Axis Insurance Company v. Barracuda Networks, Inc.

CourtDistrict Court, D. Massachusetts
DecidedFebruary 14, 2022
Docket1:20-cv-11997
StatusUnknown

This text of Axis Insurance Company v. Barracuda Networks, Inc. (Axis Insurance Company v. Barracuda Networks, Inc.) is published on Counsel Stack Legal Research, covering District Court, D. Massachusetts primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Axis Insurance Company v. Barracuda Networks, Inc., (D. Mass. 2022).

Opinion

United States District Court District of Massachusetts

) Zoll Medical Corp., et al., ) ) Plaintiff, ) ) v. ) ) Civil Action No. Barracuda Networks, Inc., et al., ) 20-11997-NMG ) Defendant. ) )

MEMORANDUM & ORDER

GORTON, J. This action arises out of a data breach which compromised certain confidential, protected health information (“PHI”) of more than 277,000 patients of Zoll Services LLC, an indirect subsidiary of Zoll Medical Corporation (together, “Zoll”). Pending before the Court is the motion of defendants Barracuda Networks, Inc. (“Barracuda”) and Sonian, Inc. (“Sonian” and together with Barracuda, “the defendants” or “the Barracuda parties”) to dismiss an intervenor complaint filed by Fusion, LLC (“Fusion” or “the intervenor”) (Docket No. 31) and the motion of Zoll, Fusion, and Axis Insurance Company (“Axis”) to substitute Axis for Zoll and Fusion. (Docket No. 43). For the reasons that follow, both motions will be allowed, in part, and denied, in part. I. Factual Background and Procedural History A. Factual Background The Court has previously recited the factual and procedural history of this action. See Zoll Med. Corp. v. Barracuda Networks, No. 20-11997, 2021 U.S. Dist. LEXIS 180761 at *2-6 (D. Mass. Sept. 21, 2021). In 2012, Fusion entered into a contract

with Sonian to provide its customers (which later included Zoll) with software and related services for the management of customer communications and email (“the OEM Agreement”).1 Fusion alleges that although Barracuda represented that its data management capabilities would enable customers to identify and reduce risks it in fact lacked the “reasonable and readily available security protocols and products” to provide such security. The data breach began on November 8, 2018, when a Barracuda employee allegedly left a data port open in its system during a standard migration of data within its network. None of

Barracuda’s supervisory, security or oversight mechanisms detected the error until approximately seven weeks later, on December 28, 2018. In the meantime, the confidential and

1 The Court will refer to Sonian and Barracuda as “the Barracuda parties” except where Sonian’s individual corporate identity is relevant. protected health information of Zoll patients was apparently accessed by unauthorized third parties. Barracuda finally contacted Fusion with respect to the data breach in January, 2019, advising that it recently discovered that a very small number of user emails stored in an application known as Sonian EA were compromised as a result of unauthorized access to our system by a third party. Barracuda informed neither Fusion nor the Zoll plaintiffs that the data port had remained open and undetected for several weeks and, instead, allegedly misrepresented that the data breach was minor. After receiving notice of the breach, Zoll began an investigation into the event to determine whether customer PHI had been accessed. As part of that investigation, it requested from Barracuda additional information regarding the data breach but Barracuda alleging refused to cooperate. Thereafter, Zoll hired an independent forensics firm, Kroll, Inc., to assist in the investigation. In June, 2019, Fusion filed for bankruptcy protection under Chapter 11 of Title II of the United States Bankruptcy Code in the United States Bankruptcy Court for the Southern District of New York. B. Procedural History The data breach has engendered substantial litigation between Fusion, Zoll, their respective insurers, the individuals whose PHI was compromised by the breach and the Barracuda parties. Those disputes are, in relevant part, described below. In April, 2019, a class action lawsuit was filed against

Zoll in the Circuit Court of Kanawha County, West Virginia, by individuals claiming that their PHI had been the subject of the data breach. That action was settled, and Zoll has assumed liability for any injury to its patients resulting from the data breach. i. The Arbitration In August, 2019, Zoll filed a proof of claim in Fusion’s bankruptcy proceeding in the Southern District of New York seeking damages allegedly arising out of the data breach. Fusion’s bankruptcy plan, which became effective in January, 2020, contained language which provided that nothing in the plan

would preclude Zoll from subsequently seeking damages from Fusion for harm suffered as a result of the data breach, provided that such damages were “solely to the extent of available insurance coverage and proceeds.” In March, 2020, Zoll initiated arbitration proceedings with Fusion, asserting claims for negligence and breach of contract.2 Fusion’s insurer, Axis, confirmed coverage of claims related to the data breach and assumed defense. After Zoll’s insurer, Ace American Insurance Company (“Ace”) paid Zoll its claims for damages incurred due to the data breach, Ace was subrogated as

the real party in interest in the arbitration. In November, 2021, Fusion, Axis, Zoll and Ace settled the arbitration claims. Fusion and Zoll confirm that, pursuant to the settlement agreement, Zoll and Ace have assigned to Axis all claims that they have against Barracuda in connection with the data breach. They contend that Axis is therefore the real party in interest with respect to the claims asserted by Fusion and Zoll against Barracuda in this action as set forth hereafter. ii. Claims of Zoll and Fusion against Barracuda In November, 2020, Zoll filed the instant action against the Barracuda parties, alleging claims for 1) negligence (Count

I), 2) breach of the implied warranty of merchantability (Count II), 3) breach of the implied warranty of fitness (Count III), 4) breach of contract (Count IV) and 5) equitable indemnification (Count V). The Barracuda parties moved to

2 Zoll also asserted claims against Barracuda before the arbitrator dismissed it as a party in December, 2020, for lack of privity. dismiss those claims and the Court allowed their motion except as to Count V. In June, 2021, Fusion intervened in the action and filed an eight-count complaint against the Barracuda parties, alleging claims for 1) breach of contract, 2) breach of the implied covenant of good faith and fair dealing, 3) negligent

misrepresentation, 4) tortious interference with contractual relations, 5) indemnification on the basis of a special relationship, 6) indemnification on the basis of tortious conduct, 7) breach of the implied warranty of merchantability and 8) breach of the implied warranty of fitness. Shortly thereafter, the Barracuda parties filed the pending motion to dismiss Fusion’s intervenor complaint for failure to state a claim upon which relief can be granted. In December, 2021, after the arbitration had concluded, Fusion and Zoll filed the pending motion to substitute Axis as plaintiff with respect to the original and intervenor

complaints. II. Barracuda’s Motion to Dismiss A. Legal Standard To survive a motion under Fed. R. Civ. P. 12(b)(6), the subject pleading must contain sufficient factual matter to state a claim for relief that is actionable as a matter of law and “plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible if, after accepting as true all non-conclusory factual allegations, the court can draw the reasonable inference that the defendant is liable for the misconduct alleged. Ocasio-Hernandez v. Fortuno-Burset, 640 F.3d 1, 12 (1st Cir. 2011).

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
Cummings v. HPG International, Inc.
244 F.3d 16 (First Circuit, 2001)
Citibank v. Grupo Cupey, Inc.
382 F.3d 29 (First Circuit, 2004)
Braunstein v. McCabe
571 F.3d 108 (First Circuit, 2009)
Negron-Almeda v. Santiago
579 F.3d 45 (First Circuit, 2009)
Ocasio-Hernandez v. Fortuno-Burset
640 F.3d 1 (First Circuit, 2011)
Haley v. City of Boston
657 F.3d 39 (First Circuit, 2011)
Bachorz v. Miller-Forslund
703 F.3d 27 (First Circuit, 2012)
Boston Helicopter Charter, Inc. v. Agusta Aviation Corp.
767 F. Supp. 363 (D. Massachusetts, 1991)
Fall River Hous. Auth. v. HV COLLINS CAPE COD LATH
604 N.E.2d 1310 (Massachusetts Supreme Judicial Court, 1992)
M.J.G. Properties, Inc. v. Hurley
537 N.E.2d 165 (Massachusetts Appeals Court, 1989)
Stewart v. Roy Bros. Inc.
265 N.E.2d 357 (Massachusetts Supreme Judicial Court, 1970)
Zimmerman v. Kent
575 N.E.2d 70 (Massachusetts Appeals Court, 1991)
King v. Driscoll
638 N.E.2d 488 (Massachusetts Supreme Judicial Court, 1994)
MASSACHUSETTS MUNICIPAL WHOLESALE ELECTRIC v. Danvers
577 N.E.2d 283 (Massachusetts Supreme Judicial Court, 1991)
Millen Industries, Inc. v. Flexo-Accessories Co.
5 F. Supp. 2d 72 (D. Massachusetts, 1998)
Blue Hills Office Park LLC v. J.P. Morgan Chase Bank
477 F. Supp. 2d 366 (D. Massachusetts, 2007)

Cite This Page — Counsel Stack

Bluebook (online)
Axis Insurance Company v. Barracuda Networks, Inc., Counsel Stack Legal Research, https://law.counselstack.com/opinion/axis-insurance-company-v-barracuda-networks-inc-mad-2022.