In re Accellion, Inc. Data Breach Litigation

Background

Grace Beyer moved under Federal Rule of Civil Procedure 42(a) to consolidate current and future related proposed class actions arising from the December 2020 Accellion data breach. The motion also requested an abbreviated briefing schedule for applications to appoint interim co-lead class counsel under Rule 23(g). Accellion supported the motion, while plaintiffs in three related cases opposed aspects of it.

The opinion identified 15 related cases. Nine named Accellion as the only defendant, and six also named one or more Accellion clients. The cases alleged that unauthorized third parties exploited vulnerabilities in Accellion’s file-transfer software and accessed personal identifying information or other sensitive information. The alleged claims included negligence, invasion of privacy, consumer-protection violations, and data-privacy-law violations.

Court’s Analysis

Rule 42(a) permits consolidation when cases before the court share common questions of law or fact. The court found that the Accellion-only cases involved substantially similar factual and legal issues, were at the same procedural stage, and would involve parallel discovery. It also found no apparent basis to conclude that consolidation would cause undue inconvenience, delay, or expense.

The court rejected the argument that the six cases also naming Accellion clients should proceed separately. Although those cases presented client-specific issues, the court concluded that the issues concerning Accellion were the same across the cases. It further reasoned that the clients’ conduct and potential responsibility would be relevant even in cases naming only Accellion. Consolidating the cases would avoid duplicative discovery, pretrial motions, class-certification filings, and case-management work.

The court included the Accellion Client Cases in the consolidation except for Cochran v. The Kroger Co. and Accellion, Inc., No. 5:21-cv-01887-EJD. The court deferred the consolidation decision for that case because it was scheduled to consider a motion for final approval of a class-action settlement on March 24, 2022.

Order

The court granted the Motion to Consolidate. The Clerk was ordered to consolidate 14 listed case numbers under master file number 21-cv-01155-EJD and close the other listed case files. The consolidated matters were assigned the caption “In re Accellion, Inc. Data Breach Litigation, Case No. 21-cv-01155-EJD.” The order stated that consolidation did not add any person or entity as a party to an action where that person or entity had not been named, served, or added under the Federal Rules of Civil Procedure, and that it did not waive claims or defenses.

The order established procedures for a master docket, filing and service, attorney appearances, preservation of evidence, and notifying the court about subsequently filed or transferred related actions. Parties were directed to preserve relevant evidence, including electronically stored information. The court separately ordered all parties to meet and confer and submit a proposed briefing schedule for applications to appoint interim co-lead class counsel within 10 days of the order. The opinion did not decide the merits of the underlying data-breach claims or whether interim co-lead counsel should be appointed.