In re Accellion, Inc. Data Breach Litigation

Background

Hackers breached Accellion’s File Transfer Appliance in December 2020 and January 2021. The application was used to transfer files that often contained sensitive personal information, including Social Security numbers, demographic information, and medical records. Plaintiffs alleged that the breaches exposed their information and caused injuries including identity theft and fraudulent credit charges.

This proposed class action originally included eleven claims. In an earlier order, the court mostly granted Accellion’s motion to dismiss, allowed the negligence claim to proceed, and dismissed the Confidentiality of Medical Information Act claim with leave to amend. Plaintiffs’ amended complaint included the negligence claim but did not renew the medical-information claim.

Motion to Dismiss the Negligence Claim

Accellion moved under Rule 12(b)(6), which permits dismissal when a complaint does not state a legally sufficient claim. Accellion challenged only whether the amended complaint adequately alleged a special relationship creating a duty of care under California law. The court rejected plaintiffs’ argument that the law-of-the-case doctrine barred the motion because an amended complaint is treated as a new complaint and must be assessed on its own merits.

The court nevertheless considered its earlier reasoning because it found the amended complaint substantially similar to the original complaint. California law identifies four factors relevant to a special relationship: dependence, control, a limited scope of people to whom the duty is owed, and benefits to the party owing the duty.

The court concluded that all four factors supported a special relationship. Plaintiffs depended on the security features of Accellion’s software because they could not personally secure their information when it was sent through the application. Accellion controlled the means of protection because it could issue patches for security vulnerabilities. The relationship was limited to people whose information the software transferred, even though their identities were not yet known. Finally, Accellion benefited commercially from providing the software.

The court therefore denied Accellion’s motion to dismiss the negligence claim. It deferred deciding choice-of-law issues because they were fact-intensive and better suited to a later stage of the case.

Motion for Reconsideration

Plaintiffs asked the court to reconsider its earlier dismissal of their Confidentiality of Medical Information Act claim. Reconsideration is an exceptional remedy generally available only for newly discovered evidence, clear error or manifest injustice, or an intervening change in controlling law. Plaintiffs relied on a recent California Court of Appeal decision, J.M. v. Illuminate Education, Inc.

The court determined that the decision did not justify reconsideration. The earlier dismissal under California Civil Code section 56.06(a) was based on insufficient allegations that Accellion was organized for the purpose of maintaining medical information, not on whether that purpose had to be the company’s sole purpose. The appellate decision therefore did not affect the basis for the earlier ruling.

The court also concluded that the appellate decision did not change its analysis under section 56.06(b). The earlier ruling determined that Accellion did not qualify as a covered health-care provider because it did not offer its software directly to individual consumers, and the later decision did not interpret the word “consumer” in that provision.

The court denied plaintiffs’ motion for reconsideration. It stated that this ruling also applied to plaintiffs’ accompanying request for leave to amend the medical-information claim, which the court did not address separately.