EMOI Servs., L.L.C. v. Owners Ins. Co.

2021 Ohio 3942, 180 N.E.3d 683

• Court: Ohio Court of Appeals
• Decided: November 5, 2021
• Docket: 29128
• Status: Published

Opinion

[Cite as EMOI Servs., L.L.C. v. Owners Ins. Co., 2021-Ohio-3942.]

IN THE COURT OF APPEALS OF OHIO SECOND APPELLATE DISTRICT MONTGOMERY COUNTY

EMOI SERVICES, LLC : : Plaintiff-Appellant : Appellate Case No. 29128 : v. : Trial Court Case No. 2019-CV-5979 : OWNERS INSURANCE COMPANY : (Civil Appeal from : Common Pleas Court) Defendant-Appellee : :

...........

OPINION

Rendered on the 5th day of November, 2021.

JOHN A. SMALLEY, Atty. Reg. No. 0029540, 131 North Ludlow Street, Suite 1400, Dayton, Ohio 45402 Attorney for Plaintiff(s)-Appellant

ERIN B. MOORE, Atty. Reg. No. 0061638, 800 Performance Place, 109 North Main Street, Dayton, Ohio 45402 Attorney for Defendant(s)-Appellee

............. -2-

EPLEY, J.

{¶ 1} EMOI (Electronic Medical Office Integration) Services, LLC, appeals from a

judgment of the Montgomery County Court of Common Pleas, which granted summary

judgment to Owners Insurance Company on EMOI’s breach of contract and bad faith

claims. For the following reasons, the trial court’s judgment will be reversed, and the

case will be remanded for further proceedings.

I. Facts and Procedural History

{¶ 2} The underlying facts are largely undisputed. EMOI provides “medical billing

services and application services and support” to medical providers. The company

obtains necessary information from patients and medical providers for medical services

rendered and formulates it into a fillable billing claims form to the third-party payer

network. EMOI also sends invoices to patients for balances due.

{¶ 3} EMOI employees have two computer logins. They first must provide login

information to access their work computers. Employees then use a second login to

access Medics, the system that allows customers to input billing data, scheduling, and

other applications offered to them. In addition to Medics, EMOI has its own proprietary

software that is the preferred method for customers to enter patient charges, procedure

codes, and diagnosis codes.

{¶ 4} On September 12, 2019, after logging into her workstation, an EMOI

employee, Ruth Ross, discovered that she was unable to access the Medics system.

She contacted Vernon Glaser, the general manager of EMOI, who contacted Dan Glaser-

Garbrick, EMOI’s software developer and information technology (IT) manager.

{¶ 5} Glaser-Garbrick “could not log in the way [he] normally [did]” but was able to -3-

access the system using VPN access. When he did, he saw that all of the files on the

affected servers had “weird extensions.” Glaser-Garbrick recognized that EMOI’s

system had been hacked and the files encrypted. A ransom note was “in every single

folder on all the computers that were affected.” Glaser-Garbrick informed Glaser of what

had occurred. At this point, Glaser was receiving phone calls from several clients, all of

whom reported that they could not access the system.

{¶ 6} According to Glaser-Garbrick, the ransom note stated that the files were

encrypted and currently unavailable, but the company could get them back. The hacker

indicated that the company should respond by email with the provided personal code and

that the company could decrypt one file for free. Per the hacker’s instructions, Glaser-

Garbrick sent the hacker an encrypted file and the personal code indicated on the ransom

note, and the hacker responded with the contents of the file. Glaser-Garbrick indicated

that the returned file could be opened and operated normally. The hacker further

indicated that the remaining files could be decrypted for three bitcoins, which at that time

cost a total of approximately $35,000.

{¶ 7} EMOI started investigating data recovery companies that could decrypt its

files without paying the hacker. It selected a company from Australia, but the estimated

cost was approximately $55,000, and the data recovery company was not certain that all

of the data could be recovered. Ultimately, EMOI decided to pay the hacker. Within

about an hour of sending the bitcoin, EMOI received an email with a link to download a

program that would decrypt the files. Glaser-Garbrick stated that, once the decryption

program operated and decrypted the files, “the files would open and functioned the way

they were intended.” A few files did not get decrypted, “but they weren’t super critical.” -4-

{¶ 8} Soon after the decryption was completed, the encryption program re-ran on

the Medics server. Glaser-Garbrick was able to decrypt the files again with the same

decryption key previously provided by the hacker.

{¶ 9} In response to the ransomware attack, EMOI upgraded the Medics software,

transitioned from remote access to using VPN software, and moved its computer access

to a new domain. EMOI also changed how it backed up its system. The system still

had a few residual problems: the interface between EMOI’s website and Medics could not

communicate and the program that auto-generated remittances did not function due to

being moved to the new server, and the automated phone call system had not been

decrypted because the key did not work.

{¶ 10} When the ransomware attack occurred, EMOI was covered by a

businessowner’s insurance policy issued by Owners. At approximately 8:03 a.m. on

September 13, 2019 (the day after the attack), Glaser called his insurance agent to report

the incident and file a claim. EMOI’s claim was assigned to Bradley Weaner, a field claim

representative for Auto-Owners Insurance, the parent company of Owners. Weaner

reviewed the written loss notification in the computer system, reviewed EMOI’s policy,

and then spoke with Glaser. Glaser reported that the situation was discovered when an

employee could not log into her computer system. Glaser told Weaner that the data was

not physically damaged, but was inaccessible due to being encrypted and held for

ransom. While reviewing the claim, Weaner spoke with his branch manager and home

office commercial lines manager.

{¶ 11} Weaner concluded that there was no coverage under any of the potentially

applicable provisions of the insurance policy, including the Data Compromise -5-

endorsement and the Electronic Equipment endorsement. The Data Compromise

endorsement addresses the compromise of an individual’s “personal data.” The

exclusion portion of the Data Compromise endorsement precludes coverage for “[a]ny

threat, extortion or blackmail. This includes, but is not limited to, ransom payments and

private security assistance[.]” The Electronic Equipment endorsement includes a

provision addressing “direct physical loss or damage to ‘media.’ ”

{¶ 12} Weaner again spoke with Glaser and informed him that the claim would be

denied. He also sent a coverage position letter outlining the bases for the lack of

coverage. The letter identified the two potentially applicable endorsements and

explained that neither provision provided coverage, reasoning:

As cited in the policy language above, paying ransom is excluded. Since

the data belongs to another party that is not your customer it does not meet

the definition of “affected individual”. Furthermore, there is no direct

physical loss to the “media”. * * *

The letter indicated that EMOI should contact Owners with any additional information.

EMOI did not provide additional information to Owners following the denial.

{¶ 13} In December 2019, EMOI filed suit in the common pleas court, alleging that

Owners breached its contract by denying coverage under the Electronic Equipment

provision and that Owners denied coverage in bad faith. Owners denied the claims and

counterclaimed for a declaratory judgment that “no coverage, payment or indemnity is

owed” to EMOI under the policy.

{¶ 14} On January 21, 2021, Owners moved for summary judgment on EMOI’s

claims and its counterclaim for declaratory judgment. In its motion, Owners highlighted -6-

the Businessowners Special Property Coverage form, the Data Compromise

endorsement, and the Electronic Equipment endorsement in the policy and argued,

primarily, that no direct physical loss or damage had occurred, as required by the Special

Property Coverage Form and Electronic Equipment endorsement. Owners further

argued that the Data Compromise endorsement did not extend to the type of loss incurred

by EMOI, as it did not involve “affected persons” or “personally identifying information.”

Finally, Owners asserted that, in the absence of a breach of contract, there can be no

basis for a bad faith claim. Owners supported its motion with depositions from Glaser,

Glaser-Garbrick, and Weaner, as well as an affidavit from Weaner and accompanying

documents.

{¶ 15} In response, EMOI focused on the Electronic Equipment endorsement.

The company indicated that it was “not seeking merely to recover for lost data,” which it

acknowledged was not covered by the policy. Rather, it argued that it was seeking

coverage for “the damage to the media, not the information or data contained on the

media.” EMOI explained that the software, a computer program, “was damaged by a

computer hacker who manipulated the computer software program, encrypting the

program to prevent EMOI’s use of the software and access to the data. Both the Medics

software and EMOI’s own software was not accessible or usable. Thus, the computer

software was damaged.” EMOI further asserted that, even after it obtained the

decryption key, the software was still damaged, as it became encrypted again. EMOI

stated it that also suffered several other problems with software it was running.

{¶ 16} EMOI supported its motion with an affidavit from an expert witness, Chris

Johnson, who had over 35 years of experience and training in the insurance industry. -7-

Johnson discussed deficiencies in Weaner’s investigation and opined both that Owners

failed in its duties to EMOI and that EMOI’s claim should have been granted. Owners

sought to strike Johnson’s affidavit. We find no indication that the trial court addressed

the motion to strike, but it did not reference Johnson’s affidavit in its decision on the motion

for summary judgment.

{¶ 17} In granting summary judgment to Owners, the trial court found EMOI’s

arguments unconvincing. It reasoned:

Garbrick testified that he considered EMOI’s “whole database” to be

damaged because the encryption prevented EMOI from accessing or using

it. (Garbrick Dep. 47.) However, Garbrick admitted that once he decrypted

it, he could use the database and that it does what it did before it was

encrypted. Id. Assuming arguendo that the software was “damaged”

while it was encrypted, given the fact that EMOI has all the data it did before

the ransomware attack, and that its software is now fully-functional, the

Court finds that the “media” is no longer damaged.

In reality, this is a data compromise situation, rather than a situation

involving physical damage to electronic equipment. The hacker gained

unauthorized access to EMOI’s computer systems as a result of a

vulnerability within the system, and EMOI ultimately had to pay a ransom in

order to regain control of [its] software and data. Unfortunately for EMOI,

the Data Compromise endorsement in its insurance policy expressly

excludes coverage for costs arising from any threat, extortion or blackmail,

including ransom payments. The Data Compromise endorsement also -8-

excludes costs arising from correcting any deficiency in its “systems,

procedures or physical security that may have contributed to a ‘personal

data compromise.’ ” In other words, the cost endured by EMOI to upgrade

its systems to cure the deficiency that left it vulnerable to attack is expressly

excluded under the Data Compromise endorsement.

The Court suspects that EMOI is attempting to interpret the language

in the Electronic Equipment endorsement in a way that provides coverage

because the Data Compromise endorsement, which is the applicable

endorsement, clearly excludes coverage in this situation. However, the

Court cannot logically conclude that EMOI sustained direct physical loss of

or damage to its “media” when EMOI’s computer systems are now fully-

functional with all the data it had before the ransomware attack.

The trial court thus granted summary judgment to Owners on all of EMOI’s claims and

entered judgment in favor of Owners.

{¶ 18} EMOI appeals from the trial court’s judgment, claiming that the trial court

erred in granting Owners’ motion for summary judgment.

II. Summary Judgment Standard

{¶ 19} Pursuant to Civ.R. 56(C), summary judgment is proper when (1) there is no

genuine issue as to any material fact, (2) the moving party is entitled to judgment as a

matter of law, and (3) reasonable minds, after construing the evidence most strongly in

favor of the nonmoving party, can only conclude adversely to that party. Zivich v. Mentor

Soccer Club, Inc., 82 Ohio St.3d 367, 369-370, 696 N.E.2d 201 (1998). The moving

party carries the initial burden of affirmatively demonstrating that no genuine issue of -9-

material fact remains to be litigated. Mitseff v. Wheeler, 38 Ohio St.3d 112, 115, 526

N.E.2d 798 (1988). To this end, the movant must be able to point to evidentiary materials

of the type listed in Civ.R. 56(C) that a court is to consider in rendering summary

judgment. Dresher v. Burt, 75 Ohio St.3d 280, 292-293, 662 N.E.2d 264 (1996). The

substantive law of the claim or claims being litigated determines whether a fact is

“material.” Perrin v. Cincinnati Ins. Co., 2020-Ohio-1405, 153 N.E.3d 832, ¶ 29 (2d

Dist.).

{¶ 20} Once the moving party satisfies its burden, the nonmoving party may not

rest upon the mere allegations or denials of the party’s pleadings. Dresher at 293; Civ.R.

56(E). Rather, the burden then shifts to the nonmoving party to respond, with affidavits

or as otherwise permitted by Civ.R. 56, setting forth specific facts that show that there is

a genuine issue of material fact for trial. Dresher at 293. Throughout, the evidence

must be construed in favor of the nonmoving party. Id.

{¶ 21} We review the trial court’s ruling on a motion for summary judgment de

novo. Schroeder v. Henness, 2d Dist. Miami No. 2012-CA-18, 2013-Ohio-2767, ¶ 42.

De novo review means that this court uses the same standard that the trial court should

have used, and we examine all the Civ.R. 56 evidence, without deference to the trial court,

to determine whether, as a matter of law, no genuine issues exist for trial. Ward v. Bond,

2d Dist. Champaign No. 2015-CA-2, 2015-Ohio-4297, ¶ 8.

III. Breach of Contract Claim

{¶ 22} EMOI first claims that summary judgment was improper on its breach of

contract claim because genuine issues of material fact exist as to whether EMOI suffered

damage to its media and whether the damage was covered under the terms of the -10-

Electronic Equipment endorsement.

{¶ 23} The interpretation of a contract is a question of law. St. Marys v. Auglaize

Cty. Bd. of Commrs., 115 Ohio St.3d 387, 2007-Ohio-5026, 875 N.E.2d 561, ¶ 38;

Nationwide Mut. Fire Ins. Co. v. Guman Bros. Farm, 73 Ohio St.3d 107, 108, 652 N.E.2d

684 (1995). When reviewing a contract, the court’s primary role is to ascertain and give

effect to the intent of the parties. Hamilton Ins. Serv., Inc. v. Nationwide Ins. Cos., 86

Ohio St.3d 270, 273, 714 N.E.2d 898 (1999). “We presume that the intent of the parties

to a contract is within the language used in the written instrument.” DiPasquale v.

Costas, 186 Ohio App.3d 121, 2010-Ohio-832, 926 N.E.2d 682, ¶ 36 (2d Dist.), quoting

Saunders v. Mortensen, 101 Ohio St.3d 86, 2004-Ohio-24, 801 N.E.2d 452.

{¶ 24} A contract that is, by its terms, clear and unambiguous requires no real

interpretation or construction and will be given the effect called for by the plain language

of the contract. Aultman Hosp. Assn. v. Community Mut. Ins. Co., 46 Ohio St.3d 51, 55,

544 N.E.2d 920 (1989). Where terms in an insurance contract are not defined, courts

will give them their plain and ordinary meaning. E.g., Westfield Ins. Co. v. Galatis, 100

Ohio St.3d 216, 2003-Ohio-5849, 797 N.E.2d 1256, ¶ 11; Colter v. Spanky’s Doll House,

2d Dist. Montgomery No. 21111, 2006-Ohio-408, ¶ 29. “[A]mbiguous language in an

insurance contract is construed against the insurance company.” Dominish v.

Nationwide Ins. Co., 129 Ohio St.3d 466, 2011-Ohio-4102, 953 N.E.2d 820, ¶ 7.

{¶ 25} The parties’ arguments on appeal mirror those raised in the trial court.

EMOI disputes the trial court’s conclusion that EMOI’s software was not damaged. The

company argues that Glaser-Garbrick’s deposition testimony created a genuine issue of

material fact as to whether EMOI’s software was damaged, and it asserts that the damage -11-

was covered under the Electronic Equipment endorsement in its policy with Owners.

EMOI adds that in reaching the conclusion that its software was not damaged, the court

failed to construe the evidence in the light most favorable to EMOI.

{¶ 26} Owners responds that the policy requires direct physical loss or damage,

and because EMOI’s software was intangible, it was not covered by the Electronic

Equipment endorsement. Owners cites to numerous cases addressing the application

of “direct physical loss or damage” under a variety of circumstances. Owners further

claims that EMOI misconstrues the definition of “media,” emphasizing that the

endorsement contemplates tangible items that are subject to physical damage.

{¶ 27} The Electronic Equipment endorsement reads, in relevant part:

1. COVERAGE

Covered Property

***

(2) Unscheduled Equipment

(b) When a limit of insurance is shown in the Declarations under

ELECTRONIC EQUIPMENT, MEDIA, we will pay for direct physical loss of

or damage to “media” which you own, which is leased or rented to you or

which is in your care, custody or control while located at the premises

described in the Declarations. We will pay for your costs to research,

replace or restore information on “media” which has incurred direct physical

loss or damage by a Covered Cause of Loss.

Direct physical loss of or damage to Covered Property must be caused by -12-

a Covered Cause of Loss.

The endorsement defines “media” as “materials on which information is recorded such as

film, magnetic tape, paper tape, disks, drums, and cards. The definition section further

states that “media” includes “computer software and reproduction of data contained on

covered media.”

{¶ 28} As an initial matter, there is no apparent dispute that EMOI was insured

against damage to media. The policy’s coverage page indicates that EMOI paid a

premium of $161.91 for media coverage and had a coverage limit of $100,000. We

therefore begin with whether EMOI’s claim concerns “media.”

A. Media

{¶ 29} The policy initially provides a broad definition of the term “media”: “materials

on which information is recorded.” The sentence then provides examples of tangible

“materials” that meet that definition: “film, magnetic tape, paper tape, disks, drums, and

cards.” By the policy’s express language, the list is illustrative, not exhaustive.

Accordingly, by its terms, other devices may satisfy the definition of “media.”

{¶ 30} Similar to statutory construction, we must read the policy’s broad definition

of media (“materials on which information is recorded”) in light of the representative

examples provided. Accord Stiner v. Amazon.com, Inc., 162 Ohio St.3d 128, 2020-Ohio-

4632, 164 N.E.3d 394, ¶ 32 (“the canon of ejusdem generis requires us to limit a broad

phrase that follows specific examples to items similar to those specific examples”). In

this case, the specific examples (“film, magnetic tape, paper tape, disks, drums, and

cards”) appear to encompass a wide array of data storage devices, including paper data

storage, magnetic data storage, optical storage, and solid-state/flash memory storage. -13-

While the specific examples also may have common characteristics that would limit

“media” to specific types of devices, those limiting characteristics are not apparent on this

record.

{¶ 31} The parties have not directed us to cases addressing whether a server

meets the definition of “media.” However, at least one court has held that a company’s

server fell within the definition of “electronic media and records.” See Lambrecht &

Assocs., Inc. v. State Farm Lloyds, 119 S.W.3d 16, 25, 2003 WL 21078083 (Tex.App.)

(“Based on Ashley's affidavit, the server falls within the definition of ‘electronic media and

records’ because it contains a hard drive or ‘disc’ which could no longer be used for

‘electronic data processing, recording, or storage.’ ”). At oral argument, counsel for

Owners indicated that a server could be “media,” although counsel asserted that it would

need to be physically damaged.

{¶ 32} We repeat that the definitional provision of the Electronic Equipment

endorsement further provides that “computer software and reproduction of data contained

on covered media” also fall within the definition of “media.” Giving this provision its plain

and ordinary meaning, computer software must be contained on another medium for the

provision to apply.

{¶ 33} In his deposition, Glaser-Garbrick described how EMOI’s system was

designed. He stated that EMOI had a physical server that operated as a host server for

the Medics database; clients communicated with the database via an application installed

on their computers. The host server was configured as a virtualization server, which

allowed EMOI to run additional virtual servers “on top of it.” (“Server virtualization is the

process of dividing a physical server into multiple unique and isolated virtual servers by -14-

means of a software application. Each virtual server can run its own operating systems

independently.” vmware, Server Virtualization Definition, https://www.vmware.com/

topics/glossary/content/server-virtualization (accessed Oct. 26, 2021).

{¶ 34} At the time of the ransomware attack, EMOI also had a backup virtual host

server, which connected to the other server through a protocol called iSCSI (internet small

computer systems interface). Glaser-Garbrick stated that the backup virtual host server

functioned as an extra hard drive to save backups. Glaser-Garbrick explained that, prior

to the ransomware attack, EMOI would run automatic backups every night and a full file

copy of the Medics database would be saved on the backup server that was connected

to the network.

{¶ 35} Glaser-Garbrick did not expressly address whether any components of

EMOI’s system constituted “media.” Owners did not provide evidence from an IT

specialist to address what constitutes media.

{¶ 36} Viewing the evidence in the light most favorable to EMOI, the company’s

servers constituted materials on which EMOI’s information was recorded and thus

arguably met the policy’s definition of “media.” Glaser’s and Glaser-Garbrick’s

deposition testimony established that the servers contained the Medics software and

EMOI’s proprietary software, as well as the Medics database. Glaser-Garbrick also

specifically identified a backup server that operated as an extra hard drive on which the

Medics information was saved nightly.

{¶ 37} In its appellate brief, Owners contends that there is no coverage for

computer software and reproduction of data in this case, because “[n]o film, magnetic

tape, disc, drum, card, etc., has been identified as physically damaged in this claim.” -15-

(Emphasis sic.) Owners’ argument appears to stem from the policy’s statement that

media includes computer software and reproduction of data that is contained on “covered

media.” Consistent with the use of the term “covered” throughout the policy, we read

“covered media” to mean media that is insured under the endorsement. See Black’s Law

Dictionary 365 (6th Ed.1990) (“Cover. To protect by means of insurance[.]”) We do not

find it reasonable to interpret the phrase to mean only media that has incurred a covered

loss, as Owners suggests. In this case, because the computer software and

reproduction of data was contained on EMOI’s servers, i.e., “covered media”, those items

also met the definition of media.

{¶ 38} Owners’ reading of the definitional section renders meaningless the

sentence defining media to include “software and reproduction of data on covered media.”

Without that sentence, the definition of media reasonably would be restricted to tangible

electronic storage media, and the policy already includes a provision stating “We will pay

for your costs to research, replace or restore information on ‘media’ which has incurred

direct physical loss or damage by a Covered Cause of Loss.” In other words, without the

definitional sentence regarding software and reproduction of data, the policy provides

coverage for physical loss or damage to tangible media and to replace information – which

would include software and reproduction of data – contained on that tangible media.

Owners’ interpretation of the media provision does not adequately account for the

additional statement defining “media” to include software and reproduction of data on

covered media.

B. Damage

{¶ 39} In granting summary judgment to Owners, the trial court concluded that -16-

EMOI’s software was not damaged. The court focused on the fact that, after employing

the decryption program, EMOI’s software again became operational. Construing the

evidence in the light most favorable to EMOI, as we are required to do, we conclude that

EMOI’s evidence supports a conclusion that its software was, in fact, damaged by the

malicious encryption.

{¶ 40} According to Glaser’s deposition testimony, EMOI’s system was functioning

normally at the end of business on September 11, 2019. Glaser-Garbrick testified that

when he accessed the system on September 12, he saw that “all the files had weird

extensions,” and there were approximately nine or ten different extensions. (Glaser-

Garbrick Depo. at 14.) Glaser-Garbrick clarified that each computer on the network was

encrypted, but with a different extension. (Id. at 14.) Because the backup server was

connected to EMOI’s network, it also was encrypted.

{¶ 41} When asked during his deposition whether anything was damaged by the

encryption, Glaser-Garbrick and Owners’ attorney had the following exchange:

Q. * * * Did you find anything that you would consider damaged as a result

of the encryption by the hacker?

A. Our whole database.

Q. And why do you consider it damaged?

A. We couldn’t use it at all.

Q. While it was encrypted?

A. Yes.

(Glaser-Garbrick Depo. at 47.) Although Glaser-Garbrick at times referred to the

database’s being encrypted, he testified that the hacker involuntarily encrypted all of the -17-

digital information, which is “basically what runs the whole software – * * * the system.”

(Id. at 25.) Glaser-Garbrick further testified that ransom notes had been added “in all the

folders and stuff, too. * * * It was just in every single folder on all the computers that were

affected.” (Id. at 16.) When Glaser-Garbrick attempted to open a file, the ransom note

would appear instead.

{¶ 42} Glaser-Garbrick further testified that portions of the software remained

damaged even after decryption. He stated that a program that generated remittances

continued not to function after the decryption. In addition, the automated phone call

system was contained on one of the virtual hard drives that did not get decrypted because

the key did not work. (Id. at 44-45.) Glaser-Garbrick further stated that, even after he

obtained the decryption key, the software was still damaged, as it became encrypted

again. Construing the evidence in EMOI’s favor, Glaser-Garbrick’s testimony indicated

that the hacker did not simply make EMOI’s software inaccessible, and not all of EMOI’s

software was restored following EMOI’s receipt of the decryption key. Genuine issues

of material fact thus exist as to whether EMOI’s software was damaged.

C. Direct Physical Damage

{¶ 43} We next turn to another significant area of dispute: whether the damage to

EMOI’s software constituted “direct physical loss of or damage” to covered property.

Owners cites to numerous cases addressing the phrase “direct physical loss of or

damage” in insurance policies to support three general propositions: (1) the policy covers

only items with a physical existence, i.e., tangible items; (2) “physical loss or damage”

does not occur when the insured merely loses access or use; and (3) “physical loss or

damage” does not occur when the item can be restored by cleaning. Owners claims that -18-

EMOI’s alleged damage is not covered by its policy because the software and data have

no physical existence and thus are not susceptible to physical loss or damage; EMOI

merely lost access to its data and software due to the ransomware attack, and the data

and software were readily restored with the decryption program. We find Owners’ cases

distinguishable.

{¶ 44} First, Owners cites several cases in which the policy at issue required direct

physical loss or damage to “tangible” property. EMOI’s businessowners policy does not

include the term “tangible,” and we find that distinction significant. Owners also cites to

several cases, some of which stemmed from the COVID-19 pandemic, in which a

business was unable to operate due to governmental mandates, curfews, or prohibitions.

Other cited cases involved events such power outages that prevented operation of the

business. Those circumstances are not analogous to an incursion into EMOI’s computer

system.

{¶ 45} We highlight two cases cited by Owners. In Mastellone v. Lightning Rod

Mut. Ins. Co., 175 Ohio App.3d 23, 2008-Ohio-311 (8th Dist.), homeowners brought suit

against their insured for refusing to provide coverage for mold found on the exterior and

interior of their house and for water damage to their basement. With respect to the

exterior mold on the home’s cedar siding, the court agreed with the insurer that the

homeowners provided no evidence to show that the mold on the siding of the house

constituted “physical damage.” The trial court construed “physical injury” to mean “a

harm to the property that adversely affects the structural integrity of the house.” Id. at

¶ 61, citing 10A Couch on Insurance (3d Ed.1998), Section 148:46 (the requirement that

a loss be “physical” is “widely held” to preclude claims based on “a detrimental economic -19-

impact unaccompanied by a distinct, demonstrable, physical alteration of the property”).

{¶ 46} Although there was evidence of mold staining on the exterior siding of the

house, the court concluded that the staining did not rise to level of “physical injury,”

because it was only temporary and did not affect the structure of the wood. The court

noted that the homeowners’ expert had testified that the mold could be cleaned, although

the staining would reoccur. There was no evidence that the wood needed to be

replaced. The insurer’s experts stated that the primary concern about the mildew was

aesthetic. The Eighth District thus concluded that the trial court erred in failing to direct

a verdict in the insurer’s favor. See Mama Jo’s, Inc. v. Sparta Ins. Co., 11th Cir. No. 18-

12887 (Aug. 18, 2020) (need for cleaning does not satisfy “direct physical” loss).

{¶ 47} Glaser-Garbrick’s description of the “damage” caused by the encryption

went beyond aesthetic. Glaser-Garbrick stated in his deposition that all of the files had

“weird extensions” that prevented access to the files. When he tried to open the

encrypted files, a ransom note appeared. As a result of the encryption, EMOI and its

clients were unable to access EMOI’s system for a significant period of time.

{¶ 48} Owners contends that the EMOI’s system was not physically damaged

because once the decryption program was run, EMOI’s files opened and operated the

way they were intended to, as Glaser-Garbrick testified. In essence, Owners argues that

EMOI’s system merely needed to be cleaned, like the mold in Mastellone.

{¶ 49} The record contains minimal information about how encryption occurs and

its effects on computer data. When asked during his deposition to describe how

encryption worked, Glaser-Garbrick responded, “I’m trying to think about the best way to

explain this. It’s a mathematical function that’s been designed so it’s hard to find a -20-

solution for it, but if you know the answer to the problem, you would be able to basically

undo the encryption.” (Glaser-Garbrick at 23.) Glaser-Garbrick agreed that “once you

get the code, you can unlock it to read it or use the information that’s being sent.” (Id. at

24.) Glaser-Garbrick indicated that encryption and decryption is often “handled without

people realizing it.” (Id.) Glaser-Garbrick did not describe, in technical terms, how

encryption and decryption occurs and the effects on the item being encrypted. No other

evidence regarding encryption was offered by the parties. Accordingly, construing the

evidence in EMOI’s favor, the evidence supports a conclusion that the encryption

damaged EMOI’s software and data, and that the damage was not merely aesthetic or

amounted to loss of access or use.

{¶ 50} Owners also relies on Ward Gen. Ins. Servs., Inc. v. Employers Fire Ins.

Co., 7 Cal.Rptr.3d 844, 114 Cal.App.4th 548 (2003), a computer-related case, to support

its contention that there can be no “direct physical” loss or damage to software, an

intangible object. In that case, the plaintiff was in the process of updating its Oracle

computer database when human error caused the system to “crash,” resulting in the loss

of its electronically-stored data used to service its clients’ insurance policies. Id. at 846.

The insured incurred expenses to restore its data and suffered loss of business income

from the disruption. The plaintiff sought coverage under its businessowners policy,

which was denied due to the lack of “direct physical loss of or damage to property,” and

the trial court agreed.

{¶ 51} In affirming the trial court’s judgment, the California appellate court noted

that the loss was not covered unless it resulted from a risk of direct physical loss. The

court applied the “ordinary and popular” meaning of “direct physical loss” and held that -21-

“the loss of plaintiff's database does not qualify as a ‘direct physical loss,’ unless the

database has a material existence, formed out of tangible matter, and is perceptible to

the sense of touch.” Id. at 850. It continued:

We fail to see how information, qua information, can be said to have

a material existence, be formed out of tangible matter, or be perceptible to

the sense of touch. To be sure, information is stored in a physical medium,

such as a magnetic disc or tape, or even as papers in three-ring binders or

a file cabinet, but the information itself remains intangible. Here, the loss

suffered by plaintiff was a loss of information, i.e., the sequence of ones and

zeroes stored by aligning small domains of magnetic material on the

computer's hard drive in a machine readable manner. Plaintiff did not lose

the tangible material of the storage medium. Rather, plaintiff lost the stored

information. The sequence of ones and zeros can be altered, rearranged,

or erased, without losing or damaging the tangible material of the storage

medium.

We conclude the loss of the database, with its consequent economic

loss, but with no loss of or damage to tangible property, was not a “direct

physical loss of or damage to” covered property under the terms of the

subject insurance policy, and, therefore, the loss is not covered.

(Footnote omitted.) Id. at 851.

{¶ 52} EMOI argues that Ward and other cases are inapplicable, because the

policy language here provides coverage for an intangible item: software. EMOI states in

its appellate brief: “Computer software is not the same type of tangible thing as a floppy -22-

disk, tape or thumb drive. It is something that is not physical, seen or touched.

However, it is tangible enough for [Owners] to insure and expressly define under the

definition of ‘media’ and thus, must be tangible enough to be damaged or suffer direct

physical damage if such is required under the policy by a computer hacker as was done

in this case.” (Appellant’s Brief at 17.)

{¶ 53} EMOI’s position is supported by Natl. Ink and Stitch, LLC v. State Auto

Property and Cas. Ins. Co., 435 F.Supp.3d 679 (D.Md.2020). In National Ink and Stitch,

the computer server and networked computers of an embroidery and screen printing

business experienced a ransomware attack, which prevented the business from

accessing all of the art files and other data contained on the server and, with one

exception, all of its software. The attacker demanded a bitcoin to release access to the

software and data. The business paid the bitcoin, but it did not receive all of the

necessary files to release its software and data (it received the executable file, but not the

configuration file.). The hacker demanded another bitcoin for the additional file.

Instead, the business hired a security company to replace and reinstall its software and

to install protective software. The resultant system was slower than it previously had

been, art files could not be accessed, and experts indicated that there were likely dormant

remnants of the ransomware software that could re-infect the entire system. To

eliminate the risk of further infection, the business could “wipe” the entire system and

reinstall of the software and information or purchase a new server and components.

{¶ 54} The business filed a claim with State Auto regarding the ransomware attack,

seeking coverage for the replacement of its system. The policy stated that State Auto

“will pay for direct physical loss of or damage to Covered Property * * *.” The -23-

Businessowners Special Form Computer Coverage endorsement defined Covered

Property to include “Electronic Media and Records (Including Software),” and defined

“Electronic Media and Records” to include “(a) Electronic data processing, recording or

storage media such as films, tapes, discs, drums or cells; [and] (b) Data stored on such

media.” State Auto denied the claim.

{¶ 55} In cross-motions for summary judgment, the parties disputed whether the

business experienced “direct physical loss or damage to” its computer system.

Interpreting the policy, the district court concluded that the policy contemplated that data

and software could experience “direct physical loss or damage.” It reasoned:

Here, the Policy expressly lists “data” as an example of Covered Property

under its definition of “Electronic Media and Records (Including Software).”

ECF 35-2 at 61. While the term “data” is qualified with the phrase “stored

on such media,” if the Policy intended to require physical loss or damage to

the media itself, as opposed to just the data, it could have stopped at

subsection (a), which describes the covered media. Id. Instead, the

Policy includes “data stored on such media” as a separate subcategory of

Covered Property in subsection (b). Id. The Policy also contains the

phrase “Including Software” in its heading describing covered property. Id.

Thus, the plain language of the Policy contemplates that data and software

are covered and can experience “direct physical loss or damage.”

Natl. Ink & Stitch, LLC, 435 F.Supp.3d at 682. See also Lambrecht & Assocs., Inc., 119

S.W.3d at 24-26 (Tex.App.2003) (policy’s language allowed for coverage to “electronic

media and records” and the “data stored on such media” as “such property is capable of -24-

sustaining a ‘physical’ loss”).

{¶ 56} Again, construing the evidence in the light most favorable to EMOI, we

conclude that the policy contemplated that EMOI’s software and reproduction of data was

capable of being physically damaged, and Glaser-Garbrick has testified that it was.

D. Exclusions

{¶ 57} Finally, Owners argues that applicable limitations and exclusions exist that

preclude coverage under the Electronic Equipment endorsement. The exclusion

provision in the endorsement precludes coverage for:

a. Wear and tear * * *

b. Loss or damage caused by:

(1) Corrosion or rusting;

(2) Dryness or dampness of atmosphere; or

(3) Extremes of temperature

unless directly resulting from accidental direct physical damage to

the electronic equipment system’s air conditioning equipment

caused by a peril not excluded by this endorsement.

c. Any dishonest, fraudulent or criminal act by:

(1) You;

(2) Your partners; or

(3) Any of your officers, directors or trustees

Whether acting alone or in collusion with others.

d. “Electrical disturbance” unless caused by lightning.

e. Loss or damage caused by: -25-

(1) Data processing “media” failure; or

(2) Breakdown or malfunction of the data processing equipment and

component parts while the “media” is being run through the system.

f. Actual work upon, installation or testing of Covered Property. * * *

g. Faulty construction or error in the design of the Covered Property. * * *

h. Delay or loss of market;

i. Loss or damage caused by or resulting from improper operation of

Covered Property.

j. Breakage, marring, scratching, tearing or denting of any “laptop computer”

unless caused by * * *.

{¶ 58} Owners states, in summary fashion, that coverage for EMOI’s claim is

excluded under (e), (h), and (i). Construing the evidence in EMOI’s favor, we disagree

that the circumstances here involve media failure, a malfunction or breakdown of

equipment while the “media” was being run through the system, a loss of market, or

improper operation of the media by EMOI.

{¶ 59} Owners further points to the “Business Income and Extra Expenses”

provision within the “Additional Coverages” portion of the Electronic Equipment

endorsement. This provision generally states that Owners would pay for loss of business

income during the period of restoration. This provision has its own exclusions, which

include losses or damage caused by “Theft of any property, which is not an integral part

of a building or structure at the time of loss.” We fail to see how this provision would

preclude coverage under the endorsement as a whole, nor does the record suggest that -26-

all of EMOI’s loss or damage would fall under this provision.

{¶ 60} For the foregoing reasons, we conclude that genuine issues of material fact

exist as to whether EMOI’s claim was covered by Electronic Endorsement – Media policy.

Consequently, the trial court erred in granting summary judgment to Owners on EMOI’s

breach of contract claim.

{¶ 61} EMOI’s first assignment of error is sustained.

IV. Bad Faith Claim

{¶ 62} In its second assignment of error, EMOI claims that the trial court erred in

granting summary judgment to Owners on its bad faith claim. The trial court did not

separately address EMOI’s bad faith claim, but instead granted judgment to Owners

based on its disposition of EMOI’s breach of contract claim.

{¶ 63} “In Ohio, an insurer has a duty to act in good faith toward its insured in

carrying out its responsibilities under the policy of insurance. Those responsibilities

include the handling and payment of an insured’s claim. Thus, ‘[a]n insurer fails to

exercise good faith in the processing of a claim of its insured where its refusal to pay the

claim is not predicated upon circumstances that furnish reasonable justification therefor.’ ”

(Citations omitted.) Unklesbay v. Fenwick, 167 Ohio App.3d 408, 2006-Ohio-2630, 855

N.E.2d 516, ¶ 14 (2d Dist.), quoting Zoppo v. Homestead Ins. Co., 71 Ohio St.3d 552,

644 N.E.2d 397 (1994), paragraph one of the syllabus.

{¶ 64} During his deposition, Weaner described the process he employed when

reviewing EMOI’s claim. Weaner received EMOI’s claim on the morning of September

13. The loss notice stated that all files were encrypted and were being held under

ransom and that the business could not operate under current conditions. Weaner -27-

indicated that he had spoken with Glaser, reviewed the policy provisions, and had spoken

with a home officer examiner about the facts he had learned from Glaser. Weaner and

the home officer examiner reviewed EMOI’s policy, identified policies that potentially

applied to the claim, and reviewed them “looking for coverage.” The claim was denied

the same day.

{¶ 65} When asked about his experience with computer matters, Weaner indicated

that he received regular IT training from Auto-Owners, predominantly on phishing.

Weaner did not know how software could be damaged and did not know of anyone at

Auto-Owners who could explain damage to software. Weaner did not consult with an IT

or computer expert while evaluating EMOI’s claim. Weaner stated that he previously had

handled claims involving damage to computer systems, but those claims typically had

involved water, fire, or electrical surges.

{¶ 66} Weaner acknowledged that he had a duty to an insured to act in good faith,

which included the duties to fully and fairly investigate the claim and to objectively

evaluate the claim.

{¶ 67} In response to Owners’ motion for summary judgment, EMOI presented the

affidavit of an expert witness, Chris Johnson, who indicated that he had 35 years of

experience in the insurance industry. Johnson opined that Owners’ evaluation of EMOI’s

complaint was deficient and “fell well below the standards, practices and customs in the

insurance industry for conducting a fair, thorough and competent investigation of an

insurance claim.” He stated that Owners failed to consider the various types of damage

that can occur to media such as software, emphasizing that Owners did not consult with

an IT or computer science specialist when evaluating EMOI’s claim. Johnson noted that -28-

Weaner had previously handled claims involving damage to computers, but not to

software.

{¶ 68} Upon review of the evidence, we find that genuine issues of material fact

exist as to whether Owners complied with its duty of good faith in denying EMOI’s claim.

Accordingly, the trial court erred in granting summary judgment on EMOI’s bad faith claim.

{¶ 69} EMOI’s second assignment of error is sustained.

V. Conclusion

{¶ 70} The trial court’s judgment will be reversed, and the matter will be remanded

for further proceedings.

.............

DONOVAN, J., concurs.

TUCKER, P.J., dissents:

{¶ 71} The Electronic Equipment endorsement provides coverage for “direct

physical loss or damage” to media, with media being defined as a device upon “which

information is recorded * * *.” The endorsement then states that “media includes

computer software * * * contained on covered media.” Thus, as correctly noted by the

majority opinion, “giving this language its plain and ordinary meaning, computer software

[to be covered by the endorsement] must be contained on another medium * * *.” The

medium, presumably a server, upon which the software at issue was stored did not

sustain physical loss or damage. Therefore, coverage under the endorsement was not

triggered. Upon this basis, I respectfully dissent.

{¶ 72} In opposition to this conclusion, EMOI argues that as a result of the hacker’s -29-

encryption, its software was damaged, and this damage invoked coverage because

“software is included in the [endorsement’s] definition of media * * *.” EMOI does not,

and cannot, assert that the encryption caused loss or damage to the server upon which

the software was stored. But, as explained, such loss or damage to the device upon

which the software is stored was a prerequisite to coverage for loss or damage to

{¶ 73} I submit that the conclusion I have reached is compelled by the clear,

unambiguous endorsement language, which eliminates any factual issues regarding

whether EMOI’s loss is a covered loss. Perhaps the endorsement language could have

been more precise, but as the Ohio Supreme Court recently reaffirmed, a court cannot

“creat[e] [a contractual] ambiguity by asking whether the parties could have included

different or more express language in their agreement.” AKC, Inc. v. United Specialty

Ins. Co., Ohio Slip Opinion No. 2021-Ohio-3540, __ N.E.3d __, ¶ 12, citing 11 Lord,

Williston on Contracts, Section 30:4 (4th Ed.2021).

{¶ 74} The conclusion I have reached highlights the following “hard reality about

insurance”:

It is not a general safety net for all dangers. If risk is not having money

when you need it, insurance is one answer to perilous events that could

prompt a sudden drop in revenue. Fair pricing of insurance turns on

correctly accounting for the likelihood of the occurrence of each defined peril

and the cost of covering it. Efforts to push coverage beyond its terms

creates a mismatch, an insurance product that covers something no one

paid for and, worse, runs the risk of leaving insufficient funds to pay for perils -30-

that insureds did pay for. That is why courts must honor the coverage the

parties did – and did not – provide for in their written contracts of insurance.

Santo’s Italian Café, LLC v. Acuity Ins. Co., ___ F.4th ___, 2021 WL 4304607, *7 (6th

Cir.).1

{¶ 75} Based upon my coverage conclusion, I also dissent regarding the majority

decision that there are factual issues surrounding EMOI’s bad faith cause of action.

Since, in my opinion, Owners made the correct coverage call, its refusal to pay EMOI’s

claim was “predicated upon circumstances that furnish[ed] reasonable justification” for

the refusal. Unklesbay, 167 Ohio App.3d 408, 2006-Ohio-2630, 855 N.E.2d 516, at ¶ 14,

quoting Zoppo, 71 Ohio St.3d 552, 644 N.E.2d 397, at paragraph one of the syllabus.

Given this, Owners, as a matter of law, did not act in bad faith.

Copies sent to:

John A. Smalley Erin B. Moore Hon. Gregory F. Singer

1 Acuity decided whether Santo’s, a restaurant, was entitled to business interruption coverage based upon Santo’s being forced to suspend its indoor dining operation as a result of Ohio’s Covid-19 mandates. Santo’s business interruption coverage was, as in the present case, triggered by loss or damage to covered property. The Sixth Circuit, applying Ohio law, decided that since no covered property was altered by the forced shutdown, Santo’s did not sustain loss or damage to covered property, and, thus, the loss was not covered. Though the interpretation of the loss or damage language has been discussed in this case, resolution of the appropriate interpretation of this language is not relevant to my analysis because, as discussed, EMOI does not assert loss or damage to the server upon which the affected software was stored.