EMOI Servs., L.L.C. v. Owners Ins. Co.

2022 Ohio 4649, 208 N.E.3d 818, 170 Ohio St. 3d 78

• Court: Ohio Supreme Court
• Decided: December 27, 2022
• Docket: 2021-1529
• Status: Published

Opinion

[Until this opinion appears in the Ohio Official Reports advance sheets, it may be cited as EMOI Servs., L.L.C. v. Owners Ins. Co., Slip Opinion No. 2022-Ohio-4649.]

NOTICE This slip opinion is subject to formal revision before it is published in an advance sheet of the Ohio Official Reports. Readers are requested to promptly notify the Reporter of Decisions, Supreme Court of Ohio, 65 South Front Street, Columbus, Ohio 43215, of any typographical or other formal errors in the opinion, in order that corrections may be made before the opinion is published.

SLIP OPINION NO. 2022-OHIO-4649 EMOI SERVICES, L.L.C., APPELLEE, v. OWNERS INSURANCE COMPANY, APPELLANT. [Until this opinion appears in the Ohio Official Reports advance sheets, it may be cited as EMOI Servs., L.L.C. v. Owners Ins. Co., Slip Opinion No. 2022-Ohio-4649.] Insurance—Contracts—Businessowners insurance policy—When contractual language is clear, the writing itself determines the parties’ intent— Electronic-equipment endorsement requires direct physical loss of or damage to media—Computer software cannot experience direct physical loss or physical damage, because it does not have a physical existence— When insurance policy covers “physical damage,” there must be direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy. (No. 2021-1529—Submitted August 2, 2022—Decided December 27, 2022.) APPEAL from the Court of Appeals for Montgomery County, No. 29128, 2021-Ohio-3942. SUPREME COURT OF OHIO

__________________ STEWART, J. {¶ 1} In this appeal from a judgment of the Second District Court of Appeals, we are asked to determine whether a businessowners insurance policy issued by appellant, Owners Insurance Co. (“Owners”), and held by appellee, EMOI Services, LLC (“EMOI”), covers losses that resulted from a ransomware attack on EMOI’s computer-software systems. Because the ransomware attack caused no “direct physical loss of or damage to” the software—a requirement for coverage under the policy—Owners is not responsible for covering the resulting loss. Accordingly, we reverse the decision of the Second District and reinstate the trial court’s grant of summary judgment in favor of Owners and against EMOI on EMOI’s claim for breach of contract and bad-faith denial of insurance coverage. Facts and Procedural History {¶ 2} EMOI is a computer-software company that uses software it has developed, along with outside software, to provide medical offices with service and support for setting appointments, record keeping, and billing. On September 12, 2019, EMOI became the target of a ransomware attack when an unknown party, i.e., a “hacker,” illegally gained access to EMOI’s computer systems and encrypted files needed for using its software and database systems. As a result of the attack, when a file was opened, a ransom note appeared notifying the user that the files were encrypted and therefore unavailable but that the files could be restored to normal by a decryption key the hacker would provide in exchange for the payment of three bitcoins—approximately $35,000 at the time. {¶ 3} After looking into the timing and financial feasibility of recovering the files through the assistance of a third-party company, EMOI decided to pay the ransom. Upon payment, EMOI received an email from the hacker with a link to download a program that would decrypt the files. A majority of the system files were returned to normal following the decryption process. An automated phone

2 January Term, 2022

system, however, remained encrypted because the decryption key had not worked on the separate server that attended to that system. There was no hardware or equipment damage as a result of the ransomware attack. Following the attack, EMOI upgraded its software systems and took other steps to protect its systems from future attacks. {¶ 4} At the time of the ransomware attack, EMOI was insured under a businessowners insurance policy issued by Owners. EMOI’s general manager contacted Owners to file an insurance claim within a day of the attack. That claim was reviewed by Bradley Weaner, a field claims representative for Owners. Weaner ultimately determined that EMOI’s policy did not cover the type of losses experienced by EMOI—i.e., EMOI’s payment of the ransom and the costs associated with investigating and remediating the attack as well as upgrading its security systems—and denied the claim the same day it was filed. {¶ 5} In a letter denying the claim, Weaner identified two potentially applicable provisions in the insurance policy: the “Data Compromise” endorsement and the “Electronic Equipment” endorsement. Weaner quoted the language from the data-compromise endorsement that defined “personal data compromise” as well as the language that excluded coverage for “any threat, extortion or blackmail,” including but not limited to “ransom payments.” Accordingly, Weaner notified EMOI that the data-compromise endorsement did not apply to its claim. {¶ 6} Weaner also explained that the electronic-equipment endorsement did not apply. The electronic-equipment endorsement provides:

When a limit of insurance is shown in the Declarations under ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct physical loss of or damage to “media” which you own, which is leased or rented to you or which is in your care, custody or control while located at the premises described in the Declarations. We will

3 SUPREME COURT OF OHIO

pay for your costs to research, replace or restore information on “media” which has incurred direct physical loss or damage by a Covered Cause of Loss. Direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.

(Capitalization sic.) {¶ 7} The electronic-equipment endorsement defines “media” as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards.” The definition section further states that “media” includes “computer software and reproduction of data contained on covered media.” Weaner denied the claim under the electronic-equipment endorsement on the grounds that there was no “direct physical loss to the ‘media.’ ” {¶ 8} In December 2019, EMOI filed a lawsuit against Owners, alleging that Owners breached the insurance policy contract by denying coverage under the electronic-equipment endorsement and that Owners denied coverage in bad faith. Owners answered the complaint by denying EMOI’s legal claims and counterclaimed for a declaratory judgment that “no coverage, payment or indemnity is owed” to EMOI under the policy. Thereafter, Owners filed a motion for summary judgment on EMOI’s claims and its counterclaim for declaratory judgment. {¶ 9} The trial court granted summary judgment to Owners. The trial court explained that the evidence showed that the software and database systems were not damaged by the encryption but that EMOI was prevented from accessing or using those systems because of the encryption. The trial court also noted: “In reality, this is a data compromise situation, rather than a situation involving physical damage to electronic equipment,” and “[u]nfortunately for EMOI, the Data

4 January Term, 2022

Compromise endorsement in its insurance policy expressly excludes coverage for costs arising from any threat, extortion or blackmail, including ransom payments.” {¶ 10} EMOI appealed the trial court’s grant of summary judgment, and the Second District reversed in a two-to-one decision. The appellate court determined that the language of the electronic-equipment endorsement potentially applied to EMOI’s claim if EMOI could prove that its media, i.e., its software, was in fact damaged by the encryption. The appellate court determined that genuine issues of material fact existed as to whether there was actual damage to the software based on the affidavits and deposition transcripts submitted by EMOI in its brief in opposition to Owners’ motion for summary judgment. The Second District also noted that EMOI submitted expert testimony indicating that Owners did not thoroughly review EMOI’s claim that the software was damaged before it denied the claim and held that there were genuine issues of material fact whether Owners complied with its duty of good faith in denying EMOI’s claim. The appellate court reversed the trial court’s grant of summary judgment to Owners on the claim for breach of contract and the claim of bad faith in denying coverage. {¶ 11} Owners appealed to this court, and we accepted the following propositions of law for review:

I. A businessowners property policy that requires “direct physical loss of or damage to” property does not cover losses from a ransomware attack. II. A court cannot read a ransomware coverage into a businessowners all risk property policy by reading key ransomware exclusions out. III. Experts are not required for either coverage determinations or to avoid bad faith claims.

5 SUPREME COURT OF OHIO

See 166 Ohio St.3d 1413, 2022-Ohio-554, 181 N.E.3d 1210. We find merit to Owners’ first proposition of law, and we reverse the judgment of the court of appeals on that basis. Our disposition of the first proposition of law renders Owners’ second and third propositions of law moot. Analysis {¶ 12} This case turns on the legal interpretation of the electronic- equipment endorsement in EMOI’s businessowners insurance policy. “An insurance policy is a contract.” Westfield Ins. Co. v. Galatis, 100 Ohio St.3d 216, 2003-Ohio-5849, 797 N.E.2d 1256, ¶ 9. When interpreting a contract, “the role of a court is to give effect to the intent of the parties to the agreement.” Id. at ¶ 11. We thus “examine the insurance contract as a whole and presume that the intent of the parties is reflected in the language used in the policy.” Id., citing Kelly v. Med. Life Ins. Co., 31 Ohio St.3d 130, 509 N.E.2d 411 (1987), paragraph one of the syllabus. When contractual language is clear, we look no further than the writing itself to determine the parties’ intent. Alexander v. Buckeye Pipe Line Co., 53 Ohio St.2d 241, 246, 374 N.E.2d 146 (1978). {¶ 13} We find the language in the electronic-equipment endorsement to be clear and unambiguous in its requirement that there be direct physical loss of, or direct physical damage to, electronic equipment or media before the endorsement is applicable. Since software is an intangible item that cannot experience direct physical loss or direct physical damage, the endorsement does not apply in this case. {¶ 14} The electronic-equipment endorsement states that Owners “will pay for direct physical loss of or damage to ‘media’ which [EMOI] own[s].” It also states: “Direct physical loss of or damage to Covered Property must be caused by a Covered Cause of Loss.” The Businessowners Special Property Coverage Form attached to the insurance policy states that “covered causes of loss” are “risks of direct physical loss.” The electronic-equipment endorsement defines “media” as

6 January Term, 2022

“materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards” and states that “media” includes “computer software and reproduction of data contained on covered media.” {¶ 15} EMOI argues that computer software is “media” under the policy and that the policy nevertheless contemplates that software can be damaged, despite that it is nonphysical. EMOI contends that the policy covers that damage even when there has been no damage to hardware. We are not persuaded by this argument. The most natural reading of the phrase “direct physical loss of or damage to” is that EMOI is insured for direct physical loss of its media and insured for direct physical damage to its media. See Ward Gen. Ins. Servs., Inc. v. Emps. Fire Ins. Co., 114 Cal.App.4th 548, 554, 7 Cal.Rptr.3d 844 (2003) (construing the phrase “direct physical loss of or damage to” to require direct physical damage, as opposed to indirect or nonphysical damage, to the covered property, because “[m]ost readers expect the first adjective in a series of nouns or phrases to modify each noun or phrase in the following series unless another adjective appears”); see also Santo’s Italian Café, L.L.C. v. Acuity Ins. Co., 15 F.4th 398, 402 (6th Cir.2021) (construing identical language as containing a requirement of “direct physical loss” or “direct physical damage” to the covered property). In other words, the adjectives “direct” and “physical” modify both “loss” and “damage.” Accord Kingray, Inc. v. Farmers Group, Inc., 523 F.Supp.3d 1163, 1173 (C.D.Cal.2021). Similarly, although the term “computer software” is included within the definition of “media,” it is included only insofar as the software is “contained on covered media.” (Emphasis added.) We hold that “covered media” means media that has a physical existence. Indeed, all examples of covered media in the definition section are materials of a physical nature, i.e., “film, magnetic tape, paper tape, disks, drums, and cards.” And we also hold that the policy requires that there must be direct physical loss or physical damage of the covered media containing the computer software for the software to be covered under the policy. This interpretation is supported by the

7 SUPREME COURT OF OHIO

language of the electronic-equipment endorsement, which states that “direct physical loss of or damage to Covered Property [i.e., media] must be caused by a Covered Cause of Loss [i.e., risk of direct physical loss].” {¶ 16} Computer software cannot experience “direct physical loss or physical damage” because it does not have a physical existence. See Ward at 850. Software is essentially nothing more than a set of instructions that a computer follows to perform specific tasks. Fantasy Sports Properties, Inc. v. Sportsline.com, Inc., 287 F.3d 1108, 1118 (Fed.Cir.2022) (“Software is a set of instructions, known as code, that directs a computer to perform specified functions or operations”). It is information stored on a computer or other electronic medium. See Ward at 850. While a computer or other electronic medium has physical electronic components that are tangible in nature, the information stored there has no physical presence. Id. In other words, the information—the software—is entirely intangible. Focusing on what the parties would have intended, see Alexander, 53 Ohio St.2d at 246, 374 N.E.2d 146, we are unpersuaded that the policy covered “physical damage” to computer software (an intangible) without there also being physical damage to the hardware on which the software was stored. {¶ 17} Because the insurance policy at issue did not cover the type of loss EMOI experienced, Owners did not breach its contract with EMOI. Accordingly, we reverse the judgment of the Second District Court of Appeals and reinstate the trial court’s grant of summary judgment in favor of Owners on EMOI’s claim of breach of contract and bad-faith denial of insurance coverage. Judgment reversed. O’CONNOR, C.J., and KENNEDY, FISCHER, DEWINE, DONNELLY, and BRUNNER, JJ., concur. _________________ Dyer, Garofalo, Mann & Schultz, L.P.A., John A. Smalley, and Kenneth J. Ignozzi, for appellee.

8 January Term, 2022

Green & Green Lawyers, L.P.A., and Erin B. Moore, for appellant. Vorys, Sater, Seymour, & Pease, L.L.P, Natalia Steele, and Anthony Spina, urging reversal for amici curiae Ohio Insurance Institute and American Property Casualty Insurance Association. Arnold & Clifford, L.L.P, James E. Arnold, and Gerhardt A. Gosnell II; and Anderson Kill, P.C., Joshua Gold, Daniel J. Healy, and Dennis J. Nolan, urging affirmance for amicus curiae United Policyholders. Rutter & Russin, L.L.C., and Robert P. Rutter, urging affirmance for amicus curiae Rutter & Russin, L.L.C. _________________