Skurauskis v. NationsBenefits Holdings, LLC

UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF FLORIDA CASE NO. 23-CV-60830-RAR ARIANA SKURASKIS, et al., on behalf of themselves and all others similarly situated, Plaintiffs, v. NATIONSBENEFITS HOLDINGS, LLC, et al., Defendants. _________________________________________/ ORDER GRANTING DEFENDANTS’ MOTION TO STAY DISCOVERY THIS CAUSE comes before the Court on Defendants NationsBenefits, LLC and NationsBenefits Holdings, LLC’s (“NationsBenefits”) Motion to Stay Discovery Pending Ruling on Motion to Dismiss Plaintiffs’ Consolidated Class Action Complaint (“Motion to Stay”), [ECF No. 60], filed on October 6, 2022.1 For the reasons set forth herein, it is hereby ORDERED AND ADJUDGED that Defendants’ Motion to Stay is GRANTED. BACKGROUND This class action suit stems from a healthcare data breach in which information collected by NationsBenefits—a health benefits administration company that partners with managed care organizations to provide supplemental benefits, flex cards, and member engagement solutions— was accessed by an unauthorized third party in early 2023. See generally Cons. Compl., [ECF No. 1 The Motion is ripe for adjudication. See Plaintiffs’ Response in Opposition (“Response”), [ECF No. 62]; Defendants’ Reply in Support (“Reply”), [ECF No. 68]; and Plaintiffs’ Surreply in Opposition (“Surreply”), [ECF No. 70]. Further, the Court has carefully reviewed the Consolidated Class Action Complaint (“Consolidated Complaint”), [ECF No. 44]; Defendants’ Motion to Dismiss the Consolidated Complaint (“MTD”), [ECF No. 59]; and all pleadings regarding Defendants’ Motion to Consolidate before the Judicial Panel on Multidistrict Litigation (“JPML”) pursuant to 28 U.S.C. § 1407 , see generally In re: Fortra FileTransfer Software Data Sec. Breach Litig., MDL No. 3090. 44]. The purported third-party, a cybercriminal hacking group known as Clop ransomware gang (“Clop”), obtained the personal health information of nearly 3 million people in the data breach. Cons. Compl. ¶ 3. Plaintiffs now bring suit alleging that “[a]s a result of NationsBenefits’ impermissibly lax data security practices, Plaintiffs and Class Members are at a present and continuing risk for identity and medical identity theft,” and that NationsBenefits “compounded this harm by waiting more than two months before notifying affected consumers that their highly sensitive Private Information was now in the hands of sophisticated cyber criminals.” Cons. Compl. ¶ 5. Plaintiffs’ Amended Complaint sets forth six counts common to all Plaintiffs in connection with the data breach: Negligence, Negligence Per Se, Breach of a Third-Party Beneficiary Contract, Breach of an Implied Contract, Unjust Enrichment, and Declaratory Judgment. Cons. Compl. ¶¶ 234–312. Plaintiffs further assert additional causes of action divided into 14 state subclasses alleging a variety of statutory causes of action under various state consumer protection laws, deceptive trade practices, and personal data protection laws. Cons. Compl. ¶¶ 313–580.2 Defendants filed their MTD on October 6, 2023, [ECF No. 59]. They maintain that suit against NationsBenefits is improper because the breach was perpetrated against Fortra LLC (“Fortra”) rather than NationsBenefits, a company with which NationsBenefits contracted to provide information technology management services. See generally MTD. Specifically, Defendants argue that Plaintiffs lack standing because they fail to “allege any actual misuse of their Private Information, and . . . fail to allege facts that plausibly connect any alleged misuse to the Incident.” Id. at 2 . Defendants also argue that Plaintiffs “impermissibly ‘group plead’ the 2 The 14 state subclasses are Arkansas, California, Florida, Illinois, Indiana, Kansas, Michigan, Missouri, New Jersey, New York, North Carolina, Ohio, Pennsylvania, and Texas. allegations in an attempt to overstate the nature of the Incident, the injuries alleged, and the causes of action and relief which they purport to seek against NationsBenefits.” Id. The same day Defendants filed their MTD, they also filed the instant Motion to Stay. Defendants ask the Court to temporarily stay discovery pending the Court’s ruling on the pending MTD. See generally Mot. to Stay. In support of their Motion to Stay, Defendants argue that a stay is warranted because (1) the MTD is meritorious, id. at 4–8; (2) a stay will not harm or prejudice plaintiffs and will prevent significant undue burden to Defendants, id. at 8–10; and (3) Defendants have a motion pending before the JPML under 28 U.S.C. § 1407 , see generally Reply. LEGAL STANDARD District courts enjoy broad discretion in deciding how to best manage the cases before them. See Johnson v. Bd. of Regents of Univ. of Ga., 263 F.3d 1234, 1269 (11th Cir. 2001); see also Chrysler Int’l Corp. v. Chemaly, 280 F.3d 1358, 1360 (11th Cir. 2002). “In deciding whether to stay discovery pending resolution of a motion to dismiss, the court must balance the harm produced by a delay in discovery against the possibility that the motion will be granted and entirely eliminate the need for such discovery.” In re: Mednax Services, Inc., Customer Data Security Breach Litig., No. 21-MD-02994, 2021 WL 10428229 , at *1 (S.D. Fla. Oct. 9, 2021) (quoting Koock v. Sugar & Felsenthal, LLP, No. 8L09-CV-609-T-17EAJ, 2009 WL 2579307 , at *2 (M.D. Fla. Aug. 19, 2009)); see also Point Conversions, LLC v. Lopane, No. 20-61549, 2020 WL 6700236 , at *1 (S.D. Fla. Oct. 29, 2020) (staying discovery pending a decision on defendant’s motion to dismiss which “raise[s] serious questions regarding the viability of Plaintiff’s Complaint that must be resolved before Defendant is burdened with discovery and other pretrial obligations”). Importantly, where a pending motion may dispose of the entire action, granting a stay of discovery not necessary for resolution of the motion may be justified. See Chudasama v. Mazda Motor Corp., 123 F. 3d 1353, 1367 (11th Cir. 1997) (“Facial challenges to the legal sufficiency of a claim or defense, such as a motion to dismiss based on failure to state a claim for relief, should . . . be resolved before discovery begins.”); Lewis v. Mercedes-Benz, USA, LLC, No. 1981220, 2020 WL 4923640 , at *2 (S.D. Fla. Mar. 25, 2020) (quoting Nankvil v. Lockheed Martin Corp., 216 F.R.D. 689, 692 (M.D. Fla. 2003)) (explaining that “good cause to stay discovery exists wherein resolution of a preliminary motion may dispose of the entire action.”). “This necessarily entails taking a preliminary peak at the merits of the dispositive motion to see if it appears to be clearly meritorious and truly case dispositive.” Lewis, 2020 WL 4923640 , at *2 (internal quotations and citations omitted); McCabe v. Foley, 233 F.R.D. 683, 685 (M.D. Fla. 2006) (holding “[a] request to stay discovery pending a resolution of a motion is rarely appropriate unless resolution of the motion will dispose of the entire case.”); see also Goldstein v. Costco Wholesale Corp., No. 21-80601, 2021 WL 2827757 , at *2 (S.D. Fla. July 8, 2021) (“When faced with legitimate challenges to the legal theory upon which a broad class action complaint rests, a temporary stay of discovery is the proper course until such challenges are resolved.”). Further, in the case of a motion to stay discovery “pending a motion to the JPML to transfer and consolidate, courts consider three factors: (1) potential prejudice to the non-moving party; (2) potential prejudice to the moving party if the stay is not granted; and (3) conservation of judicial resources.” Ephraim v. Abbott Laboratories, Inc., 601 F. Supp. 3d 1274 , 1275 (S.D. Fla. 2022) (citing Ali v. 7-Eleven, Inc., No. 22-20328, 2022 WL 713665 , at *2 (S.D. Fla. Mar. 10. 2022)) (noting “courts frequently grant stays pending the JPML’s determination whether to consolidate and transfer cases.”) (internal quotations omitted). “Ultimately, the proponent of a stay of discovery bears the burden of demonstrating its necessity, appropriateness, and reasonableness.” Taylor v. Service Corp., Int’l, No. 20-60709, 2020 WL 6118779 , at *4 (S.D. Fla. Oct. 16, 2020) (quoting Ray v. Spirit Airlines, Inc., No. 1261528, 2012 WL 541793 , at *2 (S.D. Fla. Nov. 9. 2012)) (noting that “when faced with legitimate standing challenges . . . discovery should not commence until such challenges are resolved.”). ANALYSIS I. Defendants’ Standing and Pleading Challenges Warrant a Stay of Discovery A “preliminary peek” at the pending Motion to Dismiss reveals that Defendants have raised colorable challenges to Plaintiffs’ Article III standing, as well as the pleading sufficiency of Plaintiffs’ claims. Plaintiffs counter they have Article III standing under binding precedent, that the MTD lacks merit, and that each count in the Consolidated Complaint states a viable cause of action. Resp. at 5–8. However, without passing judgment on the merits of the MTD, a cursory review indicates that Defendants’ standing and pleading sufficiency challenges are viable enough to warrant a stay of discovery pending the Court’s ruling on the MTD and/or the JPML’s ruling on Defendants’ pending § 1407 Motion. Concerning Defendants’ substantive attacks on Plaintiffs’ claims, the Court first considers Defendants’ standing challenge, which is directed primarily at the injury-in-fact and traceability requirements of Article III. See MTD at 7–21; Mot. at 5–7. To establish the individual standing prerequisites, a plaintiff must have “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). These three elements must be supported “with the manner and degree of evidence required at the successive stages of the litigation.” Wilding v. DNC Servs. Corp., 941 F.3d 1116 , 1124–25 (11th Cir. 2019), (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992)); see also 31 Foster Children v. Bush, 329 F.3d 1255, 1263 (11th Cir. 2003) (“How much evidence is necessary to satisfy [the standing requirement] depends on the stage of litigation at which the standing challenge is made.”). Further, “plaintiffs must demonstrate standing for each claim that they press and for each form of relief that they seek.” TransUnion LLC v. Ramirez, 141 S. Ct. 2190, 2208 (2021). Article III standing may be challenged either facially or factually. A facial attack looks only to the face of the complaint and accepts its allegations as true. See Lawrence v. Dunbar, 919 F.2d 1525 , 1528–29 (11th Cir. 1990). It “requires the court merely to look and see if the plaintiff has sufficiently alleged a basis of subject matter jurisdiction.” Stalley ex rel. U.S. v. Orlando Reg’l Healthcare Sys., Inc., 524 F.3d 1229, 1232 (11th Cir. 2008) (quoting McElmurray v. Consol. Gov’t of Augusta–Richmond Cnty., 501 F.3d 1244, 1250 (11th Cir. 2007)). A factual attack, by contrast, challenges the factual basis for jurisdiction notwithstanding any of the complaint’s allegations. See Lawrence, 919 F.2d at 1528–29. In weighing a factual attack, a court is free to consider materials outside the pleadings, and the pleadings are afforded no presumptive truth. Id. at 1529; see also Butts v. ALN Grp., LLC, 512 F. Supp. 3d 1301 , 1305 (S.D. Fla. 2021). “As a threshold matter, the Court need only find that one named Plaintiff has Article III standing to maintain suit.” In re Mednax Servs., Inc., Customer Data Sec. Breach Litig., 603 F. Supp. 3d 1183 , 1200 (S.D. Fla. 2022). A plaintiff has suffered an injury in fact if he or she has “suffered ‘an invasion of a legally protected interest’ that is ‘concrete and particularized’ and ‘actual or imminent, not conjectural or hypothetical.’” Spokeo, 578 U.S. at 339 (quoting Lujan, 504 U.S. at 560 ). “Central to assessing concreteness is whether the asserted harm has a ‘close relationship’ to a harm traditionally recognized as providing a basis for a lawsuit in American courts—such as a physical harm, monetary harm, or various intangible harms . . . .” TransUnion, 141 S. Ct. at 2200 . Concrete intangible harms may include reputational harms, disclosure of private information, and intrusion on seclusion. Id. at 2204 (collecting cases). Here, contrary to Defendants’ argument, Plaintiffs’ allegations appear to plainly satisfy Article III’s injury-in-fact requirement. The Consolidated Complaint includes allegations that various plaintiffs had their full names, dates of birth, Social Security numbers, phone numbers, addresses, gender, health plan subscription information, and other personal identifying information stolen as a result of the data breach at the center of this litigation. Cons. Compl. ¶ 12. Even more significantly, several plaintiffs also allege actual misuse of personal data following the breach, including spam emails, calls, and texts, unauthorized bank account creation, fraudulent account charges, and fraudulent billing. Cons. Compl. ¶¶ 23–126. Plaintiffs also allege emotional harm and the burden arising from the increased time that affected victims must now dedicate towards identity theft protection and fraud monitoring in the wake of the breach. See id. These allegations are adequate to establish injury-in-fact under Article III, a conclusion this Court has reached on more than one occasion. See In re Mednax Services, Inc., 603 F. Supp. 3d at 1200-05 (finding as dispositive the fact that Plaintiffs alleged actual misuse and access to personal data coupled with the intangible costs of emotional distress and increased time plaintiffs had to spend reviewing their financial information and monitoring for identity theft); Desue v. 20/20 Eye Care Network, Inc., No. 21-61275, 2022 WL 796367 , at *5 (S.D. Fla. Mar. 15, 2022) (“Further, courts have found that evidence of misuse of certain individuals’ data affected by the same data breach can help establish a ‘substantial risk’ of future harm for those plaintiffs who have not yet been affected.” (quoting McMorris v. Carlos Lopez & Associates, LLC, 995 F.3d 295, 301 (2nd Cir. 2021))). Accordingly, Defendants’ injury-in-fact challenge as a basis for staying discovery fails. Defendants’ traceability challenge, however, presents a closer question. Beyond establishing that a plaintiff has suffered an injury in fact, he or she must allege a “causal connection between the injury and the conduct complained of”—in other words, the injury must be “fairly traceable to the challenged action of the defendant.” Lujan, 504 U.S. at 560 (cleaned up). However, Article III standing does not require that defendants be the most immediate cause, or even a proximate cause, of plaintiffs’ injuries; it requires only that those injuries be fairly traceable to defendants. See Lexmark Int’l, Inc. v. Static Control Components, Inc., 572 U.S. 118 , 134 n.6 (2014). “Even harms that flow indirectly from the action in question can be said to be ‘fairly traceable’ to that action for standing purposes.” Wilding, 941 F.3d at 1125 (quoting Focus on the Family v. Pinellas Suncoast Transit Auth., 344 F.3d 1263, 1273 (11th Cir. 2003)) (alteration omitted). Plaintiffs’ point to Mednax and Desue in support of their argument that the harms alleged here are fairly traceable to the challenged conduct of Defendants. Resp. at 6. But Plaintiffs overlook a key difference that distinguishes the instant case from this Court’s prior opinions—the fact it was Fortra’s systems that were breached rather than NationsBenefits’. And while it is premature at this stage to fully evaluate the merits of Plaintiffs’ arguments in opposition to this aspect of NationsBenefits’ defense, the Court is persuaded at this stage that Defendants have satisfactorily articulated a factual challenge to Article III’s traceability requirement sufficient to warrant a stay of discovery pending the Court’s more fulsome evaluation of the MTD. Apart from its standing challenge, the MTD also substantively challenges all 27 counts contained in Plaintiffs’ Amended Complaint for failure to state a claim pursuant to Rule 12(b)(6). MTD at 22–50. Indeed, Defendants raise potentially fatal pleading deficiencies concerning Plaintiffs’ claims for Negligence, Negligence Per Se, Breach of a Third-Party Beneficiary Contract, Breach of Implied Contract, Unjust Enrichment, and Declaratory Judgment, in addition to challenging each subclass’s 21 state-law-specific statutory claims. Id. at 21–34. Accordingly, even if the Motion to Dismiss were granted in part, such a grant would substantially impact the viability of claims against one or more Defendants and drastically alter the scope of discovery. See Taylor v. Serv. Corp. Int’l, 2020 WL 6118779 , at *2; Lewis, 2020 WL 4923640 , at *2. Thus, Defendants’ pleading sufficiency challenge further counsels a temporary stay of discovery. Finally, the Court addresses Plaintiffs’ contention that a discovery stay here would prejudice Plaintiffs and not unduly burden Defendants. Defendants rightly note that there are no allegations in the Amended Complaint suggesting that Plaintiffs or prospective class members’ data is at continuing risk at the hands of NationsBenefits. Reply at 9. Indeed, it is unclear how the Court’s grant of injunctive relief directed at NationsBenefits would affect the security of any remaining at-risk data stored on Fortra’s systems. Consequently, a temporary stay will not prejudice Plaintiffs in this regard. Plaintiffs also understate the relative burden of proceeding with discovery in a nationwide data breach class action such as this, which includes 14 different state subclasses, 27 different counts, and 21 state-law-specific statutory claims. Accordingly, “Defendants will be forced to incur significant costs if they must respond to discovery about claims that ultimately may not be properly part of this case. On the other hand, the Court finds that a brief stay of discovery would not prejudice Plaintiff—and should the case proceed, Plaintiff will have ample opportunity to conduct discovery. Therefore, Defendants have adequately demonstrated the reasonableness of a temporary stay.” Taylor, 2020 WL 6118779 , at *4. II. Defendants’ Pending § 1407 Motion Separately Supports a Stay of Discovery Apart from the MTD’s viability, Defendant’s pending motion to consolidate under § 1407 provides a second, independent basis for granting a stay of discovery. Here, the Court looks to “(1) potential prejudice to the non-moving party; (2) potential prejudice to the moving party if the stay is not granted; and (3) conservation of judicial resources.” Ephraim, 601 F. Supp. 3d at 1275. First, Defendants’ § 1407 Motion is fully briefed and has been set for oral argument before the JPML on January 25, 2024. See In re: Fortra FileTransfer Software Data Sec. Breach Litig., MDL No. 3090, ECF Nos. 77; 78. Consequently, Plaintiffs will not be prejudiced by a brief stay of discovery in this action, considering the JPML is due to resolve the subject motion for transfer in just over a month. Further, this action is still in its relative infancy, given that the MTD has only been ripe since December 4, 2023, thereby “‘minimizing any potential prejudice to the Plaintiff[s] from a stay.” Ephraim, 601 F. Supp. 3d at 1276 (quoting Ali, 2022 WL 713665 , at *2). And to the extent Plaintiffs maintain that their data is at continuing risk to third-party hackers and delaying discovery will prolong this risk, see Surreply at 8, the Court once again disagrees. Plaintiffs fail to allege or explain how any of the legal or equitable remedies they seek in their Amended Complaint will reduce the risk of further penetration into Fortra’s systems, which were the target of the cyberattack that gave rise to this entire family of lawsuits. In other words, a temporary stay of discovery here will not increase the likelihood that Plaintiffs’ data will be subject to further exploitation, given that Fortra was the target of the attack. Second, Defendants would be prejudiced if a brief stay is not issued. “The purpose of a multidistrict litigation (“MDL”) is to coordinate and consolidate pretrial proceedings ‘for the convenience of parties and witnesses and [to] promote the just and efficient conduct of such actions.” Id. (quoting 28 U.S.C. § 1407 (a)). Accordingly, a brief stay of discovery pending the JPML’s decision In re: Fortra FileTransfer Software Data Sec. Breach Litig., MDL No. 3090, will “eliminate[ ] the possibility of inconsistent rulings and duplicative litigation.” Id.; see also Reply at 10–11. This need to ensure uniformity also rebuts Plaintiffs’ charge that Defendants’ § 1407 Motion is an attempt at forum shopping. Surreply at 8. Indeed, a nationwide class action data breach involving numerous defendants and the data of an estimated 3,000,000 victims across 14 states is a viable candidate for consolidation by the JPML. Apart from the collection of cases currently pending before this Court, litigation is ongoing concerning the same data breach in federal district courts across the country, with a significant portion of such activity centered in the District of Minnesota. See Reply at 11. Accordingly, the possibility of duplicative litigation and potentially inconsistent rulings here is high, a factor further weighing in favor of granting a stay of discovery pending the JPML’s ruling. Third, judicial resources would be best served by a brief stay of discovery pending a transfer decision by the JPML. “While not certain, it is reasonable to assume that this case will eventually be transferred to MDL proceedings. The JPML has routinely consolidated similar cases arising out of data security breaches.” Gray v. Target Corp., No. 13-62769, 2014 WL 12600138 , at * (S.D. Fla. Jan. 27, 2014) (collecting cases); see also Toback v. GNC Holdings, Inc., No. 1380526, 2013 WL 5588251 , at *1 (explaining that in determining whether to stay proceedings while a motion to consolidate is pending before the JPML, “[t]he Court may also consider whether it believes a consolidation order is likely.”) (citing Manual for Complex Litigation § 22.35 (4th ed. 2004); Giles v. POM Wonderful LLC, No. 10-61684, 2010 WL 4630325 , at *2 (S.D. Fla. Nov. 8, 2010)). Judicial economy would especially benefit from a brief stay here, as consolidation would have a profound impact on the scope and parameters of discovery given common questions of law and fact faced by numerous potential defendants. In sum, upon careful consideration of each of the foregoing factors, the Court is satisfied that the circumstances presented by the pending § 1407 Motion provide additional, independent grounds warranting a stay of discovery. CONCLUSION Defendants have established the necessity, appropriateness, and reasonableness of a temporary stay of discovery in this matter given the standing and pleading sufficiency challenges set forth in their MTD. Further, Defendants’ pending § 1407 Motion, which is fully briefed and currently set for oral argument before the JPML, provides additional grounds for a stay. To be clear, such a stay is merely designed to prevent extensive discovery from going forward until the Court is able to more fully evaluate the viability of Plaintiffs’ claims. Accordingly, based on the foregoing, it is hereby ORDERED AND ADJUDGED that Defendants’ Motion to Stay Discovery Pending Ruling on Motion to Dismiss Plaintiffs’ Consolidated Class Action Complaint, [ECF No. 60], is GRANTED. Discovery is hereby STAYED until further order of the Court. DONE AND ORDERED in Miami, Florida, this 15th day of December, 2023 UNITED STATES DISTRICT JUDGE Page 12 of 12