IN RE: KRONOS CUSTOMER DATA SECURITY BREACH LITIGATION (2022)

ORDER DENYING TRANSFER

Before the Panel:^* Plaintiffs in the constituent action pending in the District of Massachusetts move under 28 U.S.C. § 1407 to centralize this litigation in the District of Massachusetts. This litigation consists of five actions—three pending in the Northern District of California, one pending in the District of Massachusetts, and one pending in the Western District of Pennsylvania—as listed on Schedule A.¹ Defendants UKG, Inc. and its subsidiary Kronos Incorporated (together, Kronos) oppose centralization, as do plaintiffs in the actions pending in the Northern District of California and the Western District of Pennsylvania. Plaintiffs in the potentially-related actions support centralization in the District of Massachusetts.

On the basis of the papers filed and the hearing session held, we conclude that centralization is not necessary for the convenience of the parties and witnesses or to further the just and efficient conduct of this litigation. These putative class actions arise from a data security breach of Kronos’ cloud-based time and attendance systems and workforce management software applications in December 2021. The breach is alleged to have caused an outage of Kronos’ payroll system and compromised the personally identifiable information of the employees of their clients. The actions thus will share some common factual questions, including how the Kronos data breach occurred, what security measures were in place at the time of the breach, and what steps Kronos took in response to the breach. There are only five actions on the motion, however, three of which are consolidated in the same district before the same judge. Though there are now seven potentially-related actions, they all are pending in the same district before the same judge.

We have emphasized that “centralization under Section 1407 should be the last solution after considered review of all other options.” In re Best Buy Co., Inc., Cal. Song-Beverly Credit Card Act Litig., 804 F. Supp. 2d 1376, 1378 (J.P.M.L. 2011). These options include voluntary cooperation and coordination among the parties and the involved courts to avoid duplicative discovery or inconsistent rulings. See, e.g., In re Gerber Probiotic Prods. Mktg. & Sales Practices Litig., 899 F. Supp. 2d 1378, 1379 (J.P.M.L. 2012); In re Eli Lilly & Co. (Cephalexin Monohydrate) Patent Litig., 446 F. Supp. 242, 244 (J.P.M.L. 1978); see also Manual for Complex Litigation, Fourth, § 20.14 (2004). In the circumstances presented here, informal coordination among the small number of parties and involved courts appears eminently feasible. Indeed, the voluntary coordination efforts of the parties to the Northern District of California cases already have resulted in consolidation in that court. Of the remaining nine actions, eight are related before a single judge in the District of Massachusetts, and seven of those were filed by common counsel.

Furthermore, while the actions all share factual questions regarding the circumstances of the data breach, some also include wage and hour claims against Kronos and plaintiffs’ employers. These claims will involve factual issues unique to each employer and how each handled the payroll system outage. With a relatively small number of actions, the addition of such individualized facts and unique additional defendants would complicate the management of a coordinated proceeding.

Finally, plaintiffs in actions outside the District of Massachusetts and common defendants oppose centralization. We have found persuasive that “of all responding parties, those who would be most affected by centralization ․ do not believe that centralization would be beneficial.” In re Student–Athlete Name & Likeness Litig., 763 F. Supp. 2d 1379 (J.P.M.L. 2011). See also In re Sorin 3T Heater-Cooler Sys. Prods. Liab. Litig., 273 F. Supp. 3d 1357, 1358 (J.P.M.L. 2017) (“Critically, not a single party to any of the six actions pending outside the District of South Carolina supports centralization.”).

IT IS THEREFORE ORDERED that the motion for centralization of these actions is denied.

SCHEDULE A

MDL No. 3039 — IN RE: KRONOS CUSTOMER DATA SECURITY BREACH LITIGATION

 Northern District of California

MULLER, ET AL. v. UKG INC., C.A. No. 3:22−00346

VILLANUEVA v. UKG, INC., C.A. No. 3:22−01789

BENTE v. UKG, INC., C.A. No. 3:22−02554

 District of Massachusetts

PALLOTTA, ET AL. v. UNIVERSITY OF MASSACHUSETTS MEMORIAL

MEDICAL CENTER, ET AL., C.A. No. 4:22−10361

 Western District of Pennsylvania

KROECK v. WEST PENN ALLEGHENY HEALTH SYSTEM, INC., ET AL.,

C.A. No. 2:22−00066

FOOTNOTES

FOOTNOTE.   Judge Roger T. Benitez took no part in the decision of this matter.Additionally, one or more Panel members who could be members of the putative classes in this litigation have renounced their participation in these classes and have participated in this decision.

1.   The Panel has been notified that seven potentially-related actions are pending in the District of Massachusetts.

KAREN K. CALDWELL, Chair