749 F.Supp.3d 222
D. Mass.2024Background
- The case arises from a 2018 data breach compromising the protected health information of over 277,000 patients of Zoll Services LLC (“Zoll”).
- The breach resulted when a Barracuda Networks employee allegedly left a data port open, allowing unauthorized access for about seven weeks.
- Fusion LLC contracted with Barracuda (via an OEM agreement) for email management software, and separately, Fusion contracted with Zoll for messaging services.
- Following the breach, Zoll sued Barracuda for several claims; Fusion intervened with additional claims.
- Claims from Zoll and Fusion were later assigned to Axis Insurance, which became the sole plaintiff.
- Barracuda moved for summary judgment on the three remaining claims: equitable indemnification, breach of contract, and breach of the covenant of good faith and fair dealing.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Equitable indemnification (tort-based) | Axis (as Zoll’s assignee) argues Barracuda should indemnify Zoll for losses caused by Barracuda’s breach. | Barracuda asserts there is no relationship (e.g., agency or vicarious liability) supporting indemnification. | Court held in favor of Barracuda; no vicarious or derivative liability. |
| Breach of contract (condition precedent) | Axis argues Barracuda waived conditions precedent (like contract terms between Fusion and its customers) or should be estopped from asserting them. | Barracuda asserts it did not waive the conditions; silence/inaction is insufficient for waiver or estoppel. | Court held in favor of Barracuda; no waiver or estoppel—no genuine factual dispute. |
| Breach of covenant of good faith and fair dealing | Axis alleges Barracuda’s conduct post-breach breached implied contractual duties. | Barracuda asserts the contract contains no duty regarding data breach response; duty cannot be implied here. | Court held for Barracuda; the implied covenant cannot create obligations beyond the contract. |
Key Cases Cited
- Anderson v. Liberty Lobby, Inc., 477 U.S. 242 (standard for summary judgment)
- Fireside Motors, Inc. v. Nissan Motor Corp. in U.S.A., 479 N.E.2d 1386 (Mass. 1985) (equitable indemnification foundation)
- Santos v. Chrysler Corp., 715 N.E.2d 47 (Mass. 1999) (standard for equitable indemnification)
- Theos & Sons, Inc. v. Mack Trucks, Inc., 729 N.E.2d 1113 (Mass. 2000) (effect of independent contractor agreements)
- Sands v. Ridefilm Corp., 212 F.3d 657 (1st Cir. 2000) (condition precedent definition and enforcement)
- Ayash v. Dana-Farber Cancer Inst., 822 N.E.2d 667 (Mass. 2005) (scope of implied covenant of good faith)
- Uno Rests., Inc. v. Bos. Kenmore Realty Corp., 805 N.E.2d 957 (Mass. 2004) (inaction as breach of covenant only if duty exists)