In re MOVEit Customer Data Security Breach Litigation

Oct 4, 2023
MDL No. 3083
Reporters:
, , , ,

TRANSFER ORDER

Before the Panel:* Plaintiff in the District of Minnesota Bailey action moves under 28 U.S.C. § 1407 to centralize this litigation regarding a vulnerability in a widely-used file transfer software in the District of Minnesota. Plaintiff‘s motion includes ten actions pending in five districts, as listed on Schedule A. Since the filing of the motion, the Panel has been notified of 91 related actions in 22 districts.1

The parties differ significantly as to whether we should create an MDL, what defendants should be included in that MDL, and where any MDL should be centralized. Plaintiffs in 33 actions and potential tag-along actions support centralization. The following defendants also support centralization: Progress Software Corp. and Ipswitch, Inc. (collectively, Progress); Pension Benefits Information, LLC, and Berwyn Group (collectively, PBI);2 Athene Annuity and Life Company; F&G Annuities & Life, Inc.; Genworth Financial, Inc.; Milliman, Inc. and Milliman Solutions, LLC; and Union Bank and Trust Company. Fidelity Investments Institutional Operations Company LLC and FMR LLC do not oppose centralization.

Several parties oppose centralization, and others oppose transfer of their cases or, more broadly, cases brought against certain defendants. Plaintiffs in the Northern District of California Berry/Ng action oppose centralization and, alternatively, request exclusion of their putative statewide class action from the MDL. Plaintiffs in the Eastern District of Virginia Harding, Hale, and Smith and the District of New Jersey Weissman potential tag-along actions oppose centralization; at oral argument, certain of these plaintiffs suggested that we create a limited-purpose MDL for discovery of claims against only Progress. Plaintiffs in the Eastern District of Virginia King and Manar potential tag-along actions oppose transfer of their actions. Plaintiffs in the District of Maryland Hunter and Gregory potential tag-along actions oppose transfer of cases against the Johns Hopkins defendants. Plaintiff in the Eastern District of Virginia Behrens potential tag-along action opposes centralization and, alternatively, suggests centralization in District of Minnesota for cases against only Progress and PBI. Defendant Illinois Department of Innovation and Technology opposes transfer of the Central District of Illinois Acevedo potential tag-along action, largely on Eleventh Amendment immunity grounds. The Johns Hopkins defendants3 in five District of Maryland potential tag-along actions oppose including the claims against them in any MDL and, alternatively, request separation and remand of the claims against them or, further, that actions in which they and Progress are defendants proceed in the District of Maryland. Plaintiffs in four Southern District of New York potential tag-along actions and Defendant Teachers Insurance and Annuity Association of America (TIAA) oppose inclusion of the cases against TIAA in any MDL. Plaintiffs in four potential tag-along actions against the Milliman defendants oppose inclusion of cases against Milliman in any MDL. Potential tag-along plaintiff in the District of Nebraska Jeanfort action opposes centralization of cases that do not exclusively name PBI or Progress as defendants. Potential tag-along plaintiffs in the District of Oregon Malo action oppose centralization of their claims against Performance Health Technology. Defendants Maximus, Inc. and Maximus Federal Services, Inc., oppose centralization (but take no position on creating an MDL involving only Progress) and, alternatively, request exclusion of cases against them from any MDL. Defendant Prudential opposes centralization and, alternatively, suggests separation and remand of the claims against it.

The parties variously, as their primary or alternative position, support centralization in one or more of the following districts: the Northern District of California, the Eastern District of Louisiana, the District of Massachusetts, the District of Minnesota, the District of Nebraska, and the Eastern District of Virginia. Certain parties ask that we create defendant-specific MDLs for their claims against Milliman entities, Maximus entities, Genworth Financial entities, and TD Ameritrade.

After considering the argument of counsel, we find that centralization of these actions in the District of Massachusetts will serve the convenience of the parties and witnesses and promote the just and efficient conduct of the litigation. All actions can be expected to share factual questions arising from allegations that a vulnerability in Progress Software Company‘s MOVEit Transfer and MOVEit Cloud file transfer services was exploited by a Russian cybergang in May 2023, which to date is estimated to have compromised the personally identifying information (PII)4 of over 55 million people. On May 31, 2023, Progress posted a notice on its website stating it had discovered an SQL injection vulnerability in its MOVEit file transfer services and a related breach in its network and systems. Plaintiffs are individuals whose PII was potentially compromised who bring largely overlapping putative nationwide or statewide class actions on behalf of persons impacted by the exploitation of the MOVEit software vulnerability. All actions can be expected to share common and complex factual questions as to how the MOVEit vulnerability occurred, the circumstances of the unauthorized access and data exfiltration, and Progress‘s response to it, as well as the response of various downstream MOVEit users and customer-facing defendants with whom plaintiffs did business. Centralization offers substantial opportunities to streamline pretrial proceedings; reduce duplicative discovery and conflicting pretrial obligations; prevent inconsistent rulings on common Daubert challenges and summary judgment motions; and conserve the resources of the parties, their counsel, and the judiciary.

Plaintiffs opposing transfer argue that, instead of a singular breach, there have been numerous successive intrusions into different servers, which weighs against centralization because multiple entities responded differently to the alleged intrusions and at least one entity to which plaintiffs had given their PII prevented the intrusion from occurring. This argument does not change the fact that the MOVEit vulnerability is at the core of all cases. Even if the MOVEit vulnerability led to successive breaches, Progress, direct users of MOVEit software, and customer-facing companies (many of whom did not use MOVEit software but instead contracted or subcontracted with a company that did) are alleged to be responsible for the compromise of plaintiffs’ PII and are named in varying combinations among the overlapping putative class actions. Disentangling the allegations against Progress (and, in many cases, direct users of MOVEit software like PBI and IBM) from the allegations against other defendants in the same case5 seems impracticable, if not impossible, under Section 1407(a).6 Highlighting the interconnectedness among defendants, defendants such as the Milliman entities have expressed their intent to bring third party claims against PBI and Progress in cases in which the plaintiffs have not named them. Although no single defendant is named in all cases, we are of the opinion that the parties can obtain significant efficiencies by placing all actions concerning the vulnerabilities in the MOVEit software before a single judge.

Plaintiffs opposing transfer and certain customer-facing defendants that seek exclusion of the claims against them argue that the Panel‘s decision denying centralization in In re Accellion, Inc., Customer Data Sec. Breach Litig., 543 F. Supp. 3d 1372, 1374 (J.P.M.L. 2021) should dictate the same result here. But Accellion is distinguishable. Accellion arose from a breach, over a period from mid-December 2020 into January 2021, of a “legacy” file transfer appliance that Accellion allegedly had encouraged its customers to discontinue using. Id. at 1374. Accellion also involved 26 cases – about a quarter of the 101 cases at issue here. Id. We denied centralization, in part, because most parties opposed centralization and the parties had largely self-organized, preferring to informally cooperate. Id. (“Most parties, including two defendants, oppose centralization, and have cooperated to organize all but two actions into three coordinated or consolidated proceedings...“). The parties here do not appear to be cooperating informally (which—with 101 total actions, numerous defendants, and 22 involved districts—may not be possible). While, as in Accellion, there may be allegations specific to each defendant‘s role in the breach of a particular plaintiff‘s data,7 this litigation—regardless of whether Progress is named as a defendant in a particular case—poses significant questions about Progress‘s role (and, in many cases, the role of direct users like PBI) in the ultimate exploitation of the MOVEit Transfer vulnerability. In contrast to the product in Accellion, the MOVEit Transfer software here is far from a “legacy” product—instead, the MOVEit technology appears to have been used by numerous companies across multiple sectors of the economy.

While we are sympathetic to the convenience-based arguments made by some plaintiffs who sue only the defendant to which they entrusted their data, in deciding the question of centralization, we must consider the needs of all parties and view the litigation as a whole. See In re: Watson Fentanyl Patch Prod. Liab. Litig., 883 F. Supp. 2d 1350, 1351–52 (J.P.M.L. 2012) (“While we are aware that centralization may pose some inconvenience to some parties, in deciding issues of transfer under Section 1407, we look to the overall convenience of the parties and witnesses, not just those of a single plaintiff or defendant in isolation.“) (citation omitted); cf. In re Libr. Editions of Children‘s Books, 297 F. Supp. 385, 386 (J.P.M.L. 1968) (rejecting “worm‘s eye view of Section 1407” and noting that “the Panel must weigh the interests of all the plaintiffs and all the defendants” and the litigation as a whole). That the MDL may grow to include actions brought solely against customer-facing defendants does not mean that discovery in those actions must cease while common discovery is being conducted against other defendants in the MDL. Instead, some defendant-specific discovery (taken, for example, in a streamlined manner via defendant fact sheets) could be ordered to proceed simultaneously with common discovery of Progress and others, if the transferee judge deems such an approach worthwhile.

At a certain stage of this litigation (e.g., perhaps after common discovery and motion practice concludes concerning Progress and other widely-named defendants such as PBI), the transferee judge may decide that some actions are ready for remand to their transferor courts ahead of other actions. If so, Section 1407 remand is available to return actions to their transferor courts with a minimum of delay. See Panel Rules 10.1-10.3; In re Marriott Int‘l., Inc., Customer Data Sec. Breach Litig., 363 F. Supp. 3d 1372, 1374 (J.P.M.L. 2019).

We are persuaded that the District of Massachusetts is the appropriate transferee district for these cases. More cases are pending in this district than in any other district, and the owner of the MOVEit file transfer software, Progress Software Corp., is headquartered in Burlington, Massachusetts. Relevant employees likely are based in this district, where potentially relevant databases, documents, witnesses, and other evidence also may be found. We are confident that Judge Allison D. Burroughs will steer this litigation on a prudent course to resolution.

IT IS THEREFORE ORDERED that the actions listed on Schedule A and pending outside the District of Massachusetts are transferred to the District of Massachusetts and, with the consent of that court, assigned to the Honorable Allison D. Burroughs for coordinated or consolidated proceedings with the actions pending there and listed on Schedule A.

PANEL ON MULTIDISTRICT LITIGATION

Karen K. Caldwell

Chair

Nathaniel M. Gorton Matthew F. Kennelly

Dale A. Kimball Madeline C. Arleo

IN RE: MOVEIT CUSTOMER DATA SECURITY BREACH LITIGATION

MDL No. 3083

SCHEDULE A

Central District of California

ORTEGA, ET AL. v. PROGRESS SOFTWARE CORPORATION, ET AL., C.A. No. 5:23−01329

Northern District of California

BERRY v. PENSION BENEFIT INFORMATION, LLC, ET AL., C.A. No. 3:23−03297

Eastern District of Louisiana

BERRY v. PROGRESS SOFTWARE CORPORATION, C.A. No. 2:23−02089

MCADAM v. PROGRESS SOFTWARE CORPORATION, C.A. No. 2:23−02295

District of Massachusetts

DIGGS, ET AL. v. PROGRESS SOFTWARE CORPORATION, C.A. No. 1:23−11370

PIPES v. IPSWITCH, INC., ET AL., C.A. No. 1:23−11394

TENNER v. PROGRESS SOFTWARE CORPORATION, C.A. No. 1:23−11412

GUILLORY-CAILLIER, ET AL. v. PROGRESS SOFTWARE CORPORATION, C.A. No. 1:23−11417

ANASTASIO v. PROGRESS SOFTWARE CORPORATION, ET AL., C.A. No. 1:23−11442

District of Minnesota

BAILEY v. PROGRESS SOFTWARE CORPORATION, ET AL., C.A. No. 0:23−02028

Notes

1
These and any other related actions are potential tag-along actions. See Panel Rules 1.1(h), 7.1 and 7.2.
2
Defendant PBI is a prominent user of MOVEit software that provides audit and address research services, including identifying decedents, lost participants or policyholders, and beneficiaries to pensions, insurance companies, third-party administrators, financial institutions, and other entities.
3
Johns Hopkins Health System and The Johns Hopkins University.
4
Plaintiffs PII includes such things as their names, Social Security numbers, birthdates, demographic information, insurance policy numbers, and other financial information.
5
For example, Progress and/or PBI are named as a defendant in cases also brought against the following: Athene Annuity & Life, Bank of America, Corebridge Financial, F&G Annuities & Life, Fidelity Investments, Genworth Financial, IBM, the Illinois Department of Innovation and Technology, Johns Hopkins, Maximus, Midland Financial, Milliman Solutions, Performance Health Tech., Prudential Insurance, Talcott Resolution Life Ins. Co., TIAA, TD Ameritrade and UNUM Group.
6
Some defendants request that the Panel use its power under Section 1407(a) to streamline the claims against them. Under this section, the Panel has the power to “separate any claim, cross-claim, counter-claim, or third-party claim and remand any of such claims before the remainder of the action is remanded.” Section 1407, however, does “not authorize the Panel to transfer one issue raised by a claim . . . while remanding another issue raised by the same claim,” In re Air Crash Disaster at Duarte, Cal. on June 6, 1971, 346 F. Supp. 529, 530 (J.P.M.L. 1972). Whether Section 1407(a) remand is available turns on a highly specific inquiry about how each complaint is pled. See, e.g., In re Juul Labs, Inc., Mktg., Sales Practices, & Prods. Liab. Litig., MDL No. 2913, Doc. No. 365 at 2 (J.P.M.L. Feb. 4, 2020) (“In any event, the seemingly indivisible nature of plaintiff‘s claims renders a partial transfer (i.e., transferring only plaintiff‘s claims against JLI and separating and remanding the claims against the other defendants) impracticable.“). Although rare, separation and remand also can impact the finality of any judgment entered by one judge when the other judge still presides over pending claims. See Rollins v. Mortg. Elec. Registration Sys., Inc., 737 F.3d 1250 (9th Cir. 2013). Separation and remand likely would complicate, rather than clarify, this already complex litigation. The same can be said of the proposal of counsel for certain Eastern District of Virginia plaintiffs who, during oral argument, hypothesized that we should create an MDL with the sole purpose of conducting discovery of Progress, an idea the likes of which we have never endorsed when creating an MDL because to do so at the outset of litigation would unduly circumscribe the discretion of the transferee judge, upon whom we rely to become intimately familiar with the contours of the litigation and chart a path to resolution.
7
The Panel also denied centralization because:

any factual overlap among the actions as to Accellion‘s FTA product, its vulnerability to attack, and its alleged support of this “legacy” product may be eclipsed by factual issues specific to each client defendant. Opponents of centralization argue that, rather than a single data breach, there were numerous data breaches of each client defendant, occurring at different times and involving each client defendant‘s own servers. Moreover, each client defendant‘s knowledge of the FTA‘s alleged vulnerability to attack will be unique, as will Accellion‘s alleged efforts to urge each client to migrate to its newer file sharing product.

In re Accellion, Inc., Customer Data Sec. Breach Litig., 543 F. Supp. 3d 1372, 1374 (J.P.M.L. 2021).
*
Judges David C. Norton and Roger T. Benitez took no part in the decision of this matter. Additionally, one or more Panel members who could be members of the putative classes in this litigation have renounced their participation in these classes and have participated in this decision.
Read the detailed case summary