In re Accellion, Inc. Data Breach Litigation

[3] 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION [7] 8 MADALYN BROWN, et al., Case No. 5:21-cv-01155-EJD 9 Plaintiffs, ORDER GRANTING MOTION TO CONSOLIDATE CASES AND SET 10 v. SCHEDULING DEADLINES 11 ACCELLION, INC., Re: Dkt. No. 37 Defendant. [12] 13 Plaintiff Grace Beyer (“Plaintiff”) in Beyer v. Flagstar Bancorp, d/b/a Flagstar Bank, No. 14 5:21-cv-02239-EJD, brings this motion requesting that all current and future related putative class 15 actions concerning the December 2020 Accellion, Inc. (“Accellion”) data breach be consolidated 16 under the title In re Accellion, Inc. Data Breach Litigation. Additionally, Plaintiff requests that 17 the Court establish an abbreviated briefing schedule for filing applications seeking appointment of 18 interim co-lead class counsel pursuant to Rule 23(g). For the reasons set forth below, the Court 19 GRANTS Plaintiff’s motion.1 20 I. BACKGROUND 21 The Beyer case is one of 15 related cases (the “Related Cases”) filed against Accellion as a 22 result of a cyberattack and data breach of Accellion’s File Transfer Appliance (“FTA’) software, 23 which it used to securely transfer large files. On December 23, 2020, Accellion disclosed to 24 several of its clients who license Accellion’s FTA that it was the target of a cyberattack. Accellion [26] 1 The Court concludes that the motion is suitable for disposition without oral argument. See Civ. 27 L.R. 7-1(b). Case No.: 5:21-cv-01155-EJD 1 also informed its impacted clients that the breach exposed personal identifying information (“PII”) 2 and other sensitive information, which clients submitted to Accellion. See Mot. to Consolidate 3 Cases and Set Scheduling Deadlines (“Mot.”), Dkt. No. 37 at 7. The Related Cases all allege that 4 unauthorized third parties exploited vulnerabilities in the FTA software to gain access to data 5 stored in or transferred by the Accellion clients’ FTA systems. Id. at 8. The plaintiffs in the 6 Related Cases purport to represent classes including customers, employees, applicants, or others 7 who provided information to the impacted Accellion clients. Although Accellion is named as a 8 defendant in every case, some plaintiffs have additionally asserted claims against certain Accellion 9 clients. The following nine cases name Accellion as the sole defendant: 10 • Brown v. Accellion, Inc., No. 5:21-cv-01155-EJD, filed February 17, 2021; 11 • Zebelman v. Accellion, Inc., No. 5:21-cv-01203-EJD, filed February 18, 2021; 12 • Rodriguez v. Accellion, Inc., No. 5:21-cv-01272-EJD, filed February 22, 2021; 13 • Stobbe v. Accellion, Inc., No 5:21-cv-01353-EJD, filed February 24, 2021; 14 • Price v. Accellion, Inc., No. 3:21-01430-EJD, filed February 26, 2021; 15 • Bolton v. Accellion, Inc., No. 5:21-cv-01645-EJD, filed March 8, 2021; 16 • Whittaker v. Accellion, Inc., No. 5:21-cv-01708-EJD, filed March 11, 2021; 17 • Sharp v. Accellion, Inc., No. 5:21-cv-02525-EJD, filed April 7, 2021; and 18 • Desjardins v. Accellion, Inc., No. 5:21-cv-04743-EJD, filed June 22, 2021 19 Six cases name Accellion and either Kroger, Flagstar Bank, or Health Net as defendants 20 (the “Accellion Client Cases”): 21 • Cochran v. The Kroger Co. and Accellion, Inc., No. 5:21-cv-01887-EJD, filed March 17, 2021; 22 • Beyer v. Flagstar Bank and Accellion, Inc., No. 5:21-cv-02239-EJD, filed March 30, 2021; 23 • Pollard v. Accellion, Inc. and Flagstar Bank, No. 5:21-cv-02572-EJD, filed April 8, 2021; 24 • Vunisa v. Health Net LLC, et. al., No. 5:21-cv-03425-EJD, filed April 6, 2021 (removed May 25 7, 2021); 26 • Doe v. Health Net of California, Inc., Health Net LLC and Accellion, Inc., No. 5:21-cv-02975 [27] Case No.: 5:21-cv-01155-EJD 1 EJD, filed April 23, 2021; and 2 • Harbour v. California Health & Wellness Plan, et. al., No. 5:21-cv-03322-EJD, filed May 4, 3 2021. 4 Plaintiff filed this motion on April 7, 2021, which Accellion joined in supporting. See 5 Mot. Plaintiffs in three of the Related Cases filed oppositions to the motion— the plaintiffs in 6 Brown and Whittaker filed a joint opposition (“Brown Opp’n”), see Dkt. No. 40, while Plaintiff 7 Susan Zebelman filed a separate opposition (“Zebelman Opp’n”), see Dkt. No. 41. Plaintiff and 8 Accellion each filed a reply in support of the motion. See Beyer Reply in Support of Mot. to 9 Consolidate Cases and Set Scheduling Deadlines, (“Beyer Reply”), Dkt. No. 47; Accellion Reply 10 in Support of Plaintiff Grace Beyer’s Motion to Consolidate Cases, (“Accellion Reply”), Dkt. No. 11 48. 12 II. LEGAL STANDARD 13 “When actions involving a common question of law or fact are pending before the court, 14 it . . . may order all the actions consolidated.” Fed. R. Civ. P. 42(a). The “district court has broad 15 discretion under this rule to consolidate cases pending in the same district.” Invs. Rsch. Co. v. 16 U.S. Dist. Ct. for Cent. Dist. of California, 877 F.2d 777 (9th Cir. 1989). “In determining whether 17 or not to consolidate cases, the Court should ‘weigh the interest of judicial convenience against the 18 potential for delay, confusion, and prejudice.’” Zhu v. UCBH Holdings, Inc., 682 F. Supp. 2d 19 1049, 1052 (N.D. Cal. 2010) (quoting Sw. Marine, Inc. v. Triple A Mach. Shop, Inc., 720 F. Supp. 20 805, 806-07 (N.D. Cal. 1989)). 21 III. DISCUSSION 22 All parties, including the plaintiffs in Brown, Whittaker, and Zebelman, agree that the 23 Court should consolidate the cases that have been filed against Accellion as a sole defendant. The 24 parties diverge however on whether a consolidation order should include the six remaining 25 cases—which name Accellion along with Kroger, Flagstar, or Health Net—or require them to 26 proceed separately. [27] Case No.: 5:21-cv-01155-EJD 1 As a preliminary matter, the Court finds that each case filed against only Accellion 2 presents substantially similar factual and legal issues. The focus in each case is the Accellion data 3 breach, and plaintiffs allege the same damages and assert similar counts, including claims for 4 negligence, invasion of privacy, violations of consumer protection statutes, and violations of data 5 privacy laws based on their PII or other sensitive information being exposed to third parties 6 without their authorization. Additionally, each case is in the same procedural stage because 7 Accellion has not yet filed an answer or responsive motion. Further, since the claims for each case 8 arise from the same or similar set of circumstances, discovery issues relating to each case will be 9 parallel. In addition, there appears to be no basis to find that consolidation would cause 10 inconvenience, delay, or expense, especially since the parties appear to agree with the 11 consolidation request. As such, the Court finds consolidation appropriate for the cases that have 12 been filed against Accellion as a sole defendant. The Court now turns to the question of whether 13 the consolidation order should include the six Accellion Client Cases. 14 The opposing plaintiffs assert that there are unique factual and legal questions raised by the 15 Accellion Client Cases which weigh against including them in the consolidation. This argument is 16 not persuasive however because initially, Accellion is still named in all the Accellion Client 17 Cases. Further, the factual and legal issues as they pertain to Accellion are the same in every case. 18 The Brown opposition’s reliance on Pacific Recovery Solutions v. Cigna Behavioral Health, Inc. 19 to distinguish the Accellion Client Cases from those only naming Accellion is also misplaced. See 20 Brown Opp’n at 8. In Pacific Recovery, the Court denied consolidation where the two cases 21 shared a common issue, but beyond the common issue, the two cases involved significant 22 differences in fact and law. See Pac. Recovery Sols. v. Cigna Behav. Health, Inc., No. 5:20-cv23 02251-EJD, 2021 WL 577394 , at *4-5 (N.D. Cal. Feb. 16, 2021). Here, the unique client specific 24 facts that the oppositions claim defeat consolidation are relevant in the Accellion only cases as 25 well. The asserted claims in the Accellion Client Cases arise from the alleged compromise of 26 information collected, transferred, and/or store by the clients through Accellion’s FTA system. [27] Case No.: 5:21-cv-01155-EJD 1 Therefore, the conduct and culpability of Accellion’s clients will be at issue in every case 2 including those only naming Accellion as a defendant. 3 Additionally, all the Related Cases are in the same procedural stage—neither Accellion nor 4 the named Accellion clients have filed an answer or responsive motion. Moreover, since the 5 claims for each case arise from the same or similar set of circumstances, discovery issues relating 6 to each case will be parallel. Still, the Brown and Whittaker plaintiffs assert that including the 7 Accellion Client Cases in the consolidation would result in “inconvenience, delay, and additional 8 expense.” Brown Opp’n at 7. The Court disagrees. Consolidating the Accellion-only cases and 9 not including the Accellion Client Cases could create duplicative and overlapping discovery 10 efforts, pretrial motions, class certification filings relating to similar or the same classes, and other 11 case management issues, which would result in what Rule 42(a) is aimed at avoiding: inefficiency. 12 Tehrani v. Int’l Cycle Works, Inc., 2007 WL 6548862 , at *1 (C.D. Cal. June 18, 2007) (“The 13 purpose of consolidation is to enhance court efficiency and to avoid substantial danger of 14 inconsistent adjudications.”). Instead, consolidating all the identified cases will allow the cases to 15 proceed at the same pace, promote judicial economy by lessening the Court’s burden of managing 16 the Related Cases, and streamline the parties’ discovery and briefing efforts as Accellion’s clients 17 impacted by the data breach will inevitably be involved. 18 The Court accordingly will include the Accellion Client Cases in the consolidation with 19 one exception. The Court will defer ordering that Cochran v. The Kroger Co. and Accellion, Inc., 20 No. 5:21-cv-01887-EJD be a part of the consolidation at this time as the Court is set to hear a 21 motion for final approval of class action settlement on March 24, 2022 in Cochran. The Court 22 intends to address the consolidation question with the Cochran parties at that time. [27] Case No.: 5:21-cv-01155-EJD 1 IV. ORDER 2 Based on the foregoing, the Motion to Consolidate is GRANTED. The Court hereby 3 ORDERS as follows: 4 Consolidation 5 (1) The Clerk of the Court shall consolidate case numbers: 5:21-cv-01155-EJD, 5:21-cv6 01203-EJD, 5:21-cv-01272-EJD, 5:21-cv-01353-EJD, 5:21-01430-EJD, 5:21-cv-01645-EJD, 7 5:21-cv-01708-EJD, 5:21-cv-02239-EJD, 5:21-cv-02525-EJD, 5:21-cv-02572-EJD, 5:21-cv8 02975-EJD, 5:21-cv-03322-EJD, 5:21-cv-03425-EJD, 5:21-cv-04743-EJD. 9 Once consolidated, the Clerk shall close 5:21-cv-01203-EJD, 5:21-cv-01272-EJD, 5:21-cv10 01353-EJD, 5:21-01430-EJD, 5:21-cv-01645-EJD, 5:21-cv-01708-EJD, 5:21-cv-02239, 5:2111 cv-02525-EJD, 5:21-cv-02572-EJD, 5:21-cv-02975-EJD, 5:21-cv-03322-EJD, 5:21-cv-0342512 EJD, 5:21-cv-04743-EJD. 13 (2) The terms of this Order (“CMO”) shall not have the effect of making any person, 14 firm, or corporation a party to any action in which he, she, or it has not been named, 15 served, or added as such, in accordance with the Federal Rules of Civil Procedure. The 16 terms of this CMO and the consolidation ordered herein shall not constitute a waiver by 17 any party of any claims in or defenses under the Federal Rules of Civil Procedure or any 18 other statute or common law to the Actions, or any subsequently filed consolidated or 19 related action. 20 Master Docket and Master File 21 (3) A Master Docket and Master File are hereby established for the Related Cases. The 22 Master File number shall be 21-cv-01155. A Master Docket will be maintained for the 23 Related Cases with all entries to be docketed under the Master File number. If a document 24 pertains to only one or some of the consolidated cases, it will be docketed on the Master 25 Docket with the notation in the docket text as to the case numbers to which it pertains. [27] Case No.: 5:21-cv-01155-EJD 1 (4) Separate docket numbers shall be terminated in accordance with the regular 2 procedures of the Clerk of this Court, and any pending schedules, deadlines, or dates in the 3 5:21-cv-01203-EJD, 5:21-cv-01272-EJD, 5:21-cv-01353-EJD, 5:21-01430-EJD, 5:21-cv4 01645-EJD, 5:21-cv-01708-EJD, 5:21-cv-02239-EJD, 5:21-cv-02525-EJD, 5:21-cv5 02572-EJD, 5:21-cv-02975-EJD, 5:21-cv-03322-EJD, 5:21-cv-03425-EJD, 5:21-cv6 04743-EJD cases shall be vacated. 7 (5) An original of this CMO shall be filed by the Clerk in the Master File and in the 8 files for each of the Related Cases captioned above, and in the file of every case 9 subsequently consolidated herewith. 10 Caption of Cases 11 (6) Every pleading filed in the Related Cases listed above shall hereafter bear the 12 following caption: “In re Accellion, Inc. Data Breach Litigation, Case No. 21-cv-0115513 EJD.” 14 (7) All papers previously filed and served to date in the Related Cases are part of the 15 record in 21-cv-01155-EJD. 16 Filing and Docketing 17 (8) When a paper is filed and the caption shows that it is to be applicable to any of the 18 Related Cases, such paper shall be filed in the Master File (21-cv-01155-EJD) and the 19 Clerk shall note such filing in the Master Docket. Such papers need not be filed, and 20 docket entries need not be made, in any other case file. 21 (9) When a paper is filed and the caption shows that it is to be applicable to fewer than 22 all of the Related Cases, such paper shall be filed in the Master File. In other words, it is 23 not necessary to file the paper in any case other than the Master File. 24 Admission of Attorneys and Appearances 25 (10) Each attorney who has already made an appearance or been admitted pro hac vice 26 in any of the Related Cases shall be deemed admitted in In re Accellion, Inc. Data Breach [27] Case No.: 5:21-cv-01155-EJD 1 Litigation, Case No. 21-cv-01155-EJD. 2 (11) Counsel who have not yet entered an appearance shall file a Notice of Appearance 3 in In re Accellion, Inc. Data Breach Litigation, Case No. 21-cv-01155-EJD. 4 Application of This Order to Subsequently Filed or Transferred Cases 5 (12) Counsel in the above-captioned Related Cases shall call to the attention of the 6 Court the filing or transfer of any related action arising out of similar facts and 7 circumstances as are alleged in the Related Cases and that therefore might properly be 8 consolidated or coordinated with the Related Cases. 9 (13) Counsel in the Related Cases shall promptly mail a copy of this Order to counsel 10 for plaintiff(s) in each such subsequently filed or transferred related action and to counsel 11 for Defendants in each such action not already a party to the Related Cases. Promptly 12 thereafter, upon notice to counsel for the parties in each such action, counsel for Plaintiffs 13 in the Related Cases and counsel for Defendants shall submit to the Court a proposed order 14 consolidating any such action. Any party objecting to the application of this CMO to such 15 a subsequently filed or transferred action, or objecting to consolidation with the Related 16 Cases, shall file a motion seeking relief from this CMO within ten (10) days after the date 17 upon which such a copy of this CMO is mailed by counsel in the Related Cases to counsel 18 for such party. 19 Filing and Service of Documents 20 (14) This case is assigned to the Electronic Case Filing (ECF) System. The parties are 21 referred to the Court’s electronic filing requirements and procedures 22 (http://www.cand.uscourts.gov/cm-ecf). 23 (15) Papers that are filed through the Court’s ECF system are deemed served on all 24 parties. Plaintiffs shall effect service of papers on Defendants by e-filing the papers in 25 accordance with all applicable rules or, if e-filing is unavailable or inapplicable, by serving 26 a copy of the same on Defendants’ counsel by electronic mail in accordance with the [27] Case No.: 5:21-cv-01155-EJD 1 Federal Rules of Civil Procedure. Defendants shall effect service of papers on Plaintiffs by 2 e-filing the papers in accordance with all applicable rules or, if e-filing is unavailable or 3 inapplicable, by serving a copy of the same on Interim Class Counsel by electronic mail in 4 accordance with the Federal Rules of Civil Procedure. All other service of papers 5 (including service of process for initiating documents) shall be governed by the Federal 6 Rules of Civil Procedure, unless otherwise agreed by the parties. 7 Preservation of Evidence 8 (16) All named parties and counsel are reminded of their duty to preserve evidence that 9 may be relevant to this case, including electronically stored information. Until the parties 10 reach an agreement on a preservation plan for all cases or the Court orders otherwise, each 11 party shall take reasonable steps to preserve all evidence that may be relevant to this 12 litigation. Counsel, as officers of the court, are obligated to exercise all reasonable efforts 5 13 to identify and notify parties and non-parties, including employees of foreign corporate or 14 institutional parties, of their preservation obligations. 3 15 IT IS FURTHER ORDERED that all parties shall meet and confer to discuss and submit a 16 || proposed briefing schedule for the motion for appointment of interim co-lead class counsel 3 17 pursuant to Rule 23(g) within ten (10) days of this Order. IT IS SO ORDERED. 19 Dated: March 14, 2022 [20] 21 eM EDWARD J. DAVILA 22 United States District Judge [26] Case No.: 5:21-cv-01155-EJD 28 || ORDER GRANTING MOTION TO CONSOLIDATE CASES AND SET SCHEDULING DEADLINES