Axis Insurance Company v. Barracuda Networks, Inc.Axis Insurance Company v. Barracuda Networks, Inc.
GORTON, J.
This case arises out of a 2018 data breach that compromised the protected health information of more than 277,000 patients of Zoll Services LLC, a subsidiary of Zoll Medical (together, “Zoll“). Pending before the Court is the motion of defendant Barracuda Network, Inc. (“Barracuda“) for summary judgment on three claims, which survived a motion to dismiss, brought by plaintiff Axis Insurance Co. (“Axis“), as assignee of Zoll and subrogee of Fusion LLC (“Fusion“). For the reasons that follow, the motion will be allowed.
I. Background
This Court has recited the lengthy and complex background of this action in its prior memoranda and orders. See, e.g., Axis Ins. Co. v. Barracuda Networks, Inc., No. CV 20-11997-NMG, 2024 WL 3458143, at *1 (D. Mass. July 17, 2024); Axis Ins. Co. v. Barracuda Networks, Inc., No. CV 20-11997-NMG, 2023 WL 2838380, at *1-*2 (D. Mass. Apr. 7, 2023). The following addresses only the background relevant to the pending motion.
A. Factual Background
Fusion sells hosted business communications products. In 2012, a company that is now a subsidiary of Fusion entered into an Original Equipment Manufacturer (“OEM“) agreement with a company that has since merged with Barracuda. The OEM agreement provided for customer communications and email management software and related services. At approximately the same time, Fusion entered a Hosting Services Agreement (“HSA“) with Zoll that would provide Zoll with cloud-based messaging software and services for electronic messages and email communications.
In 2018, a Barracuda employee allegedly left a data port in its system open during a standard data migration in its network. In
B. Procedural Background
In 2020, Zoll filed an action against Barracuda in this Court, asserting claims for negligence, breach of implied warranties, breach of contract, and equitable indemnification. Fusion was allowed to intervene in this case under
Pursuant to a previous arbitration settlement, any claims Zoll and Fusion had against Barracuda in connection with the data breach were assigned to Axis. Axis, the only remaining party in interest, was substituted as plaintiff in 2022, at which time Fusion and Zoll were dismissed as parties.
Now, Barracuda moves for summary judgment against Axis under
III. Motion for Summary Judgment
Under
A. Equitable Indemnification
Barracuda first asserts that Zoll‘s equitable indemnification claim fails as a matter of law because Zoll lacks a “special relationship” with Barracuda and, alternatively, because Zoll is a party at fault and therefore lacks “clean hands” to seek equitable indemnification.
A valid claim of indemnification can arise under Massachusetts law in one of three circumstances: 1) where there is an express contractual agreement to indemnify, 2) where an agreement to indemnify can be “implied from the nature of the relationship between the parties,” or 3) where there is “a tort based right to indemnification” based on “a great disparity in the fault of the parties.” Araujo v. Woods Hole, Martha‘s Vineyard, Nantucket S.S. Auth., 693 F.2d 1, 2 (1st Cir. 1982). The claim at issue concerns only the third circumstance, a tort-based, or equitable, right of indemnification.
Equitable indemnification allows a party “who is without fault, compelled by operation of law to defend himself against the wrongful act of another, to recover from the wrongdoer the entire amount of
Here, nothing in the record suggests that Zoll and Barracuda shared any relationship recognized under Massachusetts law as giving rise to derivative or vicarious liability. The relationship at issue between Zoll and Barracuda can best be described as one of an independent contractor. As Barracuda contends, the OEM agreement between the parties established that Zoll operated as an independent contractor, not as an agent. While not dispositive, the inclusion of a provision that a party is an independent contractor is significant evidence that the parties’ relationship is as such. See Theos & Sons, Inc. v. Mack Trucks, Inc., 729 N.E.2d 1113, 1120 (Mass. 2000). Axis makes no claim that Zoll was anything more than an independent contractor to Barracuda.
Barracuda‘s status as an independent contractor with respect to Zoll fails to create derivative or vicarious liability to those with whom Barracuda contracts. See Lyon v. Morphew, 678 N.E.2d 1306, 1310 (Mass. 1997) (“In general, an employer of an independent contractor is not liable for harm caused to another by the independent contractor‘s negligence.“); see also Decker, 449 N.E.2d at 643 (holding that relationship between manufacturer and supplier of equipment does not give rise to vicarious or derivative liability necessary for equitable indemnification claim). Axis makes no claim that derivative liability exists here even in spite of the independent contract status. Cf. Lyon, 678 N.E.2d at 1310 (stating independent contractor status can give rise to derivative liability where there is evidence of employer control over independent contractor).
Axis likewise does not contend that Barracuda shared with Zoll any other form of recognized relationship that would create the derivative or vicarious liability necessary for a viable equitable indemnification claim. See Leonard v. Lumbermens Mut. Cas. Co., 10 N.E.2d 469, 470 (Mass. 1937) (recognizing existence of derivative liability based on agency relationship); see also Hollywood Barbecue Co. v. Morse, 50 N.E.2d 55, 56 (Mass. 1943) (recognizing derivative liability arising from master-servant relationship); Tenedios v. Wm. Filene‘s Sons Co., 20 Mass. App. Ct. 252, 257, 479 N.E.2d 723, 727 (1985) (recognizing derivative liability based on employer and employee relationship); accord McGuire v. Reilly, 271 F. Supp. 2d 335, 342 (D. Mass. 2003), aff‘d, 386 F.3d 45 (1st Cir. 2004) (stressing that summary judgment is “appropriate” where “the nonmoving party fails to show the existence of a genuine issue of material fact” in record).
Because the absence of a relationship that would legally give rise to vicarious or derivative liability negates Axis‘s equitable indemnification claim, the Court need not address Barracuda‘s argument that Axis cannot recover because Zoll lacked “clean hands.”2 While the Court previously determined that Zoll had sufficiently pled that its fault was “vicarious in nature” at the motion to dismiss stage, Zoll Med. Corp. v. Barracuda Networks, Inc., 565 F. Supp. 3d 101, 110 (D. Mass. 2021), the absence of evidence of such a relationship that would give rise to vicarious or derivative liability at the summary judgment stage is dispositive. See Chapman v. Bernard‘s Inc., 198 F.R.D. 575, 579 (D. Mass. 2001) (allowing summary judgment on equitable indemnification claim because would-be indemnitor was “not an agent of [indemnitee], nor d[id] it have a relationship . . . from which it could be held vicariously or derivatively liable for the actions of [indemnitor]” and therefore [indemnitee] was “not entitled to indemnification from [indemnitor] under any circumstances.“); see also Walter & Shuffain, P.C. v. CPA Mut. Ins. Co. of Am. Risk Retention Grp., 660 F. Supp. 2d 116, 126 (D. Mass. 2009) (dismissing equitable indemnification claim because nonmoving party “ha[d] not alleged any facts establishing a relationship . . . that would give rise to vicarious or derivative liability“).
B. Breach of Contract
Barracuda next contends that Fusion‘s breach of contract claim fails as a matter of law because Axis cannot prove that Barracuda waived the conditions precedent in the OEM agreement, which this Court previously determined Fusion failed to fulfill. One such condition required Fusion to include limitation of liability and indemnification provisions in its customer contracts.
Under Massachusetts law, a contractual condition precedent is “an event [that] must occur before a contract becomes effective or before an obligation to perform arises.” Sands v. Ridefilm Corp., 212 F.3d 657, 661-62 (1st Cir. 2000). If a condition precedent is not satisfied, the contract and the obligations therein cannot be enforced. Mass. Mun. Wholesale Elec. Co. v. Town of Danvers, 577 N.E.2d 283, 288 (Mass. 1991).
It is well settled that conditions precedent can be waived. See Millen Indus., Inc. v. Flexo-Accessories Co., 5 F. Supp. 2d 72, 74 (D. Mass. 1998) (“A condition precedent in favor of one of the parties may be waived by that party.“). Waiver occurs when a party voluntarily relinquishes a known right. Bos. Helicopter Charter, Inc. v. Augusta Aviation Corp., 767 F. Supp. 363, 372 (D. Mass. 1991). A waiver is voluntary if the party either expressly or impliedly manifests intent to surrender a right and no other reasonable explanation exists for that surrender, which requires “clear, decisive and unequivocal conduct.” Bachoroz v. Miller-Forslund, 703 F.3d 27, 32-33 (1st Cir. 2012); Paterson-Leitch Co. v. Mass. Mun. Wholesale Elec. Co., 840 F.2d 985, 992 (1st Cir. 1988) (emphasis omitted). Silence, generally, is insufficient to support waiver. Dunkin’ Donuts Inc. v. Panagakos, 5 F. Supp. 2d 57, 61 (D. Mass. 1998).
Determining “[w]hether a condition precedent has been waived” is usually “a question of fact.” Millen Indus., Inc., 5 F. Supp. 2d at 74; see Wildlands Tr. of Se. Mass., Inc. v. Cedar Hill Retreat Ctr., Inc., 160 N.E.3d 297, 305 n.12 (Mass. App. Ct. 2020). Here, the facts are clear that the subject OEM agreement contains an anti-waiver provision stating that No failure or delay of [Barracuda] in exercising any right or remedy under this [OEM a]greement shall operate as a waiver of such right.
Although this provision may serve as evidence that inaction by Barracuda does not constitute waiver, the existence of an anti-waiver provision under Massachusetts law is “not dispositive,” and it remains a question of fact whether waiver has in fact occurred. Wildlands, 160 N.E.3d at 305 n.12.3
Barracuda contends that no evidence demonstrates a clear and unequivocal intent to waive the OEM‘s condition precedent to overcome this operative provision. Axis posits that Barracuda has failed to act on its right to audit Fusion‘s customer contracts, a right it claims Barracuda held under the terms of the OEM agreement. Silence alone does not, however, preclude Barracuda from summary judgment on this claim. See Dunkin’ Donuts Inc., 5 F. Supp. 2d at 61 (“[I]t is doubtful that mere silence could satisfy [the] burden of establishing clear, decisive, and unequivocal conduct.” (internal quotations omitted)); cf. KACT, Inc. v. Rubin, 819 N.E.2d 610, 616 (Mass. App. Ct. 2004) (finding waiver where party “did more than remain silent“). Without more, evidence of Barracuda‘s inaction and lack of inquiry as to its rights under the condition is insufficient to raise a dispute of fact as to whether Barracuda‘s conduct showed a clear, unequivocal intent to waive. Cf. J.H. Lynch & Sons, Inc. v. Shaw‘s Supermarkets, Inc., No. CV 05-12445-JGD, 2008 WL 11388729, at *8 (D. Mass. Feb. 15, 2008) (finding allegations of waiver sufficient to survive summary judgment where evidence showed party actively approved payment agreements despite condition precedent to the contrary).
Nevertheless, Axis claims Barracuda cannot rely on waiver to defeat the breach of contract claim under the doctrine of equitable estoppel, based on Barracuda‘s failure to inquire about whether Fusion was in compliance. To invoke equitable estoppel, Axis must establish that Barracuda made a representation that was intended to induce a course of conduct by Fusion and that Fusion did reasonably rely on that conduct to its detriment. Dunkin’ Donuts Inc., 5 F. Supp. 2d at 62 (“Although estoppel can be based on mere silence, that is true only where there is a duty to speak . . . .“). Axis, however, has not shown that Barracuda was duty-bound to inquire whether Fusion was complying with the condition precedent rather than
C. Breach of Covenant
Finally, Barracuda claims Axis is unable to prove its claim of breach of the covenant of good faith and fair dealing because it impermissibly seeks to expand Barracuda‘s obligations under the contract.
Every contract governed under Massachusetts law contains an implied covenant of good faith and fair dealing. Ayash v. Dana-Farber Cancer Inst., 822 N.E.2d 667, 683 (Mass. 2005). That covenant reflects an implicit condition that neither party “shall do anything that will have the effect of destroying or injuring the right of the other party to receive the fruits of the contract.” Galvin v. U.S. Bank Nat. Ass‘n, No. CIV.A. 14-14723, 2015 WL 1014549, at *4 (D. Mass. Mar. 9, 2015) (citing Anthony‘s Pier Four, Inc. v. HBC Assocs., 583 N.E.2d 806 (Mass. 1991)), aff‘d sub nom. Galvin v. U.S. Bank, N.A., 852 F.3d 146 (1st Cir. 2017). To show breach of covenant, a plaintiff must demonstrate that “there existed an enforceable contract between the two parties” and “the defendant did something that had the effect of destroying . . . the right of [the plaintiff] to receive the fruits of the contract.” Laser Labs, Inc. v. ETL Testing Lab‘ys, Inc., 29 F. Supp. 2d 21, 24 (D. Mass. 1998) (internal quotations omitted). Thus, the covenant cannot be used to “create rights and duties not otherwise provided for in the existing contractual relationship.” Ayash, 822 N.E.2d at 684 (quotations omitted); see MacKenzie v. Flagstar Bank, FSB, 738 F.3d 486, 493 (1st Cir. 2013) (“The concept of good faith is shaped by the nature of the contractual relationship and the scope of the covenant is only as broad as the contract . . . .” (quotations omitted)).
Allegations that a party breached the covenant of good faith and fair dealing is “ordinarily a question of fact to be determined by the jury.” Wilder v. Toyota Fin. Servs. Americas Corp., 764 F. Supp. 2d 249, 259 (D. Mass. 2011). This case, however, presents an exception. Because the covenant of good faith cannot be used to create rights that do not exist in the contractual relationship, see Ayash, 822 N.E.2d at 684, Axis must demonstrate some contractual right to which Fusion is entitled in the event of a data breach. No evidence of such was produced during discovery. As Barracuda articulates, its OEM agreement with Fusion contains no provision regarding any actions that must be taken in response to a data breach.4 As such, Axis cannot rely on an implied duty of good faith to create a new obligation where one does not exist under the terms of their agreement. See Lohnes v. Level 3 Commc‘ns, Inc., 272 F.3d 49, 62 (1st Cir. 2001) (holding that defendant did not violate covenant of good faith by failing to provide notice of a stock split because defendant was “not contractually bound to provide the appellant with individualized notice of the stock split“).
That the breach of covenant claim rests mainly on Barracuda‘s alleged inaction further demonstrates why the claim cannot survive a motion for summary judgment. Inaction constitutes “a lack of good faith . . . only when the contracting party had a duty to act,” and no such duty exists under this agreement. Uno Rests., Inc. v. Bos. Kenmore Realty Corp., 805 N.E.2d 957, 965 (Mass. 2004). In response, Axis makes no attempt to refute
ORDER
For the foregoing reasons, the motion of defendant, Barracuda Networks, Inc., for summary judgment is ALLOWED.
So ordered.
/s/ Nathaniel M. Gorton
Nathaniel M. Gorton
United States District Judge
Dated: September 9, 2024