct physical loss. The
court applied the “ordinary and popular” meaning of “direct physical loss” and held that
-21-
“the loss of plaintiff's database does not qualify as a ‘direct physical loss,’ unless the
database has a material existence, formed out of tangible matter, and is perceptible to
the sense of touch.” Id. at 850. It continued:
We fail to see how information, qua information, can be said to have
a material existence, be formed out of tangible matter, or be perceptible to
the sense of touch. To be sure, information is stored in a physical medium,
such as a magnetic disc or tape, or even as papers in three-ring binders or
a file cabinet, but the information itself remains intangible. Here, the loss
suffered by plaintiff was a loss of information, i.e., the sequence of ones and
zeroes stored by aligning small domains of magnetic material on the
computer's hard drive in a machine readable manner. Plaintiff did not lose
the tangible material of the storage medium. Rather, plaintiff lost the stored
information. The sequence of ones and zeros can be altered, rearranged,
or erased, without losing or damaging the tangible material of the storage
medium.
We conclude the loss of the database, with its consequent economic
loss, but with no loss of or damage to tangible property, was not a “direct
physical loss of or damage to” covered property under the terms of the
subject insurance policy, and, therefore, the loss is not covered.
(Footnote omitted.) Id. at 851.
{¶ 52} EMOI argues that Ward and other cases are inapplicable, because the
policy language here provides coverage for an intangible item: software. EMOI states in
its appellate brief: “Computer software is not the same type of tangible thing as a floppy
-22-
disk, tape or thumb drive. It is something that is not physical, seen or touched.
However, it is tangible enough for [Owners] to insure and expressly define under the
definition of ‘media’ and thus, must be tangible enough to be damaged or suffer direct
physical damage if such is required under the policy by a computer hacker as was done
in this case.” (Appellant’s Brief at 17.)
{¶ 53} EMOI’s position is supported by Natl. Ink and Stitch, LLC v. State Auto
Property and Cas. Ins. Co., 435 F.Supp.3d 679 (D.Md.2020). In National Ink and Stitch,
the computer server and networked computers of an embroidery and screen printing
business experienced a ransomware attack, which prevented the business from
accessing all of the art files and other data contained on the server and, with one
exception, all of its software. The attacker demanded a bitcoin to release access to the
software and data. The business paid the bitcoin, but it did not receive all of the
necessary files to release its software and data (it received the executable file, but not the
configuration file.). The hacker demanded another bitcoin for the additional file.
Instead, the business hired a security company to replace and reinstall its software and
to install protective software. The resultant system was slower than it previously had
been, art files could not be accessed, and experts indicated that there were likely dormant
remnants of the ransomware software that could re-infect the entire system. To
eliminate the risk of further infection, the business could “wipe” the entire system and
reinstall of the software and information or purchase a new server and components.
{¶ 54} The business filed a claim with State Auto regarding the ransomware attack,
seeking coverage for the replacement of its system. The policy stated that State Auto
“will pay for direct physical loss of or damage to Covered Property * * *.” The
-23-
Businessowners Special Form Computer Coverage endorsement defined Covered
Property to include “Electronic Media and Records (Including Software),” and defined
“Electronic Media and Records” to include “(a) Electronic data processing, recording or
storage media such as films, tapes, discs, drums or cells; [and] (b) Data stored on such
media.” State Auto denied the claim.
{¶ 55} In cross-motions for summary judgment, the parties disputed whether the
business experienced “direct physical loss or damage to” its computer system.
Interpreting the policy, the district court concluded that the policy contemplated that data
and software could experience “direct physical loss or damage.” It reasoned:
Here, the Policy expressly lists “data” as an example of Covered Property
under its definition of “Electronic Media and Records (Including Software).”
ECF 35-2 at 61. While the term “data” is qualified with the phrase “stored
on such media,” if the Policy intended to require physical loss or damage to
the media itself, as opposed to just the data, it could have stopped at
subsection (a), which describes the covered media. Id. Instead, the
Policy includes “data stored on such media” as a separate subcategory of
Covered Property in subsection (b). Id. The Policy also contains the
phrase “Including Software” in its heading describing covered property. Id.Thus, the plain language of the Policy contemplates that data and software
are covered and can experience “direct physical loss or damage.”
Natl. Ink & Stitch, LLC, 435 F.Supp.3d at 682. See also Lambrecht & Assocs., Inc., 119
S.W.3d at 24-26 (Tex.App.2003) (policy’s language allowed for coverage to “electronic
media and records” and the “data stored on such media” as “such property is capable of
-24-
sustaining a ‘physical’ loss”).
{¶ 56} Again, construing the evidence in the light most favorable to EMOI, we
conclude that the policy contemplated that EMOI’s software and reproduction of data was
capable of being physically damaged, and Glaser-Garbrick has testified that it was.
D. Exclusions
{¶ 57} Finally, Owners argues that applicable limitations and exclusions exist that
preclude coverage under the Electronic Equipment endorsement. The exclusion
provision in the endorsement precludes coverage for:
a. Wear and tear * * *
b. Loss or damage caused by:
(1) Corrosion or rusting;
(2) Dryness or dampness of atmosphere; or
(3) Extremes of temperature
unless directly resulting from accidental direct physical damage to
the electronic equipment system’s air conditioning equipment
caused by a peril not excluded by this endorsement.
c. Any dishonest, fraudulent or criminal act by:
(1) You;
(2) Your partners; or
(3) Any of your officers, directors or trustees
Whether acting alone or in collusion with others.
d. “Electrical disturbance” unless caused by lightning.
e. Loss or damage caused by:
-25-
(1) Data processing “media” failure; or
(2) Breakdown or malfunction of the data processing equipment and
component parts while the “media” is being run through the system.
***
f. Actual work upon, installation or testing of Covered Property. * * *
g. Faulty construction or error in the design of the Covered Property. * * *
h. Delay or loss of market;
i. Loss or damage caused by or resulting from improper operation of
Covered Property.
j. Breakage, marring, scratching, tearing or denting of any “laptop computer”
unless caused by * * *.
{¶ 58} Owners states, in summary fashion, that coverage for EMOI’s claim is
excluded under (e), (h), and (i). Construing the evidence in EMOI’s favor, we disagree
that the circumstances here involve media failure, a malfunction or breakdown of
equipment while the “media” was being run through the system, a loss of market, or
improper operation of the media by EMOI.
{¶ 59} Owners further points to the “Business Income and Extra Expenses”
provision within the “Additional Coverages” portion of the Electronic Equipment
endorsement. This provision generally states that Owners would pay for loss of business
income during the period of restoration. This provision has its own exclusions, which
include losses or damage caused by “Theft of any property, which is not an integral part
of a building or structure at the time of loss.” We fail to see how this provision would
preclude coverage under the endorsement as a whole, nor does the record suggest that
-26-
all of EMOI’s loss or damage would fall under this provision.
{¶ 60} For the foregoing reasons, we conclude that genuine issues of material fact
exist as to whether EMOI’s claim was covered by Electronic Endorsement – Media policy.
Consequently, the trial court erred in granting summary judgment to Owners on EMOI’s
breach of contract claim.
{¶ 61} EMOI’s first assignment of error is sustained.
IV. Bad Faith Claim
{¶ 62} In its second assignment of error, EMOI claims that the trial court erred in
granting summary judgment to Owners on its bad faith claim. The trial court did not
separately address EMOI’s bad faith claim, but instead granted judgment to Owners
based on its disposition of EMOI’s breach of contract claim.
{¶ 63} “In Ohio, an insurer has a duty to act in good faith toward its insured in
carrying out its responsibilities under the policy of insurance. Those responsibilities
include the handling and payment of an insured’s claim. Thus, ‘[a]n insurer fails to
exercise good faith in the processing of a claim of its insured where its refusal to pay the
claim is not predicated upon circumstances that furnish reasonable justification therefor.’ ”
(Citations omitted.) Unklesbay v. Fenwick, 167 Ohio App.3d 408, 2006-Ohio-2630, 855
N.E.2d 516, ¶ 14 (2d Dist.), quoting Zoppo v. Homestead Ins. Co., 71 Ohio St.3d 552,
644 N.E.2d 397 (1994), paragraph one of the syllabus.
{¶ 64} During his deposition, Weaner described the process he employed when
reviewing EMOI’s claim. Weaner received EMOI’s claim on the morning of September
13. The loss notice stated that all files were encrypted and were being held under
ransom and that the business could not operate under current conditions. Weaner
-27-
indicated that he had spoken with Glaser, reviewed the policy provisions, and had spoken
with a home officer examiner about the facts he had learned from Glaser. Weaner and
the home officer examiner reviewed EMOI’s policy, identified policies that potentially
applied to the claim, and reviewed them “looking for coverage.” The claim was denied
the same day.
{¶ 65} When asked about his experience with computer matters, Weaner indicated
that he received regular IT training from Auto-Owners, predominantly on phishing.
Weaner did not know how software could be damaged and did not know of anyone at
Auto-Owners who could explain damage to software. Weaner did not consult with an IT
or computer expert while evaluating EMOI’s claim. Weaner stated that he previously had
handled claims involving damage to computer systems, but those claims typically had
involved water, fire, or electrical surges.
{¶ 66} Weaner acknowledged that he had a duty to an insured to act in good faith,
which included the duties to fully and fairly investigate the claim and to objectively
evaluate the claim.
{¶ 67} In response to Owners’ motion for summary judgment, EMOI presented the
affidavit of an expert witness, Chris Johnson, who indicated that he had 35 years of
experience in the insurance industry. Johnson opined that Owners’ evaluation of EMOI’s
complaint was deficient and “fell well below the standards, practices and customs in the
insurance industry for conducting a fair, thorough and competent investigation of an
insurance claim.” He stated that Owners failed to consider the various types of damage
that can occur to media such as software, emphasizing that Owners did not consult with
an IT or computer science specialist when evaluating EMOI’s claim. Johnson noted that
-28-
Weaner had previously handled claims involving damage to computers, but not to
software.
{¶ 68} Upon review of the evidence, we find that genuine issues of material fact
exist as to whether Owners complied with its duty of good faith in denying EMOI’s claim.
Accordingly, the trial court erred in granting summary judgment on EMOI’s bad faith claim.
{¶ 69} EMOI’s second assignment of error is sustained.
V. Conclusion
{¶ 70} The trial court’s judgment will be reversed, and the matter will be remanded
for further proceedings.
.............
DONOVAN, J., concurs.
TUCKER, P.J., dissents:
{¶ 71} The Electronic Equipment endorsement provides coverage for “direct
physical loss or damage” to media, with media being defined as a device upon “which
information is recorded * * *.” The endorsement then states that “media includes
computer software * * * contained on covered media.” Thus, as correctly noted by the
majority opinion, “giving this language its plain and ordinary meaning, computer software
[to be covered by the endorsement] must be contained on another medium * * *.” The
medium, presumably a server, upon which the software at issue was stored did not
sustain physical loss or damage. Therefore, coverage under the endorsement was not
triggered. Upon this basis, I respectfully dissent.
{¶ 72} In opposition to this conclusion, EMOI argues that as a result of the hacker’s
-29-
encryption, its software was damaged, and this damage invoked coverage because
“software is included in the [endorsement’s] definition of media * * *.” EMOI does not,
and cannot, assert that the encryption caused loss or damage to the server upon which
the software was stored. But, as explained, such loss or damage to the device upon
which the software is stored was a prerequisite to coverage for loss or damage to
software.
{¶ 73} I submit that the conclusion I have reached is compelled by the clear,
unambiguous endorsement language, which eliminates any factual issues regarding
whether EMOI’s loss is a covered loss. Perhaps the endorsement language could have
been more precise, but as the Ohio Supreme Court recently reaffirmed, a court cannot
“creat[e] [a contractual] ambiguity by asking whether the parties could have included
different or more express language in their agreement.” AKC, Inc. v. United Specialty
Ins. Co., Ohio Slip Opinion No. 2021-Ohio-3540, __ N.E.3d __, ¶ 12, citing 11 Lord,
Williston on Contracts, Section 30:4 (4th Ed.2021).
{¶ 74} The conclusion I have reached highlights the following “hard reality about
insurance”:
It is not a general safety net for all dangers. If risk is not having money
when you need it, insurance is one answer to perilous events that could
prompt a sudden drop in revenue. Fair pricing of insurance turns on
correctly accounting for the likelihood of the occurrence of each defined peril
and the cost of covering it. Efforts to push coverage beyond its terms
creates a mismatch, an insurance product that covers something no one
paid for and, worse, runs the risk of leaving insufficient funds to pay for perils
-30-
that insureds did pay for. That is why courts must honor the coverage the
parties did – and did not – provide for in their written contracts of insurance.
Santo’s Italian Café, LLC v. Acuity Ins. Co., ___ F.4th ___, 2021 WL 4304607, *7 (6th
Cir.).1
{¶ 75} Based upon my coverage conclusion, I also dissent regarding the majority
decision that there are factual issues surrounding EMOI’s bad faith cause of action.
Since, in my opinion, Owners made the correct coverage call, its refusal to pay EMOI’s
claim was “predicated upon circumstances that furnish[ed] reasonable justification” for
the refusal. Unklesbay, 167 Ohio App.3d 408, 2006-Ohio-2630, 855 N.E.2d 516, at ¶ 14,
quoting Zoppo, 71 Ohio St.3d 552, 644 N.E.2d 397, at paragraph one of the syllabus.
Given this, Owners, as a matter of law, did not act in bad faith.
Copies sent to:
John A. Smalley
Erin B. Moore
Hon. Gregory F. Singer
1
Acuity decided whether Santo’s, a restaurant, was entitled to business interruption
coverage based upon Santo’s being forced to suspend its indoor dining operation as a
result of Ohio’s Covid-19 mandates. Santo’s business interruption coverage was, as in
the present case, triggered by loss or damage to covered property. The Sixth Circuit,
applying Ohio law, decided that since no covered property was altered by the forced
shutdown, Santo’s did not sustain loss or damage to covered property, and, thus, the loss
was not covered. Though the interpretation of the loss or damage language has been
discussed in this case, resolution of the appropriate interpretation of this language is not
relevant to my analysis because, as discussed, EMOI does not assert loss or damage to
the server upon which the affected software was stored.