In re Accellion, Inc. Data Breach Litigation

• Court: District Court, N.D. California
• Decided: October 28, 2024
• Docket: 5:21-cv-01155
• Status: Unknown

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 Case No. 21-cv-01155-EJD IN RE ACCELLION, INC. DATA 9 BREACH LITIGATION ORDER DENYING MOTIONS TO DISMISS AND FOR 10 RECONSIDERATION

11 Re: ECF Nos. 244, 271 12

13 In December 2020 and January 2021, hackers breached a secure file transfer application 14 offered by Defendant Accellion, Inc. and widely used by entities who handled sensitive personal 15 information. This breach exposed millions of individuals’ private data. In response, Plaintiffs 16 filed this putative class action against Accellion. Now before the Court are two motions. First is 17 Accellion’s motion to dismiss Plaintiffs’ negligence claim. Second is Plaintiffs’ motion for 18 reconsideration of an earlier order dismissing their Confidentiality of Medical Information Act 19 (“CMIA”) claim. After reviewing the parties’ written submissions, the Court finds oral argument 20 to be unnecessary under Local Rule 7-1(b). The Court DENIES both motions. 21 I. BACKGROUND 22 A. Factual Allegations 23 Accellion is a “cloud solutions company” that develops and offers products for 24 “prevent[ing] data breaches and compliance violations from third party cyber risk.” Am. Consol. 25 Class Action Compl. (“Amended Complaint” or “Am. Compl.”) ¶ 25, ECF No. 248.1 Among 26 1 Plaintiffs initially filed a redacted version of the Amended Complaint at ECF No. 230. The 27 Court cites to the unredacted version throughout this Order. 1 Accellion’s offerings is a product called the File Transfer Appliance (“FTA”). Id. ¶ 26. Accellion 2 designed the FTA to securely transfer files as an alternative to email, particularly in those 3 situations where file sizes exceed the limits for email attachments. Id. To use the FTA, a person 4 uploads the files to be transferred. Then, that person sends a link to the intended recipient from 5 which the recipient can view or download those files. Id. FTA file transfers often involved 6 sensitive personally identifiable information such as Social Security numbers, demographic 7 information, and medical records. Id. ¶ 32. 8 Accellion began offering the FTA in the early 2000s. Id. ¶ 26. By December 2020, the 9 FTA was nearly 20 years old and approaching its end of life. Id. ¶ 34. Accellion allegedly 10 recognized that the FTA had become outdated and encouraged its clients to upgrade to a newer, 11 more secure file transfer product called Kiteworks. Id. Still, Accellion continued to make the 12 FTA available, albeit with fewer resources devoted to maintaining that older product. Id. ¶ 35. 13 On December 16, 2020, the FTA’s built-in anomaly detector notified an Accellion client 14 that unauthorized third parties had breached the system. Id. ¶ 39. The client alerted Accellion, 15 and when Accellion investigated the issue, it confirmed that the FTA contained security 16 vulnerabilities. Id. Over the following week, Accellion released patches to address those 17 vulnerabilities. Id. ¶ 40. Despite Accellion’s efforts, a second breach occurred on January 20, 18 2021. Id. ¶ 43. Accellion learned about this breach two days later and identified two more 19 security vulnerabilities. Id. ¶ 44. According to Plaintiffs, Accellion struggled to fix those 20 vulnerabilities. Id. ¶¶ 47–51. 21 Plaintiffs allege that these breaches exposed their personally identifiable information, 22 subjecting them to injuries such as identity theft and fraudulent credit charges. Id. ¶ 4. 23 B. Procedural History 24 In their original Consolidated Class Action Complaint (“Original Complaint” or “Original 25 Compl.”), ECF No. 170, Plaintiffs raised eleven claims. Accellion moved to dismiss all eleven 26 claims, Mot. to Dismiss Original Compl., ECF No. 174, and the Court mostly granted Accellion’s 27 motion. Order Granting in Part & Den. in Part Mot. to Dismiss (“Prior Order”), ECF No. 217. As 1 relevant here, the Court allowed Plaintiffs’ negligence claim to proceed and dismissed Plaintiffs’ 2 CMIA claim with leave to amend. Id. at 15, 24. When Plaintiffs filed their Amended Complaint, 3 they did not renew their CMIA claim or otherwise attempt to correct the deficiencies in their 4 CMIA claim. Instead, Plaintiffs only brought the two claims for which the Court had denied the 5 motion to dismiss: negligence and one other claim not pertinent here. Am. Compl. ¶¶ 122–56. 6 Although the Court previously found that the Original Complaint stated a claim for 7 negligence, Accellion moved again to dismiss that same claim from the Amended Complaint. 8 Mot. to Dismiss Am. Compl. (“MTD Mot.”), ECF No. 244. In its motion, Accellion challenges 9 only one element of Plaintiffs’ renewed negligence claim, arguing that the amended allegations do 10 not establish a special relationship between Accellion and Plaintiffs such that Accellion owed a 11 duty of care to Plaintiffs.2 After the parties finished briefing this second motion to dismiss, 12 Plaintiffs requested permission to file a motion for reconsideration of the Court’s Prior Order 13 dismissing their CMIA claim. Mot. for Leave to File, ECF No. 266. The Court granted leave to 14 file, ECF No. 269, and Plaintiffs subsequently filed their motion. Mot. for Reconsideration 15 (“Recon. Mot.”), ECF No. 271. 16 II. MOTION TO DISMISS 17 A. Legal Standard 18 To survive a Rule 12(b)(6) motion for failure to state a claim, a complaint must contain 19 sufficient factual allegations to make out a plausible legal claim. Ashcroft v. Iqbal, 556 U.S. 662, 20 678 (2009) (citation omitted). In determining whether the complaint states a plausible claim, 21 courts “accept as true all factual allegations in the complaint and draw all reasonable inferences in 22 favor of the nonmoving party.” Retail Prop. Tr. v. United Bhd. of Carpenters & Joiners of Am., 23 2 Accellion also raises choice of law issues. However, choice of law in this case is a fact-intensive 24 exercise better suited for later stages of litigation when the parties may present evidence on the issue. In re Apple Inc. Device Performance Litig., 386 F. Supp. 3d 1155, 1170 (N.D. Cal. 2019). 25 Deferring choice of law issues is all the more appropriate here because the parties should have completed most of their discovery on choice of law already, and class certification briefing is due 26 in less than two months, providing an opportunity for Accellion to brief choice of law with the aid of evidence in the near future. Therefore, the Court declines to address choice of law in this 27 Order. 1 768 F.3d 938, 945 (9th Cir. 2014). But courts “are not bound to accept as true a legal conclusion 2 couched as a factual allegation.” Iqbal, 556 U.S. at 678 (citation omitted). 3 B. Discussion 4 1. Law of the Case 5 The Court begins by addressing Plaintiffs’ threshold argument that law of the case bars the 6 Court from granting Accellion’s motion to dismiss. Plaintiffs assert that law of the case applies 7 because the Court had previously rejected the sole argument that Accellion advances in its instant 8 motion. Opp’n to MTD Mot. (“MTD Opp’n”) 6, ECF No. 250. If Plaintiffs are correct that law of 9 the case applies, Accellion faces a higher burden to dismiss Plaintiffs’ negligence claim from the 10 Amended Complaint than it would typically face on a Rule 12(b)(6) motion. Namely, Accellion 11 would need to show that the Court’s prior special relationship finding was wrong due to “clear 12 error, changed law, new evidence, changed circumstances, or manifest injustice.” Askins v. U.S. 13 Dep’t of Homeland Sec., 899 F.3d 1035, 1043 (9th Cir. 2018). However, Plaintiffs are incorrect 14 about law of the case. Motion practice regarding an amended complaint “does not ask the court to 15 reconsider its analysis of the initial complaint” because an “amended complaint is a new 16 complaint.” This means that the parties are “entitl[ed] [] to judgment on the [new] complaint’s 17 own merits” rather than on the initial complaint’s merits. Id. As such, the Court “is not . . . bound 18 by any law of the case.” Id. 19 Although the Court is not bound in any way by its Prior Order, the Court’s earlier decision 20 is still relevant. So long as the Court does not hold Accellion to the higher standard for 21 overcoming law of the case, if the Court “determines the [A]mended [C]omplaint is substantially 22 the same as the initial complaint, the [Court] is free to follow the same reasoning” and to “decide 23 the second motion to dismiss in the same way it decided the first.” Id. Accellion asserts that the 24 Court should not even do that because there is a key difference between the Original and Amended 25 Complaints. The Original Complaint alleges that Accellion itself stored, transferred, and 26 maintained Plaintiffs’ personal information. Original Compl. ¶¶ 30, 62, 63, 114, 116. But the 27 Amended Complaint alleges that Accellion’s product (the FTA) stored, transferred, and 1 maintained that personal information. Am. Compl. ¶¶ 32, 72, 73, 123, 125. Contrary to 2 Accellion’s suggestion, though, this is not a substantial difference that renders the Court’s prior 3 reasoning inapt. As the Court explains further below, it makes no material difference whether 4 Accellion or its product is alleged to have transferred Plaintiffs’ personal information since 5 Accellion is responsible for its product. Thus, the differences between the Original and Amended 6 Complaints are no basis for the Court to abandon its prior reasoning. 7 2. Special Relationship 8 As the Court previously explained, California courts consider whether four factors are 9 present when determining if a special relationship exists: (1) dependence, (2) control, (3) limits to 10 the scope of the community to which a duty of care is owed, and (4) benefits to the duty-holder. 11 Prior Order 6–7 (quoting Regents of Univ. of Cal. v. Superior Ct., 4 Cal. 5th 607, 620–21 (2018)). 12 While the Amended Complaint’s new allegations do not alter the Court’s earlier conclusions 13 regarding these four factors, Accellion has further developed its arguments since its first motion to 14 dismiss. Therefore, the Court discusses those newly developed arguments factor-by-factor. 15 Dependence. Special relationships typically involve “an aspect of dependency,” meaning 16 that “one party relies to some degree on the other for protection.” Regents, 4 Cal. 4th at 620. The 17 degree of reliance that justifies a special relationship is high; historically, courts have recognized 18 special relationships only where “the plaintiff is particularly vulnerable.” Id. at 621 (citations 19 omitted). The Original Complaint cleared this bar because its allegations showed “there [was] no 20 reason to believe that Plaintiffs could have secured their [personal information] themselves when 21 it was sent using Accellion’s FTA software.” Prior Order 7. Put differently, because there was 22 nothing Plaintiffs could have personally done to secure their information, they needed to rely on 23 the FTA’s security features to protect their information. By extension, Plaintiffs’ reliance on 24 Accellion’s FTA software meant that Plaintiffs depended on Accellion, the entity responsible for 25 developing and updating the FTA, for protection. This logic still applies with equal force now that 26 Plaintiffs allege Accellion’s FTA software, rather than Accellion itself, transferred and maintained 27 their personal information. If anything, Plaintiffs’ amendments reinforce the first link in that 1 logical chain—that Plaintiffs relied on the FTA. 2 The remainder of Accellion’s arguments on dependence are unconvincing. First, Accellion 3 argues there were no allegations that it created the risk of data breach, that it induced detrimental 4 reliance, or that it induced a false sense of security. MTD Mot. 13. Accellion confuses different 5 sources of tort duty. Creation of risk is a separate source of duty than a special relationship, 6 Brown v. USA Taekwondo, 11 Cal. 5th 204, 214–15 (2021), so whether Accellion was responsible 7 for the risk faced by Plaintiffs is not germane to the dependence analysis. Second, Accellion 8 claims that this case is analogous to Tristan v. Bank of America, No. 22-cv-1183, 2023 WL 9 4417271 (C.D. Cal. June 28, 2023), and to Moriarty v. Bayside Insurance Associates, Inc., No. 20- 10 56139, 2021 WL 4061105 (9th Cir. Sept. 7, 2021), two cases where courts found that no special 11 relationship existed. But Tristan and Moriarity are distinguishable from this case because the 12 plaintiffs there had the ability to protect themselves, unlike Plaintiffs here. In Tristan, the 13 plaintiffs were victims of scams that solicited money through the payment platform Zelle. 2023 14 WL 4417271, at *1–2. The Tristan plaintiffs were not particularly vulnerable, though, because the 15 scammers were in direct contact with them. Id. Thus, the Tristan plaintiffs could have protected 16 themselves through their own vigilance. Similarly, in Moriarty, which involved an alleged failure 17 to warn about unpaid insurance premiums, the plaintiffs could have protected themselves by 18 keeping closer track of their own insurance payments. 2021 WL 4061105, at *1. 19 Control. “The corollary of dependence in a special relationship is control.” Regents, 4 20 Cal. 5th at 621. That is, plaintiffs depend on the defendant in a special relationship because the 21 defendant “has superior control over the means of protection.” Id. Like the Original Complaint, 22 the Amended Complaint establishes that Accellion had control over the FTA because Accellion 23 had the power to issue patches for security vulnerabilities in the FTA. Am. Compl. ¶¶ 40, 43. 24 Accellion suggests that this is not enough control because Accellion’s customers (such as the 25 government agencies and banks that collected Plaintiffs’ personal information) had the ultimate 26 responsibility for ensuring security, and because those customers could have rejected Accellion’s 27 security patches. MTD Mot. 13–14. The latter defies common sense. See Iqbal, 556 U.S. at 1 663–64 (“[D]etermining whether a complaint states a plausible claim is context specific, requiring 2 the reviewing court to draw on its experience and common sense.”). As a practical matter, it is 3 highly unlikely that entities like banks, which deal with sensitive information and require high 4 levels of security, would refuse to implement critical security patches offered by Accellion. More 5 fundamentally, control requires a defendant to be in a “unique position to protect the plaintiff from 6 injury.” Brown, 11 Cal. 5th at 216. It does not require the defendant to be the only one capable of 7 offering protection. Accellion’s customers may have been able to offer additional protection to 8 Plaintiffs, but it is Accellion who was uniquely positioned to patch security vulnerabilities in the 9 FTA. There is no indication that any other party could have provided the necessary patches. 10 Scope. Special relationships must also be “limited to specific individuals.” Regents, 4 11 Cal. 5th at 621. As the Court previously held, the relationship proposed by Plaintiffs here satisfies 12 that requirement because it “exists only between Accellion and those specific individuals whose 13 information the FTA software ferries.” Prior Order 8. Accellion resists this conclusion, arguing 14 that under this definition, the identities of those individuals benefiting from the proposed special 15 relationship are unknown. MTD Mot. 15. “Unknown,” however, does not have the same meaning 16 as “unlimited” or “unknowable.” If the beneficiaries of Plaintiffs’ proposed relationship were 17 truly unlimited or unknowable, the proposed relationship would be problematic. But that is not 18 the case here. The special relationship’s scope is not unlimited because the FTA did not transfer 19 everyone’s data. And the special relationship’s scope is not unknowable because discovery from 20 Accellion’s clients could reveal the specific beneficiaries of this relationship. The fact that the 21 exact identities of the beneficiaries are unknown at this very moment, or that it might be difficult 22 to ascertain those identities, does not improperly broaden the scope of the proposed special 23 relationship. 24 Benefit. As Accellion concedes, it “benefitted from its commercial activity of providing 25 the FTA to customers.” MTD Mot. 15. So this last factor also supports finding that a special 26 relationship exists. 27 * * * 1 Based on the Amended Complaint, all four factors support finding a special relationship, 2 just as all four factors supported finding a special relationship under the Original Complaint.3 3 Therefore, Accellion’s argument fails, and the Court DENIES its motion to dismiss. 4 III. MOTION FOR RECONSIDERATION 5 A. Legal Standard 6 A motion for reconsideration is an “extraordinary remedy” that “should not be granted[] 7 absent highly unusual circumstances.” Dairy v. Bonham, 25 F. Supp. 3d 1284, 1286 (N.D. Cal. 8 2014) (citations omitted). It is usually only appropriate to grant reconsideration in one of three 9 circumstances: (1) there is newly discovered evidence; (2) the court previously committed clear 10 error or made a manifestly unjust decision; or (3) there is an intervening change in controlling law. 11 Hiramanek v. Clark, No. 5:13-cv-00228-RMW, 2016 WL 11033962, at *1 (N.D. Cal. Mar. 29, 12 2016). Plaintiffs move for reconsideration under only the third ground. Recon. Mot. 4. 13 B. Discussion 14 Plaintiffs ask for reconsideration4 of the Court’s earlier decision to dismiss their CMIA 15 claim. In its Prior Order, the Court found that Plaintiffs failed to state a CMIA claim because they 16 did not allege facts showing that Accellion was a “provider of health care” covered by the CMIA. 17 Prior Order 22–24. Specifically, the Court held that Accellion did not meet the definitions for a 18 provider of health care under either of California Civil Code §§ 56.06(a) or (b). Plaintiffs now 19 claim that the California Court of Appeal’s recent decision in J.M. v. Illuminate Education, Inc., 20 103 Cal. App. 5th 1125 (2024), changes the landscape for § 56.06. But even if Illuminate changed 21

22 3 Accellion also briefly argues that no duty exists because Plaintiffs’ amendments show that 23 Accellion had no “threshold level of interaction[]” with Plaintiffs. MTD Mot. 16. Accellion misreads the Court’s Prior Order. There, the Court held that a duty of care can extend beyond 24 “those with whom [a defendant] shares privity” and can also extend beyond relationships with “some threshold level of interactions.” Prior Order 9. Thus, the Court did not hold that special 25 relationships require some minimum interaction. 4 Accompanying Plaintiffs’ reconsideration motion is a motion for leave to amend. The request to 26 amend the complaint to add a CMIA claim is an extension of the reconsideration motion, so the Court does not address it separately—the Court’s ruling on the reconsideration motion applies 27 equally to the motion for leave to amend. 1 the law, it did not do so in a way that affects the Court’s previous CMIA ruling. 2 To begin, § 56.06(a) defines a “provider of health care” in relevant part as a “business 3 organized for the purpose of maintaining medical information.” The Court held that, in the 4 Original Complaint, Plaintiffs failed to show that Accellion fell under the § 56.06(a) definition 5 because Plaintiffs’ allegations were insufficient. Prior Order 22–23. Plaintiffs made only two 6 allegations about Accellion’s purpose. The first allegation was conclusory and therefore 7 insufficient under Iqbal. Id. at 22 (quoting allegation in Original Compl. ¶ 167 that “Accellion is 8 organized in part for the purpose of maintaining medical information”). The second allegation 9 was not conclusory, but it was insufficient to plead purpose by itself. Plaintiffs alleged that 10 Accellion sold its file-sharing services to hospitals and other medical professionals. Id. at 23 11 (quoting Original Compl. ¶ 167). But this showed only that hospitals and medical professionals 12 had discovered that Accellion’s products could be useful, not that Accellion had purposefully 13 designed its products to appeal to medical professionals. So, the Court accepted Accellion’s 14 argument that there was a “lack of pleaded facts suggesting that Accellion is organized at all for 15 [the] purpose” required by § 56.06(a). Reply in Support of Mot. to Dismiss Original Compl. 9, 16 ECF No. 187. 17 Accellion’s motion for reconsideration does not address this pleading defect. Instead, 18 Accellion focuses on a statutory interpretation dispute that the parties had raised in their briefs on 19 the first motion to dismiss but that the Court did not address in the Prior Order: Whether 20 § 56.06(a) requires Plaintiffs to plead that maintaining medical information was Accellion’s sole 21 purpose or if it is enough that maintaining such information was one of Accellion’s purposes. 22 Recon. Mot. 5–6. According to Plaintiffs, Illuminate establishes that the latter interpretation is 23 correct. However, because the Court did not dismiss Plaintiffs’ CMIA claim on the basis that 24 § 56.06(a) covers only companies whose sole purpose is to maintain medical information, even 25 assuming that Illuminate changed the law as Plaintiffs suggests, Illuminate is not relevant to the 26 Court’s prior ruling on § 56.06(a). Thus, Illuminate cannot be a basis for reconsidering the 27 Court’s § 56.06(a) ruling. 1 Illuminate does not change the Court’s § 56.06(b) analysis either. In its Prior Order, the 2 Court found that Accellion was not a provider of health care under § 56.06(b) because it did not 3 offer its software directly to individual consumers. Prior Order 23. Section 56.06(b) applies to 4 businesses that offer software to “consumers,” Cal. Civ. Code § 56.06(b), which the Court 5 construed to mean “individual consumers.” Prior Order 23. [/Juminate did not construe the word 6 || “consumer” in § 56.06(b), so it is not relevant to the Court’s prior § 56.06(b) ruling, either. 7 Accordingly, the Court DENIES Plaintiffs’ motion for reconsideration. 8 IV. CONCLUSION 9 The Court DENIES Accellion’s motion to dismiss and Plaintiffs’ motion for 10 reconsideration. 11 IT IS SO ORDERED. e 12 Dated: October 28, 2024 EDWARD J. DAVILA 15 United States District Judge 16

= 17

Z 18 19 20 21 22 23 24 25 26 27 28 Case No.: 21-cv-01155-EJD ORDER DEN. MOTS. TO DISMISS & FOR RECONSIDERATION