In re Accellion, Inc. Data Breach Litigation
- Edward Davila
- 5:21-cv-01155
- U.S. District Court · Northern District of California
- 3
In Brown v. Accellion, Judge Davila denied Accellion’s motion to relate two cases involving different claims, facts, and trials.
Accellion, Inc.; the Brown plaintiffs and plaintiffs in the consolidated cases; and Ace American Insurance Company, whose separate case was not related to Brown.
What happened
In Brown v. Accellion, Accellion asked the court to treat a separate lawsuit by Ace American Insurance Company as related to Brown and other consolidated cases. The Ace American case involved cyber insurance coverage for a law firm after a ransomware attack, while Brown involved individuals whose personal information was exposed through an Accellion file-transfer system.
The court found that the cases involved different parties, legal claims, and facts. Ace American’s claims largely concerned a contract, including issues about liability limits and indemnification. Brown involved negligence and state consumer-protection claims based mainly on Accellion’s alleged failure to protect individuals’ personal information. The cases also requested different types of trials: a bench trial in Ace American and a jury trial in Brown.
Judge Edward J. Davila denied Accellion’s motion to relate the cases. The order addressed case management and whether the cases should proceed before the same judge; it did not decide the underlying claims.
The detailed version
- In re Accellion, Inc. Data Breach Litigation · No. 5:21-cv-01155
- Edward Davila
- Mar. 14, 2022
Background
Accellion, Inc. filed an administrative motion under Civil Local Rules 3-12(b) and 7-11(a) asking the court to relate Ace American Insurance Company v. Accellion, Inc., No. 4:21-cv-09615-YGR, to Brown v. Accellion, Inc., No. 5:21-cv-01155-EJD. A plaintiff in the Ace American case opposed the motion.
Under Civil Local Rule 3-12(a), cases are related when they concern substantially the same parties, property, transaction, or event, and when separate proceedings would likely cause an unnecessarily burdensome duplication of work or expense or create conflicting results.
Why the Court Found the Cases Were Not Related
The court rejected Accellion’s argument that the cases should be related because they involved the same general conduct. It identified several important differences.
First, the plaintiffs were not similarly situated. Ace American had provided cyber insurance to a Boston law firm and sought recovery after the firm paid a $2 million ransom following a ransomware attack. Accellion had provided software services to the law firm under a contract. By contrast, the Brown plaintiffs were individuals whose personally identifiable information was exposed after interacting with a third party that used Accellion’s file-transfer appliance. The Brown plaintiffs were not in direct contractual privity with Accellion.
Second, the claims differed. Brown and the consolidated cases asserted negligence and violations of state consumer-protection laws. Ace American asserted negligence, breach of contract, and three misrepresentation claims arising from transactions between Accellion and the law firm. Although both cases included negligence claims, the court found that they addressed different alleged conduct and would require different evidence. Ace American’s negligence allegations focused mainly on Accellion’s alleged failure to notify the law firm about a software patch, while Brown’s allegations focused mainly on the alleged failure to safeguard individuals’ personal information.
Third, the cases involved different facts and case-management issues. Ace American involved a long-standing relationship between Accellion and the law firm, a contract, and contractual limitation-of-liability and indemnification provisions. Brown involved a requested jury trial, while Ace American involved a requested bench trial. The court therefore found that the cases would require separate fact-finders.
Ruling
The court DENIED Accellion’s motion to relate the Ace American and Brown cases. It concluded that the cases could proceed before different judges without an undue burden or a significant risk of conflicting results. The order did not resolve the merits of the claims in either case.
Read the full 3-page opinion on CourtListener, the free public archive maintained by the Free Law Project.