EMOI Servs., L.L.C. v. Owners Ins. Co.

2021 Ohio 3942, 180 N.E.3d 683

Opinion

IN THE COURT OF APPEALS OF OHIO SECOND APPELLATE DISTRICT MONTGOMERY COUNTY

EMOI SERVICES, LLC :

:

Plaintiff-Appellant : Appellate Case No. 29128 :

v. : Trial Court Case No. 2019-CV-5979 :

OWNERS INSURANCE COMPANY : (Civil Appeal from : Common Pleas Court)

Defendant-Appellee :

:

...........

OPINION

Rendered on the 5th day of November, 2021.

...........

JOHN A. SMALLEY, Atty. Reg. No. 0029540, 131 North Ludlow Street, Suite 1400, Dayton, Ohio 45402 Attorney for Plaintiff(s)-Appellant

ERIN B. MOORE, Atty. Reg. No. 0061638, 800 Performance Place, 109 North Main Street, Dayton, Ohio 45402 Attorney for Defendant(s)-Appellee

.............

EPLEY, J.

{¶ 1} EMOI (Electronic Medical Office Integration) Services, LLC, appeals from a judgment of the Montgomery County Court of Common Pleas, which granted summary judgment to Owners Insurance Company on EMOI’s breach of contract and bad faith claims. For the following reasons, the trial court’s judgment will be reversed, and the case will be remanded for further proceedings.

I. Facts and Procedural History

{¶ 2} The underlying facts are largely undisputed. EMOI provides “medical billing services and application services and support” to medical providers. The company obtains necessary information from patients and medical providers for medical services rendered and formulates it into a fillable billing claims form to the third-party payer network. EMOI also sends invoices to patients for balances due.

{¶ 3} EMOI employees have two computer logins. They first must provide login information to access their work computers. Employees then use a second login to access Medics, the system that allows customers to input billing data, scheduling, and other applications offered to them. In addition to Medics, EMOI has its own proprietary software that is the preferred method for customers to enter patient charges, procedure codes, and diagnosis codes.

{¶ 4} On September 12, 2019, after logging into her workstation, an EMOI employee, Ruth Ross, discovered that she was unable to access the Medics system. She contacted Vernon Glaser, the general manager of EMOI, who contacted Dan Glaser- Garbrick, EMOI’s software developer and information technology (IT) manager.

{¶ 5} Glaser-Garbrick “could not log in the way [he] normally [did]” but was able to

3

access the system using VPN access. When he did, he saw that all of the files on the affected servers had “weird extensions.” Glaser-Garbrick recognized that EMOI’s system had been hacked and the files encrypted. A ransom note was “in every single folder on all the computers that were affected.” Glaser-Garbrick informed Glaser of what had occurred. At this point, Glaser was receiving phone calls from several clients, all of whom reported that they could not access the system.

{¶ 6} According to Glaser-Garbrick, the ransom note stated that the files were encrypted and currently unavailable, but the company could get them back. The hacker indicated that the company should respond by email with the provided personal code and that the company could decrypt one file for free. Per the hacker’s instructions, Glaser- Garbrick sent the hacker an encrypted file and the personal code indicated on the ransom note, and the hacker responded with the contents of the file. Glaser-Garbrick indicated that the returned file could be opened and operated normally. The hacker further indicated that the remaining files could be decrypted for three bitcoins, which at that time cost a total of approximately $35,000.

{¶ 7} EMOI started investigating data recovery companies that could decrypt its files without paying the hacker. It selected a company from Australia, but the estimated cost was approximately $55,000, and the data recovery company was not certain that all of the data could be recovered. Ultimately, EMOI decided to pay the hacker. Within about an hour of sending the bitcoin, EMOI received an email with a link to download a program that would decrypt the files. Glaser-Garbrick stated that, once the decryption program operated and decrypted the files, “the files would open and functioned the way they were intended.” A few files did not get decrypted, “but they weren’t super critical.”

4

{¶ 8} Soon after the decryption was completed, the encryption program re-ran on the Medics server. Glaser-Garbrick was able to decrypt the files again with the same decryption key previously provided by the hacker.

{¶ 9} In response to the ransomware attack, EMOI upgraded the Medics software, transitioned from remote access to using VPN software, and moved its computer access to a new domain. EMOI also changed how it backed up its system. The system still had a few residual problems: the interface between EMOI’s website and Medics could not communicate and the program that auto-generated remittances did not function due to being moved to the new server, and the automated phone call system had not been decrypted because the key did not work.

{¶ 10} When the ransomware attack occurred, EMOI was covered by a businessowner’s insurance policy issued by Owners. At approximately 8:03 a.m. on September 13, 2019 (the day after the attack), Glaser called his insurance agent to report the incident and file a claim. EMOI’s claim was assigned to Bradley Weaner, a field claim representative for Auto-Owners Insurance, the parent company of Owners. Weaner reviewed the written loss notification in the computer system, reviewed EMOI’s policy, and then spoke with Glaser. Glaser reported that the situation was discovered when an employee could not log into her computer system. Glaser told Weaner that the data was not physically damaged, but was inaccessible due to being encrypted and held for ransom. While reviewing the claim, Weaner spoke with his branch manager and home office commercial lines manager.

{¶ 11} Weaner concluded that there was no coverage under any of the potentially applicable provisions of the insurance policy, including the Data Compromise

5

endorsement and the Electronic Equipment endorsement. The Data Compromise endorsement addresses the compromise of an individual’s “personal data.” The exclusion portion of the Data Compromise endorsement precludes coverage for “[a]ny threat, extortion or blackmail. This includes, but is not limited to, ransom payments and private security assistance[.]” The Electronic Equipment endorsement includes a provision addressing “direct physical loss or damage to ‘media.’ ”

{¶ 12} Weaner again spoke with Glaser and informed him that the claim would be denied. He also sent a coverage position letter outlining the bases for the lack of coverage. The letter identified the two potentially applicable endorsements and explained that neither provision provided coverage, reasoning:

As cited in the policy language above, paying ransom is excluded. Since the data belongs to another party that is not your customer it does not meet the definition of “affected individual”. Furthermore, there is no direct physical loss to the “media”. * * * The letter indicated that EMOI should contact Owners with any additional information. EMOI did not provide additional information to Owners following the denial.

{¶ 13} In December 2019, EMOI filed suit in the common pleas court, alleging that Owners breached its contract by denying coverage under the Electronic Equipment provision and that Owners denied coverage in bad faith. Owners denied the claims and counterclaimed for a declaratory judgment that “no coverage, payment or indemnity is owed” to EMOI under the policy.

{¶ 14} On January 21, 2021, Owners moved for summary judgment on EMOI’s claims and its counterclaim for declaratory judgment. In its motion, Owners highlighted

6

the Businessowners Special Property Coverage form, the Data Compromise endorsement, and the Electronic Equipment endorsement in the policy and argued, primarily, that no direct physical loss or damage had occurred, as required by the Special Property Coverage Form and Electronic Equipment endorsement. Owners further argued that the Data Compromise endorsement did not extend to the type of loss incurred by EMOI, as it did not involve “affected persons” or “personally identifying information.” Finally, Owners asserted that, in the absence of a breach of contract, there can be no basis for a bad faith claim. Owners supported its motion with depositions from Glaser, Glaser-Garbrick, and Weaner, as well as an affidavit from Weaner and accompanying documents.

{¶ 15} In response, EMOI focused on the Electronic Equipment endorsement.

The company indicated that it was “not seeking merely to recover for lost data,” which it acknowledged was not covered by the policy. Rather, it argued that it was seeking coverage for “the damage to the media, not the information or data contained on the media.” EMOI explained that the software, a computer program, “was damaged by a computer hacker who manipulated the computer software program, encrypting the program to prevent EMOI’s use of the software and access to the data. Both the Medics software and EMOI’s own software was not accessible or usable. Thus, the computer software was damaged.” EMOI further asserted that, even after it obtained the decryption key, the software was still damaged, as it became encrypted again. EMOI stated it that also suffered several other problems with software it was running.

{¶ 16} EMOI supported its motion with an affidavit from an expert witness, Chris Johnson, who had over 35 years of experience and training in the insurance industry.

7

Johnson discussed deficiencies in Weaner’s investigation and opined both that Owners failed in its duties to EMOI and that EMOI’s claim should have been granted. Owners sought to strike Johnson’s affidavit. We find no indication that the trial court addressed the motion to strike, but it did not reference Johnson’s affidavit in its decision on the motion for summary judgment.

{¶ 17} In granting summary judgment to Owners, the trial court found EMOI’s arguments unconvincing. It reasoned:

Garbrick testified that he considered EMOI’s “whole database” to be damaged because the encryption prevented EMOI from accessing or using it. (Garbrick Dep. 47.) However, Garbrick admitted that once he decrypted it, he could use the database and that it does what it did before it was encrypted. Id. Assuming arguendo that the software was “damaged”

while it was encrypted, given the fact that EMOI has all the data it did before the ransomware attack, and that its software is now fully-functional, the Court finds that the “media” is no longer damaged.

In reality, this is a data compromise situation, rather than a situation involving physical damage to electronic equipment. The hacker gained unauthorized access to EMOI’s computer systems as a result of a vulnerability within the system, and EMOI ultimately had to pay a ransom in order to regain control of [its] software and data. Unfortunately for EMOI, the Data Compromise endorsement in its insurance policy expressly excludes coverage for costs arising from any threat, extortion or blackmail, including ransom payments. The Data Compromise endorsement also

8

excludes costs arising from correcting any deficiency in its “systems, procedures or physical security that may have contributed to a ‘personal data compromise.’ ” In other words, the cost endured by EMOI to upgrade its systems to cure the deficiency that left it vulnerable to attack is expressly excluded under the Data Compromise endorsement.

The Court suspects that EMOI is attempting to interpret the language in the Electronic Equipment endorsement in a way that provides coverage because the Data Compromise endorsement, which is the applicable endorsement, clearly excludes coverage in this situation. However, the Court cannot logically conclude that EMOI sustained direct physical loss of or damage to its “media” when EMOI’s computer systems are now fully-

functional with all the data it had before the ransomware attack.

The trial court thus granted summary judgment to Owners on all of EMOI’s claims and entered judgment in favor of Owners.

{¶ 18} EMOI appeals from the trial court’s judgment, claiming that the trial court erred in granting Owners’ motion for summary judgment.

II. Summary Judgment Standard

{¶ 19} Pursuant to Civ.R. 56(C), summary judgment is proper when (1) there is no genuine issue as to any material fact, (2) the moving party is entitled to judgment as a matter of law, and (3) reasonable minds, after construing the evidence most strongly in favor of the nonmoving party, can only conclude adversely to that party. Zivich v. Mentor Soccer Club, Inc., 82 Ohio St.3d 367, 369-370, 696 N.E.2d 201 (1998). The moving party carries the initial burden of affirmatively demonstrating that no genuine issue of

9

material fact remains to be litigated. Mitseff v. Wheeler, 38 Ohio St.3d 112, 115, 526 N.E.2d 798 (1988). To this end, the movant must be able to point to evidentiary materials of the type listed in Civ.R. 56(C) that a court is to consider in rendering summary judgment. Dresher v. Burt, 75 Ohio St.3d 280, 292-293, 662 N.E.2d 264 (1996). The substantive law of the claim or claims being litigated determines whether a fact is “material.” Perrin v. Cincinnati Ins. Co., 2020-Ohio-1405, 153 N.E.3d 832, ¶ 29 (2d Dist.).

{¶ 20} Once the moving party satisfies its burden, the nonmoving party may not rest upon the mere allegations or denials of the party’s pleadings. Dresher at 293; Civ.R. 56(E). Rather, the burden then shifts to the nonmoving party to respond, with affidavits or as otherwise permitted by Civ.R. 56, setting forth specific facts that show that there is a genuine issue of material fact for trial. Dresher at 293. Throughout, the evidence must be construed in favor of the nonmoving party. Id.

{¶ 21} We review the trial court’s ruling on a motion for summary judgment de novo. Schroeder v. Henness, 2d Dist. Miami No. 2012-CA-18, 2013-Ohio-2767, ¶ 42. De novo review means that this court uses the same standard that the trial court should have used, and we examine all the Civ.R. 56 evidence, without deference to the trial court, to determine whether, as a matter of law, no genuine issues exist for trial. Ward v. Bond, 2d Dist. Champaign No. 2015-CA-2, 2015-Ohio-4297, ¶ 8.

III. Breach of Contract Claim

{¶ 22} EMOI first claims that summary judgment was improper on its breach of contract claim because genuine issues of material fact exist as to whether EMOI suffered damage to its media and whether the damage was covered under the terms of the

10

Electronic Equipment endorsement.

{¶ 23} The interpretation of a contract is a question of law. St. Marys v. Auglaize Cty. Bd. of Commrs., 115 Ohio St.3d 387, 2007-Ohio-5026, 875 N.E.2d 561, ¶ 38; Nationwide Mut. Fire Ins. Co. v. Guman Bros. Farm, 73 Ohio St.3d 107, 108, 652 N.E.2d 684 (1995). When reviewing a contract, the court’s primary role is to ascertain and give effect to the intent of the parties. Hamilton Ins. Serv., Inc. v. Nationwide Ins. Cos., 86 Ohio St.3d 270, 273, 714 N.E.2d 898 (1999). “We presume that the intent of the parties to a contract is within the language used in the written instrument.” DiPasquale v. Costas, 186 Ohio App.3d 121, 2010-Ohio-832, 926 N.E.2d 682, ¶ 36 (2d Dist.), quoting Saunders v. Mortensen, 101 Ohio St.3d 86, 2004-Ohio-24, 801 N.E.2d 452.

{¶ 24} A contract that is, by its terms, clear and unambiguous requires no real interpretation or construction and will be given the effect called for by the plain language of the contract. Aultman Hosp. Assn. v. Community Mut. Ins. Co., 46 Ohio St.3d 51, 55, 544 N.E.2d 920 (1989). Where terms in an insurance contract are not defined, courts will give them their plain and ordinary meaning. E.g., Westfield Ins. Co. v. Galatis, 100 Ohio St.3d 216, 2003-Ohio-5849, 797 N.E.2d 1256, ¶ 11; Colter v. Spanky’s Doll House, 2d Dist. Montgomery No. 21111, 2006-Ohio-408, ¶ 29. “[A]mbiguous language in an insurance contract is construed against the insurance company.” Dominish v. Nationwide Ins. Co., 129 Ohio St.3d 466, 2011-Ohio-4102, 953 N.E.2d 820, ¶ 7.

{¶ 25} The parties’ arguments on appeal mirror those raised in the trial court.

EMOI disputes the trial court’s conclusion that EMOI’s software was not damaged. The company argues that Glaser-Garbrick’s deposition testimony created a genuine issue of material fact as to whether EMOI’s software was damaged, and it asserts that the damage

11

was covered under the Electronic Equipment endorsement in its policy with Owners. EMOI adds that in reaching the conclusion that its software was not damaged, the court failed to construe the evidence in the light most favorable to EMOI.

{¶ 26} Owners responds that the policy requires direct physical loss or damage, and because EMOI’s software was intangible, it was not covered by the Electronic Equipment endorsement. Owners cites to numerous cases addressing the application of “direct physical loss or damage” under a variety of circumstances. Owners further claims that EMOI misconstrues the definition of “media,” emphasizing that the endorsement contemplates tangible items that are subject to physical damage.

{¶ 27} The Electronic Equipment endorsement reads, in relevant part:

1. COVERAGE Covered Property

***

(2) Unscheduled Equipment

***

(b) When a limit of insurance is shown in the Declarations under ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct physical loss of or damage to “media” which you own, which is leased or rented to you or which is in your care, custody or control while located at the premises described in the Declarations. We will pay for your costs to research, replace or restore information on “media” which has incurred direct physical loss or damage by a Covered Cause of Loss.

Direct physical loss of or damage to Covered Property must be caused by

12

a Covered Cause of Loss.

The endorsement defines “media” as “materials on which information is recorded such as film, magnetic tape, paper tape, disks, drums, and cards. The definition section further states that “media” includes “computer software and reproduction of data contained on covered media.”

{¶ 28} As an initial matter, there is no apparent dispute that EMOI was insured against damage to media. The policy’s coverage page indicates that EMOI paid a premium of $161.91 for media coverage and had a coverage limit of $100,000. We therefore begin with whether EMOI’s claim concerns “media.”

A. Media

{¶ 29} The policy initially provides a broad definition of the term “media”: “materials on which information is recorded.” The sentence then provides examples of tangible “materials” that meet that definition: “film, magnetic tape, paper tape, disks, drums, and cards.” By the policy’s express language, the list is illustrative, not exhaustive. Accordingly, by its terms, other devices may satisfy the definition of “media.”

{¶ 30} Similar to statutory construction, we must read the policy’s broad definition of media (“materials on which information is recorded”) in light of the representative examples provided. Accord Stiner v. Amazon.com, Inc., 162 Ohio St.3d 128, 2020-Ohio- 4632, 164 N.E.3d 394, ¶ 32 (“the canon of ejusdem generis requires us to limit a broad phrase that follows specific examples to items similar to those specific examples”). In this case, the specific examples (“film, magnetic tape, paper tape, disks, drums, and cards”) appear to encompass a wide array of data storage devices, including paper data storage, magnetic data storage, optical storage, and solid-state/flash memory storage.

13

While the specific examples also may have common characteristics that would limit “media” to specific types of devices, those limiting characteristics are not apparent on this record.

{¶ 31} The parties have not directed us to cases addressing whether a server meets the definition of “media.” However, at least one court has held that a company’s server fell within the definition of “electronic media and records.” See Lambrecht & Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16, 25, 2003 WL 21078083 (Tex.App.) (“Based on Ashley's affidavit, the server falls within the definition of ‘electronic media and records’ because it contains a hard drive or ‘disc’ which could no longer be used for ‘electronic data processing, recording, or storage.’ ”). At oral argument, counsel for Owners indicated that a server could be “media,” although counsel asserted that it would need to be physically damaged.

{¶ 32} We repeat that the definitional provision of the Electronic Equipment endorsement further provides that “computer software and reproduction of data contained on covered media” also fall within the definition of “media.” Giving this provision its plain and ordinary meaning, computer software must be contained on another medium for the provision to apply.

{¶ 33} In his deposition, Glaser-Garbrick described how EMOI’s system was designed. He stated that EMOI had a physical server that operated as a host server for the Medics database; clients communicated with the database via an application installed on their computers. The host server was configured as a virtualization server, which allowed EMOI to run additional virtual servers “on top of it.” (“Server virtualization is the process of dividing a physical server into multiple unique and isolated virtual servers by

14

means of a software application. Each virtual server can run its own operating systems independently.” vmware, Server Virtualization Definition, https://www.vmware.com/ topics/glossary/content/server-virtualization (accessed Oct. 26, 2021).

{¶ 34} At the time of the ransomware attack, EMOI also had a backup virtual host server, which connected to the other server through a protocol called iSCSI (internet small computer systems interface). Glaser-Garbrick stated that the backup virtual host server functioned as an extra hard drive to save backups. Glaser-Garbrick explained that, prior to the ransomware attack, EMOI would run automatic backups every night and a full file copy of the Medics database would be saved on the backup server that was connected to the network.

{¶ 35} Glaser-Garbrick did not expressly address whether any components of EMOI’s system constituted “media.” Owners did not provide evidence from an IT specialist to address what constitutes media.

{¶ 36} Viewing the evidence in the light most favorable to EMOI, the company’s servers constituted materials on which EMOI’s information was recorded and thus arguably met the policy’s definition of “media.” Glaser’s and Glaser-Garbrick’s deposition testimony established that the servers contained the Medics software and EMOI’s proprietary software, as well as the Medics database. Glaser-Garbrick also specifically identified a backup server that operated as an extra hard drive on which the Medics information was saved nightly.

{¶ 37} In its appellate brief, Owners contends that there is no coverage for computer software and reproduction of data in this case, because “[n]o film, magnetic tape, disc, drum, card, etc., has been identified as physically damaged in this claim.”

15

(Emphasis sic.) Owners’ argument appears to stem from the policy’s statement that media includes computer software and reproduction of data that is contained on “covered media.” Consistent with the use of the term “covered” throughout the policy, we read “covered media” to mean media that is insured under the endorsement. See Black’s Law Dictionary 365 (6th Ed.1990) (“Cover. To protect by means of insurance[.]”) We do not find it reasonable to interpret the phrase to mean only media that has incurred a covered loss, as Owners suggests. In this case, because the computer software and reproduction of data was contained on EMOI’s servers, i.e., “covered media”, those items also met the definition of media.

{¶ 38} Owners’ reading of the definitional section renders meaningless the sentence defining media to include “software and reproduction of data on covered media.” Without that sentence, the definition of media reasonably would be restricted to tangible electronic storage media, and the policy already includes a provision stating “We will pay for your costs to research, replace or restore information on ‘media’ which has incurred direct physical loss or damage by a Covered Cause of Loss.” In other words, without the definitional sentence regarding software and reproduction of data, the policy provides coverage for physical loss or damage to tangible media and to replace information – which would include software and reproduction of data – contained on that tangible media. Owners’ interpretation of the media provision does not adequately account for the additional statement defining “media” to include software and reproduction of data on covered media.

B. Damage

{¶ 39} In granting summary judgment to Owners, the trial court concluded that

16

EMOI’s software was not damaged. The court focused on the fact that, after employing the decryption program, EMOI’s software again became operational. Construing the evidence in the light most favorable to EMOI, as we are required to do, we conclude that EMOI’s evidence supports a conclusion that its software was, in fact, damaged by the malicious encryption.

{¶ 40} According to Glaser’s deposition testimony, EMOI’s system was functioning normally at the end of business on September 11, 2019. Glaser-Garbrick testified that when he accessed the system on September 12, he saw that “all the files had weird extensions,” and there were approximately nine or ten different extensions. (Glaser- Garbrick Depo. at 14.) Glaser-Garbrick clarified that each computer on the network was encrypted, but with a different extension. (Id. at 14.) Because the backup server was connected to EMOI’s network, it also was encrypted.

{¶ 41} When asked during his deposition whether anything was damaged by the encryption, Glaser-Garbrick and Owners’ attorney had the following exchange:

Q. * * * Did you find anything that you would consider damaged as a result of the encryption by the hacker?

A. Our whole database.

Q. And why do you consider it damaged?

A. We couldn’t use it at all.

Q. While it was encrypted?

A. Yes.

(Glaser-Garbrick Depo. at 47.) Although Glaser-Garbrick at times referred to the database’s being encrypted, he testified that the hacker involuntarily encrypted all of the

17

digital information, which is “basically what runs the whole software – * * * the system.” (Id. at 25.) Glaser-Garbrick further testified that ransom notes had been added “in all the folders and stuff, too. * * * It was just in every single folder on all the computers that were affected.” (Id. at 16.) When Glaser-Garbrick attempted to open a file, the ransom note would appear instead.

{¶ 42} Glaser-Garbrick further testified that portions of the software remained damaged even after decryption. He stated that a program that generated remittances continued not to function after the decryption. In addition, the automated phone call system was contained on one of the virtual hard drives that did not get decrypted because the key did not work. (Id. at 44-45.) Glaser-Garbrick further stated that, even after he obtained the decryption key, the software was still damaged, as it became encrypted again. Construing the evidence in EMOI’s favor, Glaser-Garbrick’s testimony indicated that the hacker did not simply make EMOI’s software inaccessible, and not all of EMOI’s software was restored following EMOI’s receipt of the decryption key. Genuine issues of material fact thus exist as to whether EMOI’s software was damaged.

C. Direct Physical Damage

{¶ 43} We next turn to another significant area of dispute: whether the damage to EMOI’s software constituted “direct physical loss of or damage” to covered property. Owners cites to numerous cases addressing the phrase “direct physical loss of or damage” in insurance policies to support three general propositions: (1) the policy covers only items with a physical existence, i.e., tangible items; (2) “physical loss or damage” does not occur when the insured merely loses access or use; and (3) “physical loss or damage” does not occur when the item can be restored by cleaning. Owners claims that

18

EMOI’s alleged damage is not covered by its policy because the software and data have no physical existence and thus are not susceptible to physical loss or damage; EMOI merely lost access to its data and software due to the ransomware attack, and the data and software were readily restored with the decryption program. We find Owners’ cases distinguishable.

{¶ 44} First, Owners cites several cases in which the policy at issue required direct physical loss or damage to “tangible” property. EMOI’s businessowners policy does not include the term “tangible,” and we find that distinction significant. Owners also cites to several cases, some of which stemmed from the COVID-19 pandemic, in which a business was unable to operate due to governmental mandates, curfews, or prohibitions. Other cited cases involved events such power outages that prevented operation of the business. Those circumstances are not analogous to an incursion into EMOI’s computer system.

{¶ 45} We highlight two cases cited by Owners. In Mastellone v. Lightning Rod Mut. Ins. Co., 175 Ohio App.3d 23, 2008-Ohio-311 (8th Dist.), homeowners brought suit against their insured for refusing to provide coverage for mold found on the exterior and interior of their house and for water damage to their basement. With respect to the exterior mold on the home’s cedar siding, the court agreed with the insurer that the homeowners provided no evidence to show that the mold on the siding of the house constituted “physical damage.” The trial court construed “physical injury” to mean “a harm to the property that adversely affects the structural integrity of the house.” Id. at ¶ 61, citing 10A Couch on Insurance (3d Ed.1998), Section 148:46 (the requirement that a loss be “physical” is “widely held” to preclude claims based on “a detrimental economic

19

impact unaccompanied by a distinct, demonstrable, physical alteration of the property”).

{¶ 46} Although there was evidence of mold staining on the exterior siding of the house, the court concluded that the staining did not rise to level of “physical injury,” because it was only temporary and did not affect the structure of the wood. The court noted that the homeowners’ expert had testified that the mold could be cleaned, although the staining would reoccur. There was no evidence that the wood needed to be replaced. The insurer’s experts stated that the primary concern about the mildew was aesthetic. The Eighth District thus concluded that the trial court erred in failing to direct a verdict in the insurer’s favor. See Mama Jo’s, Inc. v. Sparta Ins. Co., 11th Cir. No. 18- 12887 (Aug. 18, 2020) (need for cleaning does not satisfy “direct physical” loss).

{¶ 47} Glaser-Garbrick’s description of the “damage” caused by the encryption went beyond aesthetic. Glaser-Garbrick stated in his deposition that all of the files had “weird extensions” that prevented access to the files. When he tried to open the encrypted files, a ransom note appeared. As a result of the encryption, EMOI and its clients were unable to access EMOI’s system for a significant period of time.

{¶ 48} Owners contends that the EMOI’s system was not physically damaged because once the decryption program was run, EMOI’s files opened and operated the way they were intended to, as Glaser-Garbrick testified. In essence, Owners argues that EMOI’s system merely needed to be cleaned, like the mold in Mastellone.

{¶ 49} The record contains minimal information about how encryption occurs and its effects on computer data. When asked during his deposition to describe how encryption worked, Glaser-Garbrick responded, “I’m trying to think about the best way to explain this. It’s a mathematical function that’s been designed so it’s hard to find a

20

solution for it, but if you know the answer to the problem, you would be able to basically undo the encryption.” (Glaser-Garbrick at 23.) Glaser-Garbrick agreed that “once you get the code, you can unlock it to read it or use the information that’s being sent.” (Id. at 24.) Glaser-Garbrick indicated that encryption and decryption is often “handled without people realizing it.” (Id.) Glaser-Garbrick did not describe, in technical terms, how encryption and decryption occurs and the effects on the item being encrypted. No other evidence regarding encryption was offered by the parties. Accordingly, construing the evidence in EMOI’s favor, the evidence supports a conclusion that the encryption damaged EMOI’s software and data, and that the damage was not merely aesthetic or amounted to loss of access or use.

{¶ 50} Owners also relies on Ward Gen. Ins. Servs., Inc. v. Employers Fire Ins.

Co., 7 Cal.Rptr.3d 844, 114 Cal.App.4th 548 (2003), a computer-related case, to support its contention that there can be no “direct physical” loss or damage to software, an intangible object. In that case, the plaintiff was in the process of updating its Oracle computer database when human error caused the system to “crash,” resulting in the loss of its electronically-stored data used to service its clients’ insurance policies. Id. at 846. The insured incurred expenses to restore its data and suffered loss of business income from the disruption. The plaintiff sought coverage under its businessowners policy, which was denied due to the lack of “direct physical loss of or damage to property,” and the trial court agreed.

{¶ 51} In affirming the trial court’s judgment, the California appellate court noted that the loss was not covered unless it resulted from a risk of direct physical loss. The court applied the “ordinary and popular” meaning of “direct physical loss” and held that

21

“the loss of plaintiff's database does not qualify as a ‘direct physical loss,’ unless the database has a material existence, formed out of tangible matter, and is perceptible to the sense of touch.” Id. at 850. It continued:

We fail to see how information, qua information, can be said to have a material existence, be formed out of tangible matter, or be perceptible to the sense of touch. To be sure, information is stored in a physical medium, such as a magnetic disc or tape, or even as papers in three-ring binders or a file cabinet, but the information itself remains intangible. Here, the loss suffered by plaintiff was a loss of information, i.e., the sequence of ones and zeroes stored by aligning small domains of magnetic material on the computer's hard drive in a machine readable manner. Plaintiff did not lose the tangible material of the storage medium. Rather, plaintiff lost the stored information. The sequence of ones and zeros can be altered, rearranged, or erased, without losing or damaging the tangible material of the storage medium.

We conclude the loss of the database, with its consequent economic loss, but with no loss of or damage to tangible property, was not a “direct physical loss of or damage to” covered property under the terms of the subject insurance policy, and, therefore, the loss is not covered.

(Footnote omitted.) Id. at 851.

{¶ 52} EMOI argues that Ward and other cases are inapplicable, because the policy language here provides coverage for an intangible item: software. EMOI states in its appellate brief: “Computer software is not the same type of tangible thing as a floppy

22

disk, tape or thumb drive. It is something that is not physical, seen or touched. However, it is tangible enough for [Owners] to insure and expressly define under the definition of ‘media’ and thus, must be tangible enough to be damaged or suffer direct physical damage if such is required under the policy by a computer hacker as was done in this case.” (Appellant’s Brief at 17.)

{¶ 53} EMOI’s position is supported by Natl. Ink and Stitch, LLC v. State Auto Property and Cas. Ins. Co., 435 F.Supp.3d 679 (D.Md.2020). In National Ink and Stitch, the computer server and networked computers of an embroidery and screen printing business experienced a ransomware attack, which prevented the business from accessing all of the art files and other data contained on the server and, with one exception, all of its software. The attacker demanded a bitcoin to release access to the software and data. The business paid the bitcoin, but it did not receive all of the necessary files to release its software and data (it received the executable file, but not the configuration file.). The hacker demanded another bitcoin for the additional file. Instead, the business hired a security company to replace and reinstall its software and to install protective software. The resultant system was slower than it previously had been, art files could not be accessed, and experts indicated that there were likely dormant remnants of the ransomware software that could re-infect the entire system. To eliminate the risk of further infection, the business could “wipe” the entire system and reinstall of the software and information or purchase a new server and components.

{¶ 54} The business filed a claim with State Auto regarding the ransomware attack, seeking coverage for the replacement of its system. The policy stated that State Auto “will pay for direct physical loss of or damage to Covered Property * * *.” The

23

Businessowners Special Form Computer Coverage endorsement defined Covered Property to include “Electronic Media and Records (Including Software),” and defined “Electronic Media and Records” to include “(a) Electronic data processing, recording or storage media such as films, tapes, discs, drums or cells; [and] (b) Data stored on such media.” State Auto denied the claim.

{¶ 55} In cross-motions for summary judgment, the parties disputed whether the business experienced “direct physical loss or damage to” its computer system. Interpreting the policy, the district court concluded that the policy contemplated that data and software could experience “direct physical loss or damage.” It reasoned:

Here, the Policy expressly lists “data” as an example of Covered Property under its definition of “Electronic Media and Records (Including Software).”

ECF 35-2 at 61. While the term “data” is qualified with the phrase “stored on such media,” if the Policy intended to require physical loss or damage to the media itself, as opposed to just the data, it could have stopped at subsection (a), which describes the covered media. Id. Instead, the Policy includes “data stored on such media” as a separate subcategory of Covered Property in subsection (b). Id. The Policy also contains the phrase “Including Software” in its heading describing covered property. Id.

Thus, the plain language of the Policy contemplates that data and software are covered and can experience “direct physical loss or damage.”

Natl. Ink & Stitch, LLC, 435 F.Supp.3d at 682. See also Lambrecht & Assocs., Inc., 119 S.W.3d at 24-26 (Tex.App.2003) (policy’s language allowed for coverage to “electronic media and records” and the “data stored on such media” as “such property is capable of

24

sustaining a ‘physical’ loss”).

{¶ 56} Again, construing the evidence in the light most favorable to EMOI, we conclude that the policy contemplated that EMOI’s software and reproduction of data was capable of being physically damaged, and Glaser-Garbrick has testified that it was.

D. Exclusions

{¶ 57} Finally, Owners argues that applicable limitations and exclusions exist that preclude coverage under the Electronic Equipment endorsement. The exclusion provision in the endorsement precludes coverage for:

a. Wear and tear * * * b. Loss or damage caused by:

(1) Corrosion or rusting;

(2) Dryness or dampness of atmosphere; or (3) Extremes of temperature unless directly resulting from accidental direct physical damage to the electronic equipment system’s air conditioning equipment caused by a peril not excluded by this endorsement.

c. Any dishonest, fraudulent or criminal act by:

(1) You;

(2) Your partners; or

(3) Any of your officers, directors or trustees Whether acting alone or in collusion with others.

d. “Electrical disturbance” unless caused by lightning.

e. Loss or damage caused by:

25

(1) Data processing “media” failure; or (2) Breakdown or malfunction of the data processing equipment and component parts while the “media” is being run through the system.

***

f. Actual work upon, installation or testing of Covered Property. * * * g. Faulty construction or error in the design of the Covered Property. * * * h. Delay or loss of market;

i. Loss or damage caused by or resulting from improper operation of Covered Property.

j. Breakage, marring, scratching, tearing or denting of any “laptop computer”

unless caused by * * *.

{¶ 58} Owners states, in summary fashion, that coverage for EMOI’s claim is excluded under (e), (h), and (i). Construing the evidence in EMOI’s favor, we disagree that the circumstances here involve media failure, a malfunction or breakdown of equipment while the “media” was being run through the system, a loss of market, or improper operation of the media by EMOI.

{¶ 59} Owners further points to the “Business Income and Extra Expenses”

provision within the “Additional Coverages” portion of the Electronic Equipment endorsement. This provision generally states that Owners would pay for loss of business income during the period of restoration. This provision has its own exclusions, which include losses or damage caused by “Theft of any property, which is not an integral part of a building or structure at the time of loss.” We fail to see how this provision would preclude coverage under the endorsement as a whole, nor does the record suggest that

26

all of EMOI’s loss or damage would fall under this provision.

{¶ 60} For the foregoing reasons, we conclude that genuine issues of material fact exist as to whether EMOI’s claim was covered by Electronic Endorsement – Media policy. Consequently, the trial court erred in granting summary judgment to Owners on EMOI’s breach of contract claim.

{¶ 61} EMOI’s first assignment of error is sustained.

IV. Bad Faith Claim

{¶ 62} In its second assignment of error, EMOI claims that the trial court erred in granting summary judgment to Owners on its bad faith claim. The trial court did not separately address EMOI’s bad faith claim, but instead granted judgment to Owners based on its disposition of EMOI’s breach of contract claim.

{¶ 63} “In Ohio, an insurer has a duty to act in good faith toward its insured in carrying out its responsibilities under the policy of insurance. Those responsibilities include the handling and payment of an insured’s claim. Thus, ‘[a]n insurer fails to exercise good faith in the processing of a claim of its insured where its refusal to pay the claim is not predicated upon circumstances that furnish reasonable justification therefor.’ ” (Citations omitted.) Unklesbay v. Fenwick, 167 Ohio App.3d 408, 2006-Ohio-2630, 855 N.E.2d 516, ¶ 14 (2d Dist.), quoting Zoppo v. Homestead Ins. Co., 71 Ohio St.3d 552, 644 N.E.2d 397 (1994), paragraph one of the syllabus.

{¶ 64} During his deposition, Weaner described the process he employed when reviewing EMOI’s claim. Weaner received EMOI’s claim on the morning of September 13. The loss notice stated that all files were encrypted and were being held under ransom and that the business could not operate under current conditions. Weaner

27

indicated that he had spoken with Glaser, reviewed the policy provisions, and had spoken with a home officer examiner about the facts he had learned from Glaser. Weaner and the home officer examiner reviewed EMOI’s policy, identified policies that potentially applied to the claim, and reviewed them “looking for coverage.” The claim was denied the same day.

{¶ 65} When asked about his experience with computer matters, Weaner indicated that he received regular IT training from Auto-Owners, predominantly on phishing. Weaner did not know how software could be damaged and did not know of anyone at Auto-Owners who could explain damage to software. Weaner did not consult with an IT or computer expert while evaluating EMOI’s claim. Weaner stated that he previously had handled claims involving damage to computer systems, but those claims typically had involved water, fire, or electrical surges.

{¶ 66} Weaner acknowledged that he had a duty to an insured to act in good faith, which included the duties to fully and fairly investigate the claim and to objectively evaluate the claim.

{¶ 67} In response to Owners’ motion for summary judgment, EMOI presented the affidavit of an expert witness, Chris Johnson, who indicated that he had 35 years of experience in the insurance industry. Johnson opined that Owners’ evaluation of EMOI’s complaint was deficient and “fell well below the standards, practices and customs in the insurance industry for conducting a fair, thorough and competent investigation of an insurance claim.” He stated that Owners failed to consider the various types of damage that can occur to media such as software, emphasizing that Owners did not consult with an IT or computer science specialist when evaluating EMOI’s claim. Johnson noted that

28

Weaner had previously handled claims involving damage to computers, but not to software.

{¶ 68} Upon review of the evidence, we find that genuine issues of material fact exist as to whether Owners complied with its duty of good faith in denying EMOI’s claim. Accordingly, the trial court erred in granting summary judgment on EMOI’s bad faith claim.

{¶ 69} EMOI’s second assignment of error is sustained.

V. Conclusion

{¶ 70} The trial court’s judgment will be reversed, and the matter will be remanded for further proceedings.

.............

DONOVAN, J., concurs. TUCKER, P.J., dissents:

{¶ 71} The Electronic Equipment endorsement provides coverage for “direct physical loss or damage” to media, with media being defined as a device upon “which information is recorded * * *.” The endorsement then states that “media includes computer software * * * contained on covered media.” Thus, as correctly noted by the majority opinion, “giving this language its plain and ordinary meaning, computer software [to be covered by the endorsement] must be contained on another medium * * *.” The medium, presumably a server, upon which the software at issue was stored did not sustain physical loss or damage. Therefore, coverage under the endorsement was not triggered. Upon this basis, I respectfully dissent.

{¶ 72} In opposition to this conclusion, EMOI argues that as a result of the hacker’s

29

encryption, its software was damaged, and this damage invoked coverage because “software is included in the [endorsement’s] definition of media * * *.” EMOI does not, and cannot, assert that the encryption caused loss or damage to the server upon which the software was stored. But, as explained, such loss or damage to the device upon which the software is stored was a prerequisite to coverage for loss or damage to software.

{¶ 73} I submit that the conclusion I have reached is compelled by the clear, unambiguous endorsement language, which eliminates any factual issues regarding whether EMOI’s loss is a covered loss. Perhaps the endorsement language could have been more precise, but as the Ohio Supreme Court recently reaffirmed, a court cannot “creat[e] [a contractual] ambiguity by asking whether the parties could have included different or more express language in their agreement.” AKC, Inc. v. United Specialty Ins. Co., Ohio Slip Opinion No. 2021-Ohio-3540, __ N.E.3d __, ¶ 12, citing 11 Lord, Williston on Contracts, Section 30:4 (4th Ed.2021).

{¶ 74} The conclusion I have reached highlights the following “hard reality about insurance”:

It is not a general safety net for all dangers. If risk is not having money when you need it, insurance is one answer to perilous events that could prompt a sudden drop in revenue. Fair pricing of insurance turns on correctly accounting for the likelihood of the occurrence of each defined peril and the cost of covering it. Efforts to push coverage beyond its terms creates a mismatch, an insurance product that covers something no one paid for and, worse, runs the risk of leaving insufficient funds to pay for perils

30

that insureds did pay for. That is why courts must honor the coverage the parties did – and did not – provide for in their written contracts of insurance.

Santo’s Italian Café, LLC v. Acuity Ins. Co., ___ F.4th ___, 2021 WL 4304607, *7 (6th Cir.).1

{¶ 75} Based upon my coverage conclusion, I also dissent regarding the majority decision that there are factual issues surrounding EMOI’s bad faith cause of action. Since, in my opinion, Owners made the correct coverage call, its refusal to pay EMOI’s claim was “predicated upon circumstances that furnish[ed] reasonable justification” for the refusal. Unklesbay, 167 Ohio App.3d 408, 2006-Ohio-2630, 855 N.E.2d 516, at ¶ 14, quoting Zoppo, 71 Ohio St.3d 552, 644 N.E.2d 397, at paragraph one of the syllabus. Given this, Owners, as a matter of law, did not act in bad faith.

Copies sent to:

John A. Smalley Erin B. Moore Hon. Gregory F. Singer

1 Acuity decided whether Santo’s, a restaurant, was entitled to business interruption coverage based upon Santo’s being forced to suspend its indoor dining operation as a result of Ohio’s Covid-19 mandates. Santo’s business interruption coverage was, as in the present case, triggered by loss or damage to covered property. The Sixth Circuit, applying Ohio law, decided that since no covered property was altered by the forced shutdown, Santo’s did not sustain loss or damage to covered property, and, thus, the loss was not covered. Though the interpretation of the loss or damage language has been discussed in this case, resolution of the appropriate interpretation of this language is not relevant to my analysis because, as discussed, EMOI does not assert loss or damage to the server upon which the affected software was stored.