In re Anne Arundel Data Breach Litigation

• Court: District Court, D. Maryland
• Decided: August 19, 2025
• Docket: 1:25-cv-02274
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MARYLAND Chambers of 101 West Lombard Street GEORGE L. RUSSELL, III Baltimore, Maryland 21201 Chief United States District Judge 410-962-4055 August 19, 2025

MEMORANDUM TO PARTIES RE: Correa v. Anne Arundel Dermatology, P.A. Civil Action No. 25-2274 Dear Parties:

Pending before the Court is Plaintiff Natalia Correa’s Motion to Consolidate Actions and Appoint Leadership and Executive Committee (ECF No. 7).1 The Motion is ripe for disposition and no hearing is necessary. See Local Rule 105.6 (D.Md. 2025). For the reasons set forth below, the Court will grant Correa’s Motion in part and deny the Motion in part. Background On or around July 14, 2025, Defendant Anne Arundel Dermatology, P.A. (“Anne Arundel Dermatology”) allegedly issued a notice to Plaintiff Natalia Correa and others, informing them that an unauthorized third-party may have gained access to certain parts of its IT system between February 14, 2025 and May 13, 2025 (“the Data Breach”). (Compl. ¶3, ECF No. 1). As a result of this Data Breach, Correa asserts that the unauthorized third-party likely acquired personally identifiable information and protected health information about Anne Arundel Dermatology’s patients including name, date of birth, medical record number/identification, health history, financial information, insurance information, and appointment history. (Id.¶5).

Correa alleges that Anne Arundel Dermatology “obfuscate[d] the nature of the breach and the threat it posed” because it refused to inform patients “how the breach happened, whether Defendant paid a ransom,” or why it took so long for Anne Arundel Dermatology to notify victims. (Id. ¶6). Correa contends that Anne Arundel Dermatology “should have known that each victim of the Data Breach deserved prompt and efficient notice of the Data Breach and assistance in mitigating” its effects, (id.¶ 8), and that failure to timely report the Data Breach, made the victims “vulnerable to identity theft without any warning[],” (id. ¶ 7).

On July 14, 2025, Correa filed a Class Action Complaint and Demand for Jury Trial against Anne Arundel Dermatology, P.A., individually and on behalf of all others similarly situated, for five counts of: negligence (Count I); negligence per se (Count II); breach of implied contract (Count III); unjust enrichment (Count IV); invasion of privacy (Count V). (Id. at 27–38).2 On behalf of the class, Correa seeks injunctive and declaratory relief, damages, attorneys’ fees and costs. (Id. at 38–40). On July 16, 2025, Correa filed the instant Motion to Consolidate Actions and

1 Also pending is Plaintiff Terri Wilson’s Motion to Consolidate Cases and Appoint Thomas A. Zimmerman, Jr. to Plaintiffs’ Executive Committee (ECF No. 12). Because the Court will consolidate all related actions into a single action the Motion will be denied as moot. 2 Citations to page numbers refer to the pagination assigned by the Court’s Case Management/Electronic Files (“CM/ECF”) system. Appoint Leadership and Executive Committee. (ECF No. 7). Todate, Anne Arundel Dermatology, P.A. has not filed a response tothe pending motion.3 Standard of Review 1. Consolidation Federal Rule of Civil Procedure 42(a)allows courts to consolidate cases if they involve “a common question of law or fact.”Fed.R.Civ.P. 42(a). District courts have “broad discretion” in determining whether to consolidate cases pending in their district. A/S J. Ludwig Mowinckles Rederi v. Tidewater Const. Co., 559 F.2d 928, 933 (4th Cir. 1977). The Fourth Circuit generally directs courts to consider whether “the specific risks of prejudice and possible confusion [are] overborne by the risk of inconsistent adjudications of common factual and legal issues, the burden on [the] parties, witnesses and available judicial resources posed by multiple lawsuits, the length of time required to conclude multiple suits as against a single one, and the relative expense to all concerned of the single-trial, multiple-trial alternatives.”Arnold v. E. Air Lines, Inc., 681 F.2d 186, 193 (4th Cir. 1982). 2. Appointment of Counsel Under Rule 23(g)(3) of the Federal Rules of Civil Procedure, the Court may “designate interim counsel to act on behalf of a putative class before determining whether to certify the action as a class action.” Fed.R.Civ.P. 23(g)(3). When appointing interim class counsel, courts look to factors set out in Rule 23(g)(1) to determine the adequacy of counsel: “(i) the work counsel has done in identifying or investigating potential claims in the action; (ii) counsel’s experience in handling class actions, other complex litigation, and the types of claims asserted in the action; (iii) counsel’s knowledge of the applicable law; and (iv) the resources that counsel will commit to representing the class.” Fed.R.Civ.P. 23(g)(1)(A); see Riddick v. MedStar Health, No. BAH-24- 1335, 2024 WL 4712390, at *2 (D.Md. Nov. 7, 2024). The Court may also consider “any other matter pertinent to counsel’s ability to fairly and adequately represent the interests of the class.” Fed.R.Civ.P. 23(g)(1)(B). Analysis In Correa’s Motion, she asks the Court to: (1) consolidate all related actions against Anne Arundel Dermatology and (2) appoint co-lead class counsel, liaison class counsel, and an executive committee. (Correa Mot. Consolidate Actions at 3–4, ECF No. 7). For reasons discussed more fully below, the Court will grant the request to consolidate all related actions and appoint co-lead class counsel and liaison class counsel. The Court will deny the request to appoint an executive committee. 1. Consolidation The Court first considers Correa’s request to consolidate all related actions. (Correa Br. Supp. Mot. Consolidate [“Correa Mot.”] at 10, ECF No. 7-1). To date, twenty-one (21) class actions have been filed in this Court against Anne Arundel Dermatology, P.A.4 The actions share

3 Anne Arundel Dermatology, P.A. waived service of summons on August 8, 2025. (ECF No. 13). 4 1:25-cv-02274-GLR; 1:25-cv-02279-GLR; 1:25-cv-02278-GLR; 1:25-cv-02282-GLR; 1:25-cv-02290-GLR; 1:25-cv-02293-GLR; 1:25-cv-02288-GLR; 1:25-cv-02297-GLR; 1:25-cv- 02314-GLR; 1:25-cv-02322-GLR; 1:25-cv-02336-GLR; 1:25-cv-02341-GLR; 1:25-cv-02369- common questions of law and fact as they all arise out the same Data Breach that affected Anne Arundel Dermatology, P.A. (Correa Mot. at 10). Plaintiffs allege similar injuries, including invasion of privacy, financial costs associated with mitigating risk of identity theft, loss of time and loss of productivity to detection and prevention of identity theft, and failure to receive the benefit of the bargain, among other things. (Id.; see, e.g., Compl. ¶¶6,7; Buracker v. Anne Arundel Dermatology, 25-cv-02279-GLR, Compl. [“Buracker Compl.”] ¶ 10, ECF No. 1). Further, many of the claims and relief sought in the complaints overlap. (CompareCorrea Compl. at 27–37, with Buracker Compl. at 34–55); see Mikell v. Tycon Med. Sys., Inc., No. 2:25-CV- 19, 2025 WL 720001, at *3 (E.D.Va. Mar. 6, 2025) (consolidating where all cases allege claims against single defendant arising out of data breach and many of the claims and relief in the complaints overlap); Darrin v. Huntington Ingalls Indus., No. 4:23-cv-53, 2023 WL 4938072, at *1 (E.D.Va. July 6, 2023) (same). And the risks of prejudice and possible confusion are low because the cases in their early stages. Moreover, no putative class members oppose consolidation or assert any burdens or expenses causes by consolidating. Accordingly, the Court finds that combining the cases serves the purposes of Rule 42(a) and will consolidate all related class actions into a single action. 2. Appointment of Counsel & Leadership Structure

The Court next turns to Correa’s request to appoint Gary Klinger of Milberg Coleman Bryson Phillips Grossman, PLLC and Tyler Bean of Siri & Glimstad, LLP asinterim co-lead class counsel, Gary E. Mason of Mason LLP as liaison class counsel, and an executive committee. (Correa Mot. at 17–28). Correa asserts that the proposed attorneys and firms are “ideally qualified to represent and protect the interests of the proposed classes.” (Id. at 8). The Court reviews each request in turn.

i. Interim Co-Lead Class Counsel & Liaison Counsel As stated earlier, Rule 23(g)(1) outlines four factors that courts should consider when appointing interim class counsel. Courts in this district have evaluated these same factors when considering liaison counsel. See, e.g., Mikell, 2025 WL 720001, at *4 (applying Rule 23(g)(1)(A) factors to determine appointment of interim lead counsel and liaison counsel). For the reasons that follow, theCourt finds that all four factors support appointing proposed co-lead interim and liaison counsel as requested.5

The first factor–—the work counsel has done in identifying or investigating potential claims in the action—supports appointing Klinger, Bean, and Mason as interim co-lead counsel and liaison counsel because “immediately after the public announcement of the Data Breach,” proposed counsel investigated “potential legal claims and remedies for the victims of the breach,” including “researching and discovering the facts surrounding the [breach];” interviewing many of those affected; drafting initial pleadings; and organizing plaintiffs for unified proceedings. (Correa

GLR; 1:25-cv-02384-GLR; 1:25-cv-02396-GLR; 1:25-cv-02406-GLR; 1:25-cv-02459-GLR; 1:25-cv-02476-GLR; 1:25-cv-02486-GLR; 1:25-cv-02703-GLR; 1:25-cv-02324-GLR. 5 The appointment of three or more law firms as class counsel in a data breach case such as this is not unusual. See, e.g., Mikell v. Tycon Med. Sys., Inc., No. 2:25-CV-19, 2025 WL 720001, at *4 (E.D.Va. Mar. 6, 2025). Moreover, data breach class action cases can be “particularly risky, expensive, and complex, and they present significant challenges to plaintiffs at the class certification stage.” Gordon v. Chipotle Mexican Grill, Inc., No. 17-cv-01415, 2019 WL 6972701, at *1 (D.Colo. Dec. 16, 2019). Mot. at 15). The second and third factors—experience and knowledge of the applicable law—also weigh in favor of appointing proposed interim co-lead and liaison counsel. Proposed counsel and their firms have extensive experience leading complex class actions, including data breach cases such as this one. (See generally, Milberg Resume, ECF No. 7-2; Siri & Glimstad Resume, ECF No. 7-3; Mason LLP Resume, ECF No. 7-4). Specifically, proposed counsel Klinger has settled more than 100 class actions involving privacy violations as lead or co-lead counsel; proposed counsel Bean has successfully litigated dozens of data breach and privacy class actions from inception through settlement; and proposed counsel Mason was the first attorney to “successfully settle a privacy case on a class-wide basis against Google, serving as the court-appointed lead counsel.”(Correa Mot. at 18–19, 22).These accomplishments and qualifications not only highlight proposed counsels’ wealth of experience but also suggest that the attorneys have a strong command of the applicable law, as required under Rule 23. Finally, the Court is satisfied that proposed counsel has substantial resources that they are willing to commit to representing the class. See Fed.R.Civ.P. 23(g)(1)(A)(iv). Counsel are partners at well-established law firms that have the funds and resources to litigate this case. (See generally, Milberg Resume; Siri & Glimstad Resume; Mason LLP Resume). They represent that they will not accept third-party litigation funding and will continue to expend “not merely financial [resources] but also . . . substantial expertise and work-product developed in other similar cases” to benefit the putative class. (Correa Mot. at 24, 27). Accordingly, the Court finds that all four Rule 23(g) factors support appointing proposed interim co-lead counsel and liaison counsel. ii. Executive Committee At this stage of the litigation, the Court is not persuaded that it is necessary or appropriate to appoint an Executive Committee. Committees of counsel are most commonly needed when group members’interests and positions are sufficiently dissimilar to justify giving them representation in decision making . . . . They often compete against considerations of efficiency and economy...and can lead to substantially increased costs and unnecessary duplication of efforts. In re Gerber Prods. Co. Heavy Metals Baby Food Litig., No. 121CV269MSNJFA, 2022 WL 1494378, at *3 (E.D.Va. May 10, 2022) (quoting In re 5-Hour Energy Mktg. v. Innovation Ventures, LLC, No. 13-4001-PSG, 2013 WL 12134144, at *2 (C.D.Cal. Nov. 8, 2013) (citation modified)). The Court should “establish a committee if the litigation involves numerous complex issues, if there is a substantial amount of work to be done, or if the plaintiffs have different interests that require separate representation.” Id. However, “[c]ourts routinely deny requests for appointment of executive committees where plaintiffs fail to demonstrate that such appointment is necessary.” Id.; see In re 5-Hour Energy Mktg. v. Innovation Ventures, LLC, 2013 WL 12134144, at *2 (denying appointment of an executive committee where the court is confident that interim co-lead class counsel “will assign and organize work in a way that best serves the interests of the proposed class members”).

Here, this action arises from one data breach and is comprised of lawsuits with nearly identical common law claims. (See Compl. at 27–37). Plaintiffs do not argue that it involves numerous complex issues. Rather, Plaintiffs allege the same or substantially similar harm, and do not allege different interests requiring separate representation. (See generally Compl. ¶¶6,7; Buracker Compl. ¶10). Moreover, Correa has not specified any roles or tasks that warrant appointment of the proposedexecutive committee. (Seegenerally, Correa Mot.). As such,the Court does not find it necessary to appointan executive committee in addition to proposed interim co-lead counsel and liaison counsel. When evaluating similar requests for the appointment of an executive committee, other courts in this district have reached the same conclusion. See, e.g., Mikell, 2025 WL 720001, at *6 (denying appointment of executive committee in data breach case because case stemmed from one data breach and was comprised of lawsuits with similar claims and harms).Accordingly, at this stage, the Court will deny the request to appoint an executive committee without prejudice. Conclusion

For the foregoing reasons, Correa’s Motion to Consolidate Actions and Appoint Leadership and Executive Committee (ECF No. 7) is GRANTED IN PART as to consolidation and appointment of proposed interim co-lead counsel and liaison counsel, and DENIED IN PART as to the appointment of proposed executive committee without prejudice. Wilson’s Motion to Consolidate Cases and Appoint Thomas A. Zimmerman, Jr. to Plaintiffs’ Executive Committee (ECF No. 12) is DENIED AS MOOT. It is further ORDERED that the following cases are CONSOLIDATED: 1:25-cv-02274-GLR; 1:25-cv-02279-GLR; 1:25-cv-02278-GLR; 1:25-cv- 02282-GLR; 1:25-cv-02290-GLR; 1:25-cv-02293-GLR; 1:25-cv-02288-GLR; 1:25-cv-02297- GLR; 1:25-cv-02314-GLR; 1:25-cv-02322-GLR; 1:25-cv-02336-GLR; 1:25-cv-02341-GLR; 1:25-cv-02369-GLR; 1:25-cv-02384-GLR; 1:25-cv-02396-GLR; 1:25-cv-02406-GLR; 1:25-cv- 02459-GLR; 1:25-cv-02476-GLR; 1:25-cv-02486-GLR; 1:25-cv-02703-GLR; 1:25-cv-02324- GLR. All filings should be made in the lead case, 1:25-cv-02274-GLR, and shall bear the following case caption: In re Anne Arundel Data Breach Litigation. It is further ORDERED that Gary Klinger of Milberg Coleman Bryson Phillips Grossman, PLLC and Tyler Bean of Siri & Glimstad, LLP are hereby APPOINTED as interim co-lead class counsel, and Gary E. Mason of Mason LLP is hereby APPOINTED as interim liaison class counsel. It is further ORDERED that Plaintiffs shall FILE an amended, consolidated Complaint within thirty (30) days of the date of this Order. It is further ORDERED that Defendant Anne Arundel Dermatology, P.A. shall ANSWER the Amended Complaint as required by the Federal Rules of Civil Procedure and the Local Rules of this Court. Despite the informal nature of this memorandum, it shall constitute an Order of the Court, and the Clerk is directed to docket it accordingly.

/s/ George L. Russell, III ChiefUnited States District Judge