In re FedEx Corp. Securities Litigation

Background

Lead Plaintiff City of Bradford Metropolitan District Council, acting as administering authority for the West Yorkshire Pension Fund, brought a proposed class action against FedEx Corporation and several current and former officers. The complaint asserted securities-fraud claims under Section 10(b) of the Securities Exchange Act of 1934, Securities and Exchange Commission Rule 10b-5, and Section 20(a), as well as a claim under Item 303 of Regulation S-K.

The claims concerned the June 2017 NotPetya cyberattack on TNT Express Services B.V., a European shipping subsidiary FedEx had acquired. West Yorkshire alleged that, between September 19, 2017, and December 18, 2018, FedEx and its officers misled investors about the attack’s effects on TNT’s operations, customers, revenue, integration with FedEx, and FedEx’s target of increasing FedEx Express operating income by $1.2 billion to $1.5 billion in fiscal year 2020 compared with fiscal year 2017. The complaint also alleged that FedEx failed to disclose known trends or uncertainties concerning the attack’s effects.

The defendants moved to dismiss under Federal Rules of Civil Procedure 8(a), 9(b), and 12(b)(6), the rule addressing whether a complaint adequately states a legal claim, and under the heightened pleading requirements of the Private Securities Litigation Reform Act.

Falsity and misleading statements

The court held that the complaint did not adequately allege that FedEx’s statements were false or misleading when made. It considered the challenged statements in their full context, including FedEx’s contemporaneous reports and public disclosures. Those disclosures acknowledged the attack’s financial impact, reduced TNT shipping volumes, continuing recovery efforts, increased integration costs, risks of customer loss, and the possibility that the integration might take longer or cost more than expected.

The court rejected the allegations concerning four groups of statements:

1. Operating-income target. The court concluded that the allegations did not show that FedEx’s continued commitment to the long-term income target was false when stated. The target depended on more than TNT’s performance, and the complaint did not establish that the cyberattack alone made the target unrealistic. The court also ruled that the target statements were forward-looking statements protected by the Private Securities Litigation Reform Act’s safe harbor because they were accompanied by meaningful warnings about integration risks. The complaint did not adequately allege that the individual defendants actually knew the projections were false when made.

2. Restoration of TNT operations. The court concluded that the complaint’s allegations about a six-month disruption did not contradict FedEx’s carefully qualified statements that most services had resumed, critical systems had been restored, or operations were near normal. FedEx had disclosed the continuing effects of the attack and did not represent that all recovery work had finished earlier than the complaint’s alleged timeline.

3. Retention of TNT customers. The court found that FedEx had disclosed losses in customers and shipping volume, including the attack’s estimated revenue impact and negative effects on service mix. The confidential witness’s allegation that TNT lost about 10% of its high-margin business did not identify when the losses occurred or show that FedEx’s statements that it retained a significant portion of its customer base were inconsistent with that allegation.

4. TNT integration. The court found that the complaint confused accelerating efforts to complete the integration with progress in completing it. FedEx had disclosed that it was accelerating integration work because of the attack and that this would increase costs. The court also characterized broad statements that integration was progressing well as non-actionable optimism, and found that the complaint lacked factual allegations concerning the integration of the global sales force.

Scienter

Scienter means the required state of mind for securities fraud, such as knowing falsity or reckless disregard for whether a statement was misleading. The court held that the complaint did not plead scienter with the required particularity or create a strong inference of it.

The complaint alleged generally that the individual defendants knew the true facts because of their senior positions and access to company information. But it did not identify what information they received, when they received it, or how it contradicted their public statements. The confidential witness did not implicate the individual defendants or provide facts showing that they knew the statements were inaccurate. The court therefore found the allegations too speculative. The lack of adequately pleaded scienter provided an additional basis for dismissing the Section 10(b) claims.

Other claims

The Section 20(a) claims asserted control-person liability against the individual defendants. Because the complaint did not adequately plead a primary Section 10(b) violation, the court dismissed the Section 20(a) claims as well.

The Item 303 claim alleged that FedEx failed to disclose the material effects and expected continuing effects of NotPetya. The court stated that, even assuming FedEx’s disclosures were insufficient, the Item 303 claim still failed because the complaint did not adequately plead scienter, which the court said was required for the claim to be actionable under Section 10(b).

Disposition

Judge Ronnie Abrams granted the defendants’ motion to dismiss the complaint with prejudice. The court denied West Yorkshire’s request for leave to amend, finding amendment futile because the proposed additional details would not change the conclusion that the challenged statements were not plausibly false or misleading without new facts contradicting FedEx’s public statements. The Clerk was directed to terminate the motion and close the case.