Anderson v. Fortra LLC

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA Valerie Anderson et al., individually and Case No. 23-cv-533 (SRN/DTS) on behalf of all others similarly situated, Plaintiff, ORDER v. Fortra LLC, Defendant. Bryan L. Bleichner, Christopher P. Renz, and Philip Joseph Krzeski, Chestnut Cambronne PA, 100 Washington Avenue South, Suite 1700, Minneapolis, MN 55401, for all Plaintiffs; Joseph M. Lyon, Lyon Firm, 2754 Erie Avenue, Cincinnati, OH 45208, for Plaintiff Valerie Anderson; Brian C. Gudmundson, Michael J. Laird, and Rachel Kristine Tack, Zimmerman Reed PLLP, 1100 IDS Center, 80 South Eighth Street, Minneapolis, MN 55402, for Plaintiffs Robert Taylor, Tara Hartzel Vancosky, Iraida Gonzalez, and Linda Caudill; Danielle Lynn Perry, Gary E. Mason, and Lisa A. White, Mason LLP, 5335 Wisconsin Avenue NW, Suite 640, Washington, DC 20015, for Plaintiff Robert Taylor; Jeffrey S. Goldenberg, Goldenberg Schneider LPA, 4445 Lake Forest Drive, Suite 490, Cincinnati, OH 45242, for Plaintiffs Alauntae Butts, Brett Yonally, Edward Hubler, Iraida Gonzalez, Linda Caudill, Marquese York, Muhammed Zahid, Robert Taylor, and Tara Hartzel Vancosky; Daniel E. Gustafson, David A. Goodwin, and Joseph Nelson, Gustafson Gluek PLLC, 120 South Sixth Street, Suite 2600, Minneapolis, MN 55402, for Plaintiffs Alauntae Butts, Marquese York, and Muhammed Zahid; Aaron R. Thom and Samantha Ellingson, Thom Ellingson, PLLP, 45 South Seventh Street, Suite 2610, Minneapolis, MN 55402, and Bart Cohen, Bailey & Glasser LLP, 1210 Prospect Hill Road, Villanova, PA 19085, for Plaintiff Brett Yonally; Anne T. Regan and Nathan D. Prosser, Hellmuth & Johnson PLLC, 8050 West 78th Street, Edina, MN 55439, and Dylan J. Gould and Terence Coates, Markovits, Stock & DeMarco, LLC, 119 E. Court Street, Suite 530, Cincinnati, OH 45202, for Plaintiff Edward Hubbler; Gary M. Klinger, Millberg Coleman Bryson Phillips Grossman PLLC, 227 W. Monroe Street, Suite 2100, Chicago, IL 60606, for Plaintiff Muhammed Zahid; Kenneth Jay Grunfeld, Kopelowitz Ostro Ferguson Weiselberg Gilbert PA – Pennsylvania, 65 Overhill Road, Bala Cynwyd, PA 19004, for Plaintiff Iraida Gonzalez; and, Danyll Foix, Gilbert S. Keteltas, Kyle T. Cutts, Lisa Ghannoum, and Mary Pat Brogan, Baker & Hostetler, LLP, 1050 Connecticut Avenue NW, Suite 1100, Washington, DC 20036, for Defendant Fortra LLC. SUSAN RICHARD NELSON, United States District Judge This matter is before the Court on the Motion to Stay Proceedings [Doc. No. 74] filed by Defendant Fortra LLC (“Fortra”). The plaintiffs oppose the motion, and the matter has been fully briefed. Based on a review of the files, submissions, and proceedings herein, and for the reasons below, the Court grants the motion to stay. I. BACKGROUND This consolidated class action lawsuit stems from a targeted cyberattack committed against Fortra in January, 2023. (Cons. Compl. [Doc. No. 50] ¶ 2.) Fortra is a Minnesotabased company that provides information technology management software and services, including cybersecurity and data conversion services, to customers worldwide. (Id. ¶ 3.) The cyberattack resulted in a data breach, through which the hackers gained unauthorized access to the information of 130 of Fortra’s customers. (Id. ¶ 2.) Fortra’s customers include banks, healthcare providers, healthcare benefits administrative service providers, and other companies that maintain the sensitive data of individual clients. (See generally id.) The information accessed through the data breach included the plaintiffs’ personally identifiable information (“PII”), which had been shared with Fortra’s various customers. (Id. ¶ 2.) The hackers, alleged to be the Clop ransomware group or a related group, used a managed-file transfer tool developed by Fortra—GoAnywhere MFT—to remotely access the servers of Fortra’s customers. (Id. ¶ 7.) Over the course of ten days, the group was able to steal massive amounts of private client and consumer data stored on the compromised servers. (Id. ¶ 7.) The plaintiffs brought suit against Fortra, alleging that Fortra owed and otherwise assumed common law, contractual, and statutory duties to keep the plaintiffs’ PII safe, secure, confidential, and protected from unauthorized access and disclosure. (Id. ¶ 6.) The plaintiffs argue that Fortra breached these duties by developing unsafe and unprotected tools for the remote access of data, and by implementing inadequate data security measures and protocols to protect their PII. (Id. ¶ 7.) The consolidated complaint alleges three causes of action on behalf of the entire class of plaintiffs: (1) a claim for negligence, (2) a claim for negligence per se, and (3) a claim seeking a declaratory judgment. (Id. ¶¶ 282–311.) A sub-class of the plaintiffs domiciled in California allege three additional causes of action: (1) a claim for violations of the California Consumer Records Act, (2) a claim for violations of California’s Unfair Competition Law, and (3) a claim for violations of the California Consumer Privacy Act. (Id. ¶¶ 312–47.) On July 14, 2023, Fortra filed a motion to dismiss the consolidated class action complaint for lack of standing and failure to state a claim. (Mot. to Dismiss [Doc. No. 51].) The motion was fully briefed, and the Court heard argument at a hearing on October 11, 2023. That motion remains under advisement. Individuals, situated similarly to the plaintiffs in this case, have initiated lawsuits against Fortra’s customers around the country related to the same underlying data breach. Presently, the Court is aware of related pending consolidated cases in eight federal district courts: Rosa et al. v. Brightline, Inc., No. 3:23-cv-2132-WHA, in the Northern District of California; Rougeau v. Aetna Inc., No. 3:23-cv-635-VDO, in the District of Connecticut; Skurauskis et al. v. NationsBenefits Holdings, LLC, et al., No. 0:23-cv-60830-RAR, and companion case Skurauskis et al. v. Santa Clara Family Health Plan, No. 0:23-cv-61518RAR, in the Southern District of Florida; Shepherd v. Anthem Insurance Companies, Inc. et al., No. 1:23-cv-693-TWP-MG, in the Southern District of Indiana; In re Intellihartx Data Security Incident Litigation, No. 3:23-cv-1224-JRK, in the Northern District of Ohio; In re Imagine360, LLC Data Security Incident Litigation, No. 2:23-cv-2603-GEKP, in the Eastern District of Pennsylvania; Ross et al. v. Community Health Systems, Inc. et al., No. 3:23-cv-2128-JKM, in the Middle District of Pennsylvania; and Kuffrey et al. v. Community Health Systems, Inc. et al., No. 3:23-cv-285-WDC, in the Middle District of Tennessee. Fortra is not presently named as a party in any of the related actions. On October 16, 2023, NationsBenefits, LLC, a defendant in the Skurauskis litigation, moved the Judicial Panel on Multidistrict Litigation (JPML) to transfer and centralize all related actions in the District of Minnesota under 28 U.S.C. § 1407 . See In re Fortra File Transfer Software Data Security Breach Litigation, MDL No. 3090, Doc. No. 1. The Plaintiffs in this case took no position on the question of centralization, but argued that in the event of consolidation, the proceedings should be centralized before this Court. Id., Doc. No. 66. Fortra filed a response in support of the motion to transfer and centralize the actions. Id. Doc. No. 68. The motion has been fully briefed, and a hearing has been set for January 25, 2024. Id., Doc. No. 78. At the time of this writing, the status of the related dockets are as follows. In Rougeau, In re Intellihartx Data Security Incident Litigation, In re Imagine360, LLC Data Security Incident Litigation, and Kuffrey, all proceedings have been stayed pending the decision of the JPML. In the Skurauskis cases, the defendants moved to stay discovery in light of both the JPML proceedings and their own motion to dismiss, and the plaintiffs opposed. The district court issued an order staying discovery, finding that the circumstances warranted a stay on both grounds. See Skurauskis, 0:23-cv-60830-RAR, Doc. No. 75 (S.D. Fla. Dec. 15, 2023). In Rosa, the plaintiffs opposed a motion to stay discovery pending the JPML decision, and the parties jointly moved to continue a hearing on a pending motion to dismiss. The court held the defendants’ motion to stay in abeyance, and continued the motion to dismiss hearing to March 28, 2024. Rosa, 3:23-cv-2132-WHA, Doc. Nos. 65, 74 (N.D. Cal. Oct. 26, 2023, Dec. 21, 2023). In Shepherd, the district court has stayed discovery pending resolution of a motion to dismiss currently before it, without reference to the JPML proceedings. Finally, in Ross, the defendants filed two motions on January 12, 2024: a motion to dismiss and a motion to stay proceedings pending the JPML’s decision. Both motions remain pending. II. DISCUSSION “The power to stay proceedings is incidental to the power inherent in every court to control the disposition of the causes on its docket with economy of time and effort for itself, for counsel, and for litigants.” Cottrell v. Duke, 737 F.3d 1238, 1248 (8th Cir. 2013) (quoting Landis v. N. Am. Co., 299 U.S. 248, 254 (1936)). The district court thus has discretion to stay proceedings pending a decision on transfer and consolidation from the JPML. Blackmore v. Smitty’s Supply, Inc., 451 F. Supp. 3d 1003 , 1004 (N.D. Iowa 2020); see MULTIDIST LIT Rule 2.1(d) (“The pendency of a motion . . . does not affect or suspend orders and pretrial proceedings in any pending federal district court action and does not limit the pretrial jurisdiction of that court.”). When considering a motion to stay pending a decision from the JPML, district courts consider three factors: (1) the potential prejudice to the nonmoving party; (2) the potential hardship and inequity to the moving party if the case is not stayed; and (3) the potential stay’s impact on judicial resources. Kellogg v. Watts Guerra, LLP, No. 18-cv1082 (DWF/BRT), 2018 WL 3432048 , at *1 (D. Minn. July 16, 2018); also Ephraim v. Abbott Lab’ys, 601 F. Supp. 3d 1274 , 1275 (S.D. Fla. 2022); Blackmore, 451 F. Supp. 3d at 1004; Rivers v. Walt Disney Co., 980 F. Supp. 1358, 1360 (C.D. Cal 1997). The burden of establishing that a stay is appropriate lies with the party seeking the stay. Nken v. Holder, 556 U.S. 418 , 433–34 (2009). When civil actions involving one or more common questions of fact are pending in different districts, multidistrict litigation is meant to coordinate or consolidate pretrial proceedings for the convenience of parties and witnesses, and to promote the just and efficient conduct of such actions. See 28 U.S.C. § 1407 (a). Coordination is sometimes necessary to “avoid inconsistent pretrial rulings, and conserve the resources of the parties, their counsel and the judiciary.” Kellogg, 2018 WL 3432048 , at *1 (quoting In re Vioxx Prods. Liab. Litig., 360 F. Supp. 2d 1352, 1354 (J.P.M.L. 2005). Accordingly, district courts “frequently grant stays pending the JPML’s determination whether to consolidate and transfer cases.” Ephraim, 601 F. Supp. 3d at 1275; also Ritchie Capital Mgmt., LLC v. GE Capital Corp., 87 F. Supp. 3d 463 , 471 (S.D.N.Y. 2015) (“It is common for courts to stay an action pending a transfer decision by the JPML.”); Rivers, 980 F. Supp. At 1362 (observing that a majority of courts find it is often appropriate to stay pretrial proceedings pending a JPML decision). The Court first considers whether a stay would present any potential for prejudice to the plaintiffs in this case. As both parties note, the JPML is scheduled to hear this matter on January 25, 2024, and is expected to render its decision shortly thereafter. Accordingly, Fortra argues that any delay associated with a stay will be minimal and will not cause prejudice to the plaintiffs. While the plaintiffs allege that Fortra has already caused delays to the discovery process and cite caselaw observing that stays have the potential to damage the party opposed, they do not argue that a stay in this matter would cause them significant further harm. See Lessard v. Volkswagen Group of Am., Inc., No. 16-cv-574 (WMW/TNL), 2016 Wl 3004631 , at *1–2 (D. Minn. May 24, 2016) (observing that stays carry a potential for prejudice, but finding that the other factors outweigh the “minimal prejudice” that a stay would impose on the opposing party). Given the likely short duration of any stay in this matter, the Court finds that any associated potential for prejudice to the plaintiffs is minimal. The Court next considers the hardships likely to be borne by Fortra if a stay is denied in this case. Fortra argues that a stay would protect it from conducting duplicative discovery tasks, re-litigating discovery issues, and renegotiating discovery protocols with added parties in the event of centralization by the JPML. Responding to the plaintiffs’ requests for production now, rather than waiting to find out if discovery will be unified, could result in a costly and time consuming duplication of efforts for Fortra. Denial of a stay now would thus likely undermine the JPML’s goal to facilitate the convenient, just, and efficient conduct of a centralized action, should the action be centralized. See 28 U.S.C. § 1407 (a). The plaintiffs counter that the discovery efforts Fortra seeks to avoid now are merely the completion of basic preliminary discovery orders and a request for production of documents likely relevant to all potentially related actions. In other words, because Fortra would have to perform these tasks anyway, denying a stay now would not impose any hardship or inequity. Respectfully, while the plaintiffs may be correct that Fortra will ultimately have to engage in these discovery tasks either way, their argument somewhat misses the point. As one district judge noted in ruling on a motion to stay, this litigation involves the data of an estimated 3,000,000 victims across 14 states. Skuraskis, 0:23-cv- 60830-RAR, Doc. No. 75 (S.D. Fla. Dec. 15, 2023). In addition to there being numerous defendants, the plaintiffs in each of the ongoing cases differ and are represented by separate counsel. Any orders or agreements obtained in this case may have to be relitigated or renegotiated with the added parties, potentially with different results, an avoidable hardship that weighs in favor of staying the proceedings. Compare Lessard, 2016 WL 3004631 , at *2 (finding that absent a stay the parties would be required to duplicate efforts and waste resources), with Blackmore, 451 F. Supp. 3d at 1007 (finding a risk of duplicative discovery to be minimal where the parties are represented by the same counsel across all related cases). Finally, the Court must consider what impact, if any, a stay would have on judicial resources. As the plaintiffs point out, Fortra did not move for a stay until after its motion to dismiss this matter was fully briefed and taken under advisement. Thus, the Court is already familiar with the facts and law of this case, reducing the amount of judicial resources likely to be conserved through a stay. Cf. Kellogg, 2018 WL 3432048 , at *2 (noting that without a stay, the court risks expending significant resources familiarizing itself with the facts and the law of a case that will be heard in another court). The Court agrees that at first glance, a stay now would have little impact on the Court’s resources. That said, the motion to dismiss before this Court is not the only such matter pending. The district courts presiding over related cases in the Southern District of Indiana, the Middle District of Pennsylvania, and the Southern District of Florida also have motions to dismiss pending before them. As the district court observed in Blackmore, judicial economy concerns weigh in favor of having one court, rather than several, deciding motions. Id. In this case, even a brief stay might serve to avoid the potential for inconsistent or duplicative rulings on pending motions to dismiss. Imposing a stay in this matter “provides the opportunity for the uniformity, consistency, and predictability in litigation that underlies the multidistrict litigation system.” Calder v. A.O. Smith Corp., No. 04-cv-1481 (JRT/AJB), 2004 WL 1469370 , at *1 (D. Minn. June 1, 2004). The Court finds that the three factors on balance weigh in favor of granting a stay of all proceedings and deadlines in this case, pending the JPML’s decision on centralization and transfer. III. ORDER Based on the submissions and the entire file and proceedings herein, IT IS HEREBY ORDERED that: 1. The Motion to Stay Proceedings [Doc. No. 74] filed by Defendant Fortra LLC is GRANTED. 2. All proceedings and deadlines in this case are STAYED until the Judicial Panel on Multidistrict Litigation determines whether to centralize and transfer this action and completes any transfer of the action pursuant to 28 U.S.C. § 1407 . See In re: Fortra File Transfer Software Data Security Breach Litigation, MDL No. 3090. Dated: January 18, 2024 /s/ Susan Richard Nelson SUSAN RICHARD NELSON United States District Judge