IN RE: ACCELLION (2021)

ORDER DENYING TRANSFER

Before the Panel:^* Plaintiff in one Northern District of California action (Beyer), listed on Schedule A, moves under 28 U.S.C. § 1407 to centralize this litigation in the Northern District of California. The litigation consists of fourteen actions pending in three districts, as listed on Schedule A. Since the motion was filed, the parties have notified the Panel of twelve related federal actions pending in five districts.

Plaintiffs in two potential tag-along actions and defendant Accellion, Inc. (Accellion), support the motion. All other responding parties oppose centralization, including plaintiffs in fourteen actions and defendants Flagstar Bancorp, Inc., Flagstar Bank, FSB (together, Flagstar Bank), and The Kroger Co. (Kroger). Plaintiffs in four actions alternatively support the Northern District of California as transferee district. If the Panel centralizes this litigation over their objections, Kroger suggests centralization in the Southern District of Ohio, and Flagstar Bank suggests centralization in the Eastern District of Michigan or, alternatively, does not oppose centralization in the Southern District of Ohio. Plaintiffs in two Southern District of Ohio actions and one Northern District of California action alternatively suggest the Panel create defendant-specific MDLs in the home district of each defendant.¹

On the basis of the papers filed and the hearing session held,² we are not persuaded that centralization is necessary for the convenience of the parties and witnesses or to further the just and efficient conduct of this litigation at this time. Proponents of centralization argue that these actions share factual issues concerning a recently-disclosed breach of Accellion's File Transfer Appliance (FTA) product from mid-December 2020 into January 2021. Various Accellion clients, including defendants Kroger and Flagstar Bank, used the FTA product. Plaintiffs here are these clients’ customers and/or employees who allege their personally identifiable information and/or protected health information were compromised in the breach. Of the 26 actions and potential tag-along actions now pending, nine name only Accellion as the defendant, ten name only one Accellion client, and seven are multi-defendant actions naming Accellion and one of its clients (Kroger, Flagstar Bank, or potential tag-along defendants Health Net of California, Inc., and Health Net, LLC).

We find centralization of these actions unnecessary at this time. Most parties, including two defendants, oppose centralization, and have cooperated to organize all but two actions into three coordinated or consolidated proceedings pending in the Northern District of California (actions against Accellion), the Eastern District of Michigan (actions against Flagstar Bank), and the Southern District of Ohio (actions against Kroger).³ The constituent actions are pending in just three courts before three judges. There are now actions against Kroger and/or Accellion pending in two additional districts (the Central District of Illinois and the Southern District of Indiana), and there are seven multi-defendant actions pending in the Northern District of California (six actions) and the Southern District of Indiana. But given the small number of involved courts and the preference of most parties to informally coordinate, we find it a better alternative to Section 1407 centralization at this time. We see no reason to disrupt the parties’ efforts at informal coordination when most agree that Section 1407 centralization would provide little or no benefit. Indeed, “[w]e have emphasized that centralization under Section 1407 should be the last solution after considered review of all other options.” In re Alteryx, Inc., Customer Data Sec. Breach Litig., 291 F. Supp. 3d 1377, 1378 (J.P.M.L. 2018) (quotation omitted).

Additionally, any factual overlap among the actions as to Accellion's FTA product, its vulnerability to attack, and its alleged support of this “legacy” product may be eclipsed by factual issues specific to each client defendant. Opponents of centralization argue that, rather than a single data breach, there were numerous data breaches of each client defendant, occurring at different times and involving each client defendant's own servers. Moreover, each client defendant's knowledge of the FTA's alleged vulnerability to attack will be unique, as will Accellion's alleged efforts to urge each client to migrate to its newer file sharing product. Other unique factual issues include when each client was made aware of a data breach and when it notified its customers and/or employees. Proponents of centralization argue that even in the actions in which Accellion is not named, it will be involved in some third-party discovery. But we are persuaded that such discovery can be informally coordinated.

IT IS THEREFORE ORDERED that the motion for centralization of these actions is denied.

SCHEDULE A

MDL No. 3002, IN RE: ACCELLION, INC., CUSTOMER DATA SECURITY BREACH LITIGATION

 Northern District of California

BROWN v. ACCELLION, INC., C.A. No. 5:21−01155

ZEBELMAN v. ACCELLION, INC., C.A. No. 5:21−01203

RODRIGUEZ v. ACCELLION, INC., C.A. No. 5:21−01272

STOBBE v. ACCELLION, INC., C.A. No. 5:21−01353

PRICE v. ACCELLION, INC., C.A. No. 5:21−01430

BOLTON v. ACCELLION, INC., C.A. No. 5:21−01645

WHITTAKER v. ACCELLION, INC., C.A. No. 5:21−01708

COCHRAN, ET AL. v. ACCELLION, INC., ET AL., C.A. No. 5:21−01887

BEYER v. FLAGSTAR BANCORP, INC., ET AL., C.A. No. 5:21−02239

 Eastern District of Michigan

ANGUS, ET AL. v. FLAGSTAR BANK, FSB, C.A. No. 2:21−10657

GARCIA v. FLAGSTAR BANK, F.S.B., C.A. No. 2:21−10671

 Southern District of Ohio

JONES v. THE KROGER COMPANY, C.A. No. 1:21−00146

GOVAERT, ET AL. v. THE KROGER COMPANY, C.A. No. 1:21−00174

DOTY, ET AL. v. THE KROGER COMPANY, C.A. No. 1:21−00198

FOOTNOTES

FOOTNOTE.   One or more Panel members who could be members of the putative classes in this litigation have renounced their participation in these classes and have participated in this decision.

1.   Plaintiffs in one Ohio action presented this position as an alternative in their brief and plaintiff in the other Ohio action did not include it in his brief. In their notices of intent to present oral argument, plaintiffs in both Ohio actions assert they “[s]upport centralization of cases in home districts of Defendant (Kroger to S.D. Ohio; Flagstar to E.D. Michigan; Accellion to N.D. California).”

2.   In light of the concerns about the spread of the COVID-19 virus (coronavirus), the Panel heard oral argument by videoconference at its hearing session of May 27, 2021. See Suppl. Notice of Hearing Session, MDL No. 3002 (J.P.M.L. May 10, 2021), ECF No. 77.

3.   We find centralization into defendant-specific MDLs—an alternative suggestion that was not well-developed or defined in the parties’ briefing or oral argument—similarly premature. One plaintiff suggested the Panel transfer each action to the district in which the “primary” defendant is headquartered, but did not explain how the Panel would determine which defendant is “primary” in each action. If Accellion is considered the primary defendant in each action in which it is named, then only two actions would be transferred to the Northern District of California—the Central District of Illinois and Southern District of Indiana potential tag-along actions—and these actions were not included on the motion for centralization, but only noticed as related to the actions on the motion. This potentially presents a procedural obstacle to any immediate centralization as to those actions. See 28 U.S.C. § 1407(c) (requiring notice to the parties that centralization of the actions is contemplated).

KAREN K. CALDWELL, Chair