UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
CHANTAL ATTIAS, et al.,
Plaintiffs,
v. Case No. 15-cv-882 (CRC)
CAREFIRST, INC., et al.,
Defendants.
OPINION AND ORDER
In April 2014, hackers gained unauthorized access to the internal computer systems of
health insurance company CareFirst, Inc. Plaintiffs, a group of CareFirst’s customers whose
information was exposed in the breach, filed this class action lawsuit alleging claims for breach
of contract and violations of the consumer protection laws of Maryland and Virginia. Post-
summary judgment, only their breach-of-contract claim remains. And in its most recent opinion,
the Court certified a contract class whose recovery is likely limited to nominal damages because,
as the Court held in another prior opinion, mitigation expenses associated with a data breach are
not considered actual damages under D.C. law.
Plaintiffs now ask the Court to permit them to pursue an interlocutory appeal to clarify
whether mitigation expenses are actual damages for their breach-of-contract claim. In the
alternative, Plaintiffs request reconsideration of the Court’s holding that they may not recover
those expenses.
For the reasons detailed in this opinion, the Court will deny Plaintiffs’ request for
immediate appeal under 28 U.S.C. § 1292(b). The Court will also deny Plaintiffs’ motion for
reconsideration. I. Background
The Court presumes familiarity with its six prior opinions describing the procedural and
legal background of this case, so it provides only a summary of the relevant details here. See
Attias v. CareFirst, Inc. (Attias I), 199 F. Supp. 3d 193 (D.D.C. 2016); Attias v. CareFirst, Inc.
(Attias II), 365 F. Supp. 3d 1 (D.D.C. 2019); Attias v. CareFirst, Inc. (Attias III), 518 F. Supp. 3d
43 (D.D.C. 2021); Attias v. CareFirst, Inc. (Attias IV), 344 F.R.D. 38 (D.D.C. 2023); Attias v.
CareFirst, Inc. (Attias V), No. 15-cv-882 (CRC), 2023 WL 5952052 (D.D.C. Sept. 13, 2023);
Attias v. CareFirst, Inc. (Attias VI), 346 F.R.D. 1 (D.D.C. 2024).
Plaintiffs are District of Columbia, Maryland, and Virginia residents whose health
insurance was provided by Defendant CareFirst, Inc. during the time relevant to this lawsuit.
Attias VI, 346 F.R.D. at 3. In April 2014, hackers infiltrated CareFirst’s computer system
through an email-based spear phishing campaign and gained access to the following information
from individual CareFirst customers: first and last (and sometimes middle) names, subscriber ID
numbers, dates of birth, email addresses, and usernames used to log into CareFirst’s online
member portal. Id. CareFirst did not learn the extent of the data breach until May 2015. Id. At
that point, CareFirst sent letters to the affected customers notifying them of the breach and
offering them two years of free credit monitoring and identity-theft protection through a third-
party service. Id.
In June 2015, Plaintiffs brought this class action lawsuit, originally consisting of eleven
claims including breach of contract, negligence, violation of D.C., Maryland, and Virginia
consumer protection laws, violation of the D.C. Data Breach Notification Act, negligence per se,
unjust enrichment, breach of duty of confidentiality, fraud, and constructive fraud. Attias V,
2 2023 WL 5952052, at *2. The Court initially dismissed the case for lack of standing, but the
D.C. Circuit reversed in Attias v. Carefirst, Inc., 865 F.3d 620 (D.C. Cir. 2017).
On remand, the Court found that only Plaintiffs Curt and Connie Tringler had adequately
alleged actual damages as required for most of Plaintiffs’ claims. Attias II, 365 F. Supp. 3d at 5–
6. So, the Court dismissed for failure to state a claim all causes of action but for the breach of
contract and Maryland consumer protection claims brought by the Tringlers. Id. at 6. As
relevant here, the Court held that under the D.C. Court of Appeals’ decision in Randolph v. ING
Life Ins. & Annuity Co., 973 A.2d 702, 708 (D.C. 2009), “time and money spent protecting
against future identity theft cannot constitute damage in their own right” for any of Plaintiffs’
claims. Attias II, 365 F. Supp. 3d at 14.
On Plaintiffs’ motion for reconsideration, the Court reinstated the breach-of-contract
claim as to all Plaintiffs. Attias III, 518 F. Supp. 3d at 51–57. In doing so, the Court observed
that although some D.C. Court of Appeals authority suggests that damages are required to state a
contract claim, other authority holds that “‘[e]ven where monetary damages cannot be proved’
the prevailing party may be entitled to nominal damages, specific performance, or declaratory
relief.” Id. at 52 (quoting Wright v. Allen, 60 A.3d 749, 753 & n.3 (D.C. 2013)). The Court also
rejected Plaintiffs’ argument that intervening D.C. Circuit precedent In re: U.S. Office of
Personnel Management Data Security Breach Litigation, 928 F.3d 42 (D.C. Cir. 2019) (“OPM”),
had displaced its prior holding that mitigation costs are not actual damages under D.C. law. Id.
at 54–55. To the contrary, OPM could not overturn D.C. Court of Appeals’ precedent holding
that ““actual damages’ exclude a data-breach plaintiff’s mitigation costs absent any actual
misuse of the plaintiff’s data.’” Id. at 54. The Court also revived all Plaintiffs’ Maryland and
Virginia statutory claims under those states’ consumer protection laws. Id. at 55–57.
3 Next, Plaintiffs moved to certify three classes under Federal Rule of Civil Procedure 23
corresponding to their breach-of-contract claims, Maryland statutory claims, and Virginia
statutory claims. See Attias IV, 344 F.R.D. at 43. The Court denied the motion for class
certification because it had “serious concerns about whether common issues [would]
predominate over individual inquires in this case . . . in light of the Supreme Court’s recent
decision in TransUnion LLC v. Ramirez, 594 U.S. 413 (2021).” Id. at 42. The Court then moved
ahead with Defendants’ summary judgment motion. In September 2023, the Court granted
summary judgment to CareFirst on Plaintiffs’ two statutory claims. Attias V, 2023 WL
5952052, at *15–21.
Plaintiffs’ breach-of-contract claim, however, survived summary judgment. “Although
the evidence on which Plaintiffs rely is thin,” the Court found that “a reasonable jury could
conclude that CareFirst breached an implied promise to take reasonable steps to safeguard their
personal information.” Id. at *1; see id. at *4–15. In so holding, the Court recognized that
“recovery is almost certainly limited to nominal damages.” Id. at *15. But the Court reiterated
its holding in Attias III that, under D.C. law, Plaintiffs are entitled to pursue their contract claim
to recover nominal damages alone. Id. at 13.
In its most recent opinion, the Court took up Plaintiffs’ renewed motion for class
certification. The Court first held that the alleged breach of contract supplied all class members
with Article III standing because “the breach of a contractual obligation to perform some duty
has always been understood as a concrete injury” enabling parties to bring suit “regardless of
whether they have suffered actual damages as a result.” Attias VI, 346 F.R.D. at 9–10.
The Court then considered whether to certify the contract class “when nominal damages
are likely the only form of recompense on the table.” Id. at 11. The Court observed that
4 “[c]ertification of classes for nominal damages is routine in the constitutional-tort sphere,”
adding that the limitation to nominal damages “will streamline proceedings by dispensing with
the need for individualized damage calculations.” Id. at 11–12. It further noted that notification
protocols, opt-out provisions, and the creation of subclasses were available if any class member
wished to pursue actual damages other than mitigation expenses. Id. at 12. Having assured itself
that the nominal-damages limitation was no barrier, the Court certified the contract class. Id. at
12–13.
Now, after explicitly asking the Court to certify a contract class whose recovery is limited
to nominal damages, Plaintiffs request the Court to certify for immediate appeal the question of
whether mitigation expenses associated with the breach also may be recovered. Pl.’s Mot.
Certify Interlocutory Appeal (“MCIA”). In the alternative, they ask the Court, for the second
time, to reconsider its 2019 holding that mitigation costs are not recoverable in a breach-of-
contract action under D.C. law. Id. at 13–14. Plaintiffs have also filed a Rule 23(f) motion in the
D.C. Circuit, which the Circuit has held in abeyance pending this Court’s resolution of Plaintiffs’
present motions before it.
For the reasons explained in this opinion, the Court declines to permit Plaintiffs to pursue
an interlocutory appeal and will also deny Plaintiffs’ motion for reconsideration.
II. Legal Standards
The Court may permit a party to pursue an interlocutory appeal if, in its discretion, it
determines that a non-final order “[1] involves a controlling question of law [2] as to which there
is substantial ground for difference of opinion and that [3] an immediate appeal from the order
may materially advance the ultimate termination of the litigation.” 28 U.S.C. § 1292(b). “The
party seeking interlocutory review has the burden of persuading the Court that the
5 ‘circumstances justify a departure from the basic policy of postponing appellate review until
after the entry of a final judgment.’” APCC Servs., Inc. v. Sprint Commc’ns Co., 297 F. Supp. 2d
90, 95 (D.D.C. 2003) (quoting In re Vitamins Antitrust Litig., No. 99–197 (TFH), 2000 WL
33142129, at *1 (D.D.C. Nov. 22, 2000)). Even after the district court “confirm[s] that the
moving party has satisfied all of the elements of [S]ection 1292(b) . . . , it must also conclude
that certification is appropriate as a discretionary matter.” Azima v. RAK Inv. Auth., 325 F.
Supp. 3d 30, 35 (D.D.C. 2018). Interlocutory appeals are “infrequently allowed,” for the movant
must demonstrate “exceptional circumstances” justifying piecemeal appeal. Graham v.
Mukasey, 608 F. Supp. 2d 56, 57 (D.D.C. 2009).
Plaintiffs have moved, in the alternative, for reconsideration of the Court’s prior holding
that mitigation damages are unavailable to them. Pl.’s MCIA 13–15. Under Federal Rule of
Civil Procedure 54(b), any order or decision that is not a final judgment “may be revised at any
time before the entry of a judgment adjudicating all the claims and all the parties’ rights and
liabilities.” Courts grant motions for reconsideration of interlocutory orders only “as justice
requires.” Shea v. Clinton, 850 F. Supp. 2d 153, 157 (D.D.C. 2012) (quoting Hoffman v. Dist. of
Columbia, 681 F. Supp. 2d 86, 90 (D.D.C. 2010)) (internal quotation marks omitted). While
courts enjoy significant discretion under Rule 54(b), “in order to promote finality, predictability
and economy of judicial resources,” they generally should not revisit prior interlocutory
decisions “in the absence of extraordinary circumstances such as where the initial decision was
clearly erroneous and would work a manifest injustice.” Id. at 157–58 (quoting Pueschel v. Nat’l
Air Traffic Controllers’ Ass’n, 606 F. Supp. 2d 82, 85 (D.D.C. 2009)) (internal quotation marks
omitted). In deciding whether “justice requires” reversal of its prior interlocutory order, a court
considers whether it
6 [1] “patently misunderstood a party,” [2] “has made a decision outside the adversarial issues presented to the Court by the parties,” [3] “has made an error not of reasoning but of apprehension,” or [4] whether “a controlling or significant change in the law or facts [has occurred] since the submission of the issue to the Court.”
United States v. Slough, 61 F. Supp. 3d 103, 108 (D.D.C. 2014) (alteration in original) (quoting
Singh v. George Washington Univ., 383 F. Supp. 2d 99, 101 (D.D.C. 2005)). A motion for
reconsideration should therefore be denied “when it merely asserts ‘arguments for
reconsideration [that] the court has already rejected on the merits.’” BEG Invs., LLC v. Alberti,
85 F. Supp. 3d 54, 58 (D.D.C. 2015) (alteration in original) (quoting McLaughlin v. Holder, 864
F. Supp. 2d 134, 141 (D.D.C. 2012)).
III. Analysis
A. Interlocutory Appeal
The Court begins by declining to certify the question of whether data-breach mitigation
costs are recoverable as actual damages under D.C. law. Plaintiffs have satisfied only two of the
three elements required under Section 1292(b). Even if Plaintiffs had satisfied all three elements,
the Court would exercise its discretion to decline certification.
As an initial matter, CareFirst suggests that Plaintiffs have not identified which order they
would like the Court to certify for interlocutory appeal. Def.’s Opp’n 6–7. Although Plaintiffs’
briefing is not a model of clarity, they request certification of the question “whether future
mitigation expenses and time lost . . . are actual damages that are cognizable in a breach of
contract action in the District of Columbia.” Pl.’s MCIA 15. In their reply brief, Plaintiffs
suggest they are requesting certification of “every opinion this Court has issued” indicating that
the class’s recovery is limited to nominal damages. Pl.’s Reply 1. From this, the Court
7 concludes that Plaintiffs request certification of the class certification order, which relies on the
Court’s prior orders to hold that only nominal damages are available to the class.
With that, the Court turns to the elements of Section 1292(b). Plaintiffs have satisfied the
first element: The question they seek to certify is a controlling question of law. “A question of
law is an abstract legal issue or what might be called one of ‘pure’ law, matters the court of
appeals can decide quickly and cleanly without having to study the record.” United States v.
Honeywell Int’l Inc., No. 08-cv-0961 (PLF), 2021 WL 2493382, at *3 (D.D.C. June 18, 2021)
(citation and quotation marks omitted). Whether the rule set forth in Randolph v. ING Life Ins.
& Annuity Co., 973 A.2d 702, 708 (D.C. 2009), precludes recovery of Plaintiffs’ mitigation
expenses presents a question of pure law that does not depend on facts specific to the record.
That the Court first rendered the holding at issue to resolve CareFirst’s motion to dismiss
confirms the point. Attias II, 365 F. Supp. 3d at 14–15.
And the question is controlling. It “would require reversal if decided incorrectly.”
Honeywell, 2021 WL 2493382, at *5 (citation omitted). Resolving whether mitigation expenses
are available as damages would “significantly impact the action,” id. at *3 (quoting Air Transp.
Ass’n v. U.S. Dep’t of Agric., 317 F. Supp. 3d 385, 394 (D.D.C. 2018)), because, as the Court
has observed previously, Plaintiffs are otherwise almost certainly limited to recovering nominal
damages. Attias VI, 346 F.R.D. at 11. Indeed, several judges within this district have treated
issues relating to the measure of damages as controlling for certification purposes. See
Honeywell, 2021 WL 2493382, at *5 (listing cases).
Second, the Court considers whether there is a “substantial ground for difference of
opinion” on the disputed legal question. 28 U.S.C. § 1292(b). In doing so, the Court emphasizes
that the disputed question here is whether data-breach mitigation expenses are recoverable in a
8 breach-of-contract action under D.C. law, not under the law of any other jurisdiction. And as the
Court has explained in several prior opinions, the D.C. Court of Appeals has squarely held that
absent actual misuse of the plaintiff’s data, mitigation expenses cannot be recovered as actual
damages. Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 708 (D.C. 2009). Those
costs are “an injury that is ‘not the result of any present injury, but rather the [result of] the
anticipation of future injury that has not materialized.’” Id. (citation omitted) (alteration in
original). So, such costs are not compensable.
To be sure, some courts in other jurisdictions have moved toward permitting the recovery
of mitigation expenses in data-breach cases. See, e.g., Johnson v. Nice Pak Prods., Inc., No. 23-
CV-01734-JMS-CSW, 2024 WL 2845928, at *4 (S.D. Ind. June 5, 2024) (holding that time and
effort spent monitoring accounts after a data breach are compensable damages); Stasi v.
Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 918 (S.D. Cal. 2020) (“In data breach cases
involving negligence claims, district courts have found it sufficient to allege out-of-pocket
expenses in purchasing identity theft protection services to show damages.”). But no out-of-state
precedent can displace Randolph’s holding. Nor can, as the Court has said before, the D.C.
Circuit’s holding in OPM. The Court reiterates: “Randolph remains binding D.C. law and
continues to govern plaintiffs’ D.C. law claims.” Attias III, 518 F. Supp. 3d at 55.
Plaintiffs’ most persuasive argument is that Randolph’s rule for negligence and breach-
of-fiduciary-duty claims should not extend to breach-of-contract claims. Pl.’s MCIA 10–11. At
first glance, Plaintiffs’ argument has some force. Randolph held that money spent on “credit
monitoring or other security measures” is “not the result of any present injury, but rather the
[result of] the anticipation of future injury that has not materialized.” 973 A.2d at 708 (citation
omitted) (alteration in original). Thus, mitigation expenses alone could not satisfy the injury
9 element of the plaintiffs’ negligence or breach-of-fiduciary duty claims. Here, in contrast, the
Court has already held that “the breach of a contractual obligation to perform some duty has
always been understood as a concrete injury that enables the aggrieved contracting party to
proceed in an American court.” Attias VI, 346 F.R.D. at 9.
Randolph holds that mitigation expenses alone may not create an injury when one does
not otherwise exist. But the question here is whether a plaintiff who has already demonstrated an
injury sufficient to seek nominal contract damages may also recover reasonable mitigation
expenses. The Court concludes that Randolph dictates the same result regardless of whether the
plaintiff relies entirely on mitigation expenses to establish his injury. Randolph made clear that
mitigation expenses are not a harm attributable to the initial data breach. They stem only from
the risk of future harm. By that logic, credit monitoring does not “compensate a party for the
loss incurred by the other’s breach,” as all contract damages are intended to do. See Bay Gen.
Indus., Inc. v. Johnson, 418 A.2d 1050, 1057 n.19 (D.C. 1980). Instead, mitigation services seek
to prevent loss before it happens. Until that harm is realized, it cannot be compensated.
None of this is to say that Randolph’s holding is unassailable. Some courts have reached
the same conclusion. See, e.g., Collins v. Athens Orthopedic Clinic, 347 Ga. App. 13, 19 (2018),
judgment rev’d in part, 307 Ga. 555 (2019); Doe v. Henry Ford Health Sys., 865 N.W. 2d 915,
921–22 (Mich. App. 2014). Others—a majority perhaps—have come out the other way. See,
e.g., Moore v. Centrelake Med. Grp., Inc., 299 Cal. Rptr. 3d 544, 560 (2022); In re Anthem, Inc.
Data Breach Litig., No. 15-MD-02617-LHK, 2016 WL 3029783, at *26 (N.D. Cal. May 27,
2016). Were it writing on a blank slate and having (just barely) green lit Plaintiffs’ implied
breach claim, this Court might have landed in the latter camp. The question before the Court,
however, is not whether there’s a substantial ground for a difference of opinion over the wisdom
10 of Randolph’s rule. It is whether there’s a substantial ground for a difference of opinion on
whether the D.C. Court of Appeals would extend Randolph to a breach of contract claim. The
Court has already answered that question in the negative. See Attias II, 365 F. Supp. 3d at 14
(“there is no reason to believe the D.C. Court of Appeals would treat plaintiffs’ other D.C. law
claims any differently”). And it does so again now. Accordingly, the Court finds no substantial
ground for difference of opinion.
Third, certification would not “materially advance the ultimate termination of the
litigation.” 28 U.S.C. § 1292(b). This long-running case dates to 2016, and “[a]ny appeal will
almost certainly prolong . . . the resolution of the litigation.” Arias v. DynCorp, 856 F. Supp. 2d
46, 54 (D.D.C. 2012). And as the Court has observed elsewhere, the third factor “requires a
showing that the decision below might well be reversed on appeal, as evidenced by ‘substantial
ground for difference of opinion’ on the disputed legal question.” Kennedy v. D.C., 145 F. Supp.
3d 46, 52 (D.D.C. 2015) ) (Cooper, J.). As just explained, Plaintiffs have not made that showing.
Moreover, a reversal would create problems of its own by implicating the same predominance
concerns the Court identified previously and require the parties to return to the drawing board on
class certification. See Attias IV, 344 F.R.D. at 53–54.
Even if Plaintiffs had satisfied all three elements, the Court would exercise its discretion
to decline certification. The Court first held that Plaintiffs could not recover mitigation expenses
under Randolph in 2019, over five years ago. Attias II, 365 F. Supp. 3d at 13–16. Plaintiffs
moved for reconsideration, making many of the same arguments made here. Compare Pl.’s
Memo., ECF No. 66, at 2–4, 6–8, with Pl.’s MCIA 8–9. The Court rejected those arguments and
reaffirmed its holding that mitigation damages are not recoverable under D.C. law. Attias III,
518 F. Supp. 3d at 52–55.
11 Then, in opposing CareFirst’s motion for summary judgment, Plaintiffs once again
attempted to distinguish Randolph and argued that mitigation expenses constitute actual
damages. Pl.’s Opp’n, ECF 98, at 24. Once more, the Court reiterated its holding that mitigation
expenses do not constitute actual damages under D.C. law. Attias V, 2023 WL 5952052, at *15.
The Court then explicitly asked Plaintiffs at the class certification hearing following summary
judgment if they were “still pursuing class certification even if the Court holds that . . . they
would only be entitled to nominal damages[.]” Opp’n, Ex. A (Jan. 30, 2024 Hrg. Transcript), at
7:4-7. Plaintiffs responded: “We are pursuing the class.” Id. at 7:8. Relying on that
representation, the Court took up their renewed certification motion and ultimately certified a
contract class for which “nominal damages are likely the only form of recompense.” Attias VI,
346 F.R.D. at 11. Plaintiffs may not wait until after class certification to seek interlocutory
appeal on an issue that has been the law of the case since 2019 and has been reaffirmed by the
Court in three subsequent opinions.
This exercise of the Court’s discretion is informed by its view of the merits of Plaintiffs’
claim. See Attias V, 2023 WL 5952052, at *1 (observing that “the evidence on which Plaintiffs
rely is thin”). The Court finds relevant, as well, the relatively minimal mitigation measures (on
top of the two years of free credit monitoring and identity-theft protection CareFirst gave to all
affected customers) that would have been appropriate under the circumstances. No Social
Security or credit card numbers were leaked in the breach. Attias IV, 344 F.R.D. at 54. Thus, as
the Court observed before, it is not clear that most standard mitigation measures like credit
monitoring or freezing “would relate to combatting the much narrower form of medical identity
theft potentially implicated here.” Id. at 54–55.
12 For all these reasons, the Court will not permit Plaintiffs to pursue an interlocutory appeal
under Section 1292(b).
B. Motion for Reconsideration
In the alternative, Plaintiffs ask the Court to reconsider its holding that mitigation
expenses do not constitute actual damages under D.C. law. As just explained, that holding has
been the law of the case since 2019. The Court therefore denies Plaintiffs’ motion because it
“merely asserts ‘arguments for reconsideration [that] the court has already rejected on the
merits.’” BEG Invs., LLC v. Alberti, 85 F. Supp. 3d 54, 58 (D.D.C. 2015) (alteration in
original). And “‘where litigants have once battled for the court’s decision,’ they should not be
permitted, ‘without good reason[,] . . . to battle for it again.’” Kennedy v. D.C., 145 F. Supp. 3d
46, 51 (D.D.C. 2015) (Cooper, J.) (quoting Casey v. Ward, 67 F. Supp. 3d 54, 57 (D.D.C.
2015)).
Plaintiffs also request clarification of whether they may recover mitigation expenses as
actual damages. Pl.’s MCIA 13-14. True, the Court said in its summary-judgment opinion that
recovery will “likely be limited to nominal damages.” Attias VI, 346 F.R.D. at 12 (emphasis
added). But that is so because the Court “cannot entirely rule out the possibility that there may
be some class members who believe they suffered financial harms (other than mitigation
expenses) stemming from the CareFirst data breach.” Id. (emphasis added). As to mitigation
expenses, the Court has been crystal clear: the class members cannot recover them under D.C.
law.
IV. Conclusion
For these reasons, it is hereby
13 ORDERED that [Dkt. No. 112] Plaintiffs’ Motion for Reconsideration and Motion for
Leave to Bring an Interlocutory Appeal is DENIED.
SO ORDERED.
CHRISTOPHER R. COOPER United States District Judge
Date: August 20, 2024