Allen v. Blackbaud Inc

• Court: District Court, D. South Carolina
• Decided: April 18, 2022
• Docket: 3:20-cv-02930
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF SOUTH CAROLINA COLUMBIA DIVISION

) Case No.: 3:20-mn-02972-JMC ) IN RE: BLACKBAUD, INC., ) CUSTOMER DATA BREACH ) MDL No. 2972 LITIGATION ) ) ORDER AND OPINION ____________________________________)

THIS DOCUMENT RELATES TO: ALL ACTIONS:

This matter is before the court on Plaintiffs’ Motion for Corrective Notice. (ECF No. 216.) Plaintiffs assert that curative relief is necessary because Blackbaud has made “few, if any, accurate statements [] to class members about the data breach, and the information class members have received suggests that their risk of identity theft, fraud, or data misuse is much lower than it actually is.” (ECF No. 216-1 at 25.) For the reasons set forth below, the court DENIES Plaintiffs’ Motion for Corrective Notice. (ECF No. 216.) 1 I. RELEVANT BACKGROUND Plaintiffs in this action represent a putative class of individuals whose data was provided to Blackbaud’s customers and managed by Blackbaud. (See ECF No. 194 at 9 ¶ 16.) Thus, Plaintiffs are patrons of Blackbaud’s customers rather than direct customers of Blackbaud. (ECF Nos. 92-1 at 9; 109 at 7–8.) Plaintiffs assert that, from February 7, 2020 to May 20, 2020, cybercriminals infiltrated Blackbaud’s computer networks, copied Plaintiffs’ data, and held it for ransom. (ECF No. 194 at 5 ¶ 8, 14 ¶ 29.) Blackbaud ultimately paid the ransom in an undisclosed

1 The unredacted version of Plaintiffs’ Motion for Corrective Notice was filed under seal as ECF No. 204. The court’s holding applies to both versions of Plaintiffs’ Motion for Corrective Notice. (ECF Nos. 204, 216.) amount of Bitcoin in exchange for a commitment that any data previously accessed by the cybercriminals was permanently destroyed. (Id. at 3 ¶ 1.) Plaintiffs maintain that the breach resulted from Blackbaud’s “deficient security program[.]” (ECF No. 194 at 95 ¶ 351.) They assert that Blackbaud failed to comply with industry and regulatory standards by neglecting to implement security measures to mitigate the risk of

unauthorized access, utilizing outdated servers, storing obsolete data, and maintaining unencrypted data fields. (Id. at 95–96 ¶ 351, 124 ¶ 422, 130 ¶ 441.) Plaintiffs further allege that after the breach, Blackbaud launched a narrow internal investigation into the attack that analyzed a limited number of Blackbaud systems and did not address the full scope of the attack. (Id. at 194–95 ¶ 445.) Plaintiffs contend that Blackbaud failed to provide them with timely and adequate notice of the breach and the extent of the resulting data breach. (Id. at 112–13 ¶ 391.) After the breach was made public, putative class actions arising out of the intrusion into Blackbaud’s systems and subsequent data breach were filed in state and federal courts across the country. (ECF No. 1 at 1.) On December 15, 2020, the Judicial Panel on Multidistrict Litigation consolidated all federal

litigation related to the breach into this district for coordinated pretrial proceedings. (Id. at 3.) On February 16, 2022, Plaintiffs filed their sealed Motion for Corrective Notice, seeking the court’s approval of their dissemination of a corrective notice to “prevent further harm to class members.” (ECF No. 204.) On March 1, 2022, Plaintiffs filed the redacted version of their Motion for Corrective Notice on the public docket. (ECF No. 216.)2 Plaintiffs allege that Blackbaud made numerous misrepresentations to the public, including the representation that the stolen information

2 The court notes that, although Plaintiffs filed their sealed Motion for Corrective Notice on February 16, 2022 (ECF No. 204), they did not file their redacted version until March 1, 2022 (ECF No. 216), after Blackbaud filed its Response (ECF Nos. 214, 215). As such, the chronology of the redacted versions Plaintiffs’ Motion and Blackbaud’s Response does not accurately reflect the timing of the filings with the court. had been deleted even though Blackbaud had not confirmed this, misrepresenting the type of data stolen, and performing an unreliable risk of harm analysis that did not actually take into account the harm class members faced as a result of the breach. (ECF No. 216-1 at 5.) To “rectify the harm caused by Blackbaud’s deficient—and inaccurate—notice to its customers and the public,” Plaintiffs move the court to cure these misrepresentations by dissemination of a corrective notice.

(Id. at 6.) Plaintiffs contend that the court’s approval is permissible under its “inherent authority and Federal Rule [of] Civil Procedure 23(d).” (Id. at 3.) On March 1, 2022, Blackbaud filed a sealed Response to Plaintiffs’ Motion for Corrective Notice (ECF No. 214) as well as a redacted version of its Response (ECF No. 215). In its Response, Blackbaud emphasizes that it has never directly communicated with individual members of the putative class concerning the ransomware attack and has never asked them to arbitrate, waive, or otherwise compromise their claims. (ECF No. 214 at 9.) Blackbaud argues that Plaintiffs’ proposed notice would not serve any purpose because Plaintiffs’ counsel have already publicized this case and that Plaintiffs’ Motion is improper because they are essentially

requesting that the court enforce their litigation position before the issues are decided on the merits.3 (Id. at 11.) The court heard arguments from the parties on March 23, 2022. On March 30, 2022, Blackbaud notified the court that it had removed all summaries of the security incident from its website.4

3 Blackbaud also asserts that the Motion should be dismissed based on Plaintiffs’ failure to comply with Local Rule 7.03’s meet and confer requirements prior to filing the motion. (ECF No. 214 at 11 n.2.) Because the court denies Plaintiffs’ Motion on other grounds, it declines to address this basis for denial. 4 Plaintiffs also filed a Supplement to their Motion for Corrective Notice (ECF No. 233) on April 14, 2022, over a month after the deadline to file a reply brief to Blackbaud’s Response had passed. Plaintiffs did not provide an excuse for their belated filing, and it is well within the court’s discretion to disregard this filing as untimely under the Federal Rules of Civil Procedure. See, e.g., Davidson v. O’Reilly Auto Enters., LLC, 968 F.3d 955, 963 (9th Cir. 2020); United States v. II. LEGAL STANDARD Federal Rule of Civil Procedure 23(d)(1) provides that in conducting a class action, “the court may issue orders that: (C) impose conditions on the representative parties or on intervenors; . . . or (E) deal with similar procedural matters.” Fed. R. Civ. P. 23(d)(1). “Because of the potential for abuse, a district court has both the duty and the broad authority to exercise control over a class

action and to enter appropriate orders governing the conduct of counsel and parties.” Gulf Oil Co. v. Bernard, 452 U.S. 89, 100 (1981). However, such discretion is not unlimited. In a class action, “a district court may not order restraints on speech under [Rule] 23(d) except when justified by actual or threatened misconduct of a serious nature.” Great Rivers Co-Op. of Se. Iowa v. Farmland Indus., Inc., 59 F.3d 764, 766 (8th Cir. 1995). The entry of such an order must be “based on a clear record and specific findings that reflect a weighing of the need for a limitation and the potential interference with the rights of the parties.” Gulf Oil Co., 452 U.S. at 101. “Misleading communications to class members concerning the litigation pose a serious threat to the fairness of the litigation process, the adequacy of representation and the administration of justice generally.”

In re Sch. Asbestos Litig., 842 F.2d 671, 680 (3d Cir. 1988) (citing Gulf Oil, 452 U.S. at 101 n.2). III. ANALYSIS Plaintiffs contend corrective notice is necessary because Blackbaud’s own notice of the data breach was inaccurate and misleading. (ECF No. 216-1 at 22.) Plaintiffs’ Motion primarily focuses on disputed issues in this case, namely how the breach occurred, Blackbaud’s response, and the veracity of Blackbaud’s public statements on its website. Further, a review of the record

$70,670.00 in U.S. Currency, 929 F.3d 1293, 1302 (11th Cir. 2019) (“District courts have the discretion not to consider belated arguments”); Stephenson v. Cox, 223 F. Supp. 2d 119, 121 (D.D.C. 2002). (“A district court may exercise its discretion and decide not to consider a late-filed response that falls short of the requirements of Rule 6(b).”). In the interest of promoting the efficiency of this litigation, the court declines to consider the supplemental filing. establishes that Plaintiffs have not shown that Blackbaud improperly communicated with putative class members regarding this litigation such that the court’s interference is warranted at this time. Courts typically grant curative relief where the record shows that one of the parties has communicated with putative class members in a way that misleads them about their rights related to the pending litigation. See, e.g., Romano v. SLS Residential Inc., 253 F.R.D. 292, 297

(S.D.N.Y. 2008) (finding corrective notice necessary because defendants developed and executed a plan through which they sought to coerce putative class members to opt out of the class by providing class members with “patently false and misleading information about what this Court has done, what the Court will do and what will come to pass during the litigation of this case”); Ralph Oldsmobile, Inc. v. Gen. Motors Corp., No. 99 CIV. 4567 (AGS), 2001 WL 1035132, at *3 (S.D.N.Y. Sept. 7, 2001) (remedial action warranted based on the record, which supported findings of potential coercion and potentially unknowing waivers of the rights asserted in the action); Goody v. Jefferson Cnty., No. CV-09-437-E-BLW, 2010 WL 3834025, at *3 (D. Idaho Sept. 23, 2010) (“the Court finds that corrective notice is necessary to ensure that all putative plaintiffs know

about their right to join the collective action”). Plaintiffs have alleged no comparable conduct by Blackbaud that has interfered with their ability to bring this lawsuit or misled potential class members regarding their rights in this litigation. Although courts have sometimes found communications to be inherently coercive where there is an ongoing business relationship between the defendant and potential class members, see Tolmasoff v. Gen. Motors, LLC, No. 16-11747, 2016 WL 3548219, at *11 (E.D. Mich. June 30, 2016) (citing Sorrentino v. ASN Roosevelt Ctr. LLC, 584 F. Supp. 2d 529, 533 (E.D.N.Y. 2008)), in this case, there is no direct relationship between Blackbaud and potential class members. The court also notes that Plaintiffs seek to disseminate the corrective notice to Blackbaud’s customers, who are not parties to this case nor are they putative class members. In fact, Plaintiffs have not put forth any evidence that Blackbaud communicated directly with putative class members regarding this litigation or otherwise. As such, the proposed notice does not implicate the court’s authority under Rule 23(d) to address improper communications with potential class

members or to protect the legal interests of potential class members in this case. Plaintiffs also have not shown how preventing their distribution of this notice would interfere with their prosecution of the case.5 See In re Pella Corp., Architect & Designer Series Windows Mktg., Sales Pracs. & Prods. Liab. Litig., No. 2:14-mn-00001-DCN, 2014 WL 12622421, at *3 (D.S.C. Nov. 20, 2014). Further, the court “must strive to avoid authorizing injurious class communications that might later prove unnecessary.” Jackson v. Motel 6 Multipurpose, Inc., 130 F.3d 999, 1004 (11th Cir. 1997). An order authorizing communication in a class action is improper when “(1) the communication authorized by the order is widespread and clearly injurious and (2) a certification

decision is not imminent or it is unlikely that a class will in fact be certified.” Id. “In such circumstances, the danger of abuse that always attends class communications—the possibility that plaintiffs might use widespread publication of their claims, disguised as class communications, to coerce defendants into settlement—is not outweighed by any need for immediate communications.” Id. Here, Plaintiffs intend to distribute the corrective notice to Blackbaud’s customers via email, internet advertising, social media, a website, and a press release with the assistance of a qualified claims administrator. (ECF No. 204-36 at 3–9 ¶¶ 12–34.) As such,

5 Because this order does not limit “communications regarding ongoing litigation between a class and class opponents” or ban any other communications, Plaintiffs’ First Amendment rights are not implicated. See Kleiner v. First Nat. Bank of Atl., 751 F.2d 1193, 1205 (11th Cir. 1985). Plaintiffs also ask the court to order Blackbaud to provide the e-mail addresses of the customers whose clients’ information was exfiltrated in the data breach. (ECF No. 216-1 at 28.) Such a broad dissemination of the corrective notice is likely to cause serious harm to Blackbaud’s general reputation and to its relationships with its customers. Additionally, the proposed notice adopts Plaintiffs’ position on substantive, disputed issues

at the crux of this matter concerning Blackbaud’s conduct and representations surrounding the data breach. “Rule 23(d)(2) authorizes notice to protect class members’ right to participate in the litigation it does not authorize substantive orders protecting the very rights class members seek to vindicate.” Cobell v. Kempthorne, 455 F.3d 317, 324–25 (D.C. Cir. 2006); see also DW Volbleu, LLC v. Honda Aircraft Co., Inc., No. 4:21-cv-637-SDJ, 2021 WL 5826536, at *4 (E.D. Tex. Dec. 8, 2021) (“Nothing in Rule 23(d) authorizes such a pre-certification notice addressing issues to be decided on the merits, much less a notice that overtly endorses the litigation position of one of the parties before any class has been certified.”); Payne v. Goodyear Tire & Rubber Co., 207 F.R.D. 16, 20 (D. Mass. 2002) (“The text, however, concerns disputed issues of fact in this case and may

not for that reason alone be characterized as ‘misleading.’”). At bottom, Plaintiffs invite the court to step into the purview of the jury by making credibility determinations, weighing the evidence, and drawing inferences from the facts in Plaintiffs’ favor. E.g., Reeves v. Sanderson Plumbing Prods., Inc., 503 U.S. 133, 135 (2000). The court declines to overstep its authority in this way. Further, the court observes that Plaintiffs seek to disseminate information based on discovery materials that have been designated as protected material pursuant to the Stipulated Confidentiality Order (ECF No. 63). The Confidentiality Order provides that “Discovery Material shall be used by a Receiving Party solely for purposes of this litigation.” (ECF No. 63 at 4; see also id. at 17 (“Persons obtaining access to Protected Material pursuant to this Protective Order shall use the information in connection with this Litigation only[.]”).)®° The Confidentiality Order specifically prohibits disclosure of Protected Material designated as CONFIDENTIAL to putative class members “other than the named plaintiffs, class representatives, and proposed class representatives unless and until one or more classes have been certified[.]” (Ud. at 7.) Although Plaintiffs contend that they are in the process of challenging Blackbaud’s confidential designations with the Special Master in this case, they have not shown that they have any right to use confidential information produced in discovery to broadcast their position in this litigation. See, e.g., In re Pella, 2014 WL 12622421, at *3. Ultimately, the Federal Rules of Civil Procedure do not authorize Plaintiffs’ request to widely disseminate a notice endorsing their position on dispositive issues to Blackbaud’s customers, who are not parties or putative class members in this case, where Plaintiffs have not shown that Blackbaud made misleading communications regarding this litigation. IV. CONCLUSION For the foregoing reasons, the court DENIES Plaintiffs’ Motion for Corrective Notice. (ECF No. 216.)’ Because the court declines to consider Plaintiffs’ supplemental filing, it also DENIES AS MOOT Blackbaud’s Motion to Seal its Response (ECF No. 230) and DISMISSES Plaintiffs’ Supplement to their Motion (ECF Nos. 232, 233). IT IS SO ORDERED.

United States District Judge

Protected Material” means Discovery Material “designated as CONFIDENTIAL, CONFIDENTIAL — TRIAL COUNSEL ONLY, or CONFIDENTIAL — TRIAL COUNSEL ONLY — SECURITY SENSITIVE pursuant to [the] Confidentiality Order.” (ECF No. 63 at 3.) 1 The court’s holding also applies to the sealed version of Plaintiffs’ Motion for Corrective Notice (ECF No. 204).

April 18, 2022 Columbia, South Carolina