In re Hannaford Bros.

293 F.R.D. 21, 2013 WL 1182733, 2013 U.S. Dist. LEXIS 39055
CourtDistrict Court, D. Maine
DecidedMarch 20, 2013
DocketNo. 2:08-MD-1954-DBH
StatusPublished
Cited by15 cases

This text of 293 F.R.D. 21 (In re Hannaford Bros.) is published on Counsel Stack Legal Research, covering District Court, D. Maine primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
In re Hannaford Bros., 293 F.R.D. 21, 2013 WL 1182733, 2013 U.S. Dist. LEXIS 39055 (D. Me. 2013).

Opinion

[23]*23DECISION AND ORDER ON PLAINTIFFS’ REVISED AND SUPPLEMENTED MOTION FOR CLASS CERTIFICATION

D. BROCK HORNBY, District Judge.

Hannaford grocery stores suffered a massive technological intrusion at their retail points of sale during the period December 7, 2007 through March 10, 2008. Customers’ debit and credit card data was stolen, and many lawsuits against Hannaford followed. After rulings by the Maine Supreme Judicial Court sitting as the Law Court and by the Court of Appeals for the First Circuit, the claims against Hannaford have been pared down to negligence and breach of implied contract, and the damages are limited to out-of-pocket expenditures customers made in reasonable attempts to mitigate against economic injury. Four named plaintiffs now have moved for certification of a Rule 23(b)(3) class to pursue claims for fees to obtain new cards; fees paid to expedite delivery of new cards; and fees paid for identity theft insurance and credit monitoring. The defendant Hannaford has objected. After oral argument on November 30, 2012, I find that the plaintiffs fail to meet the predominance requirement of Rule 23(b)(3) and Deny the motion for class certification.

Procedural History

The plaintiffs are grocery store customers of the defendant Hannaford.1 They claim that a third party criminally breached Hannaford’s information technology systems at the retail point of sale and gained access to the customers’ confidential financial and personal information during a 3-month period as a result of negligence and breach of implied contract on Hannaford’s part. They filed class action lawsuits in this District and in other Districts. The Judicial Panel on Multidistrict Litigation transferred all the lawsuits here.

The plaintiffs then filed a consolidated complaint that alleged seven claims against Hannaford. Hannaford moved under Rule 12(b)(6) to dismiss all claims for failure to state a cause of action.

I dismissed four of the plaintiffs’ seven claims for failure to state a claim. I allowed three to proceed, but only as to a plaintiff who, as a result of the intrusion, had in[24]*24curred fraudulent charges and had not been reimbursed. Otherwise, I ruled that the plaintiffs had suffered no injury cognizable under Maine law. Thereafter, the plaintiffs stipulated that in fact that particular plaintiff had received reimbursement. I then dismissed the consolidated class action complaint in its entirety either for failure to state a claim or for lack of cognizable injury, but I delayed entry of judgment while I certified to the Maine Supreme Judicial Court sitting as the Law Court the question:

(1) In the absence of physical harm or economic loss or identity theft, do time and effort alone, spent in a reasonable effort to avoid or remediate reasonably foreseeable harm, constitute a cognizable injury for which damages may be recovered under Maine law of negligence and/or implied contract? 2

In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 671 F.Supp.2d 198, 201 (D.Me.2009).

The Law Court answered no, agreeing with me that time and effort alone do not constitute a cognizable harm under Maine Law. In re Hannaford Bros. Co. Customer Data Sec. Breach Litig., 4 A.3d 492, 498 (Me.2010). I then entered judgment in favor of Hannaford, dismissing all claims.

On appeal, the First Circuit upheld my dismissal of five claims. But on negligence and breach of implied contract—where I ruled that the plaintiffs had stated a claim, but had not alleged cognizable injury for which to obtain relief—the Circuit ruled that the plaintiffs had sufficiently alleged categories of damages that were not time and effort alone and that were reasonably foreseeable mitigation costs that constitute cognizable harm under Maine law. Those were the fees for replacing cards and the cost of data theft protection products. As a result, the First Circuit ruled, the plaintiffs could proceed on their negligence and breach of implied contract claims, and it vacated and remanded accordingly. Anderson v. Hannaford Bros. Co., 659 F.3d 151 (1st Cir.2011).

Upon remand, the plaintiffs filed this new motion for class certification under Rule 23(b)(3), recasting their proposed class in light of the law of the case. The proposed class now is:

All persons or entities anywhere in the United States who made purchases at stores owned or operated by Defendant or for which Defendant provided electronic payment processing services, during the period from December 7, 2007 through March 10, 2008, using debit or credit cards, and who made reasonable out of pocket expenditures in mitigation of the consequences to them of an electronic breach of Defendant’s data security during this period consisting of 1) payment of fees to obtain prompt replacement of cancelled cards and 2) purchase of security products such as credit monitoring and identity theft insurance.

In other words, the proposed class now is limited to Hannaford customers who incurred out-of-pocket costs in mitigation efforts that they undertook in response to learning of the data intrusion.

Analysis

I proceed to assess whether the plaintiffs satisfy the Rule 23(a) and (b)(3) criteria:

A. Rule 23(a)

1. Numerosity

The proposed class consists of those customers who spent money to obtain prompt replacement of their cards and/or purchased credit monitoring and identity theft insurance. Is their number sufficient to satisfy the numerosity requirement?

The numerosity requirement is satisfied when “the class is so numerous that joinder of all members is impracticable.” Fed.R.Civ.P. 23(a)(1). There is no strict numerical test; “[t]he numerosity requirement requires examination of the specific facts of each ease and imposes no absolute limitations.” Gen. Tel. Co. v. EEOC, 446 U.S. 318, 329-30, 100 S.Ct. 1698, 64 L.Ed.2d 319 [25]*25(1980). Although numbers alone are “not usually determinative,” Andrews v. Bechtel Power Corp., 780 F.2d 124,131 (1st Cir.1985), the sheer number of potential litigants in a class can be the only factor needed to satisfy numerosity. In re Sonus Networks, Inc. Sec. Litig., 247 F.R.D. 244, 248 (D.Mass.2007); Swack v. Credit Suisse First Boston, 230 F.R.D. 250, 258 (D.Mass.2005); In re Relafen Antitrust Litig., 218 F.R.D. 337, 342 (D.Mass.2003) ((“forty individuals [are] generally found to establish numerosity”); 1 Herbert Newberg & Alba Conte, Newherg on Class Actions § 3.05, at 3-25 (3d ed. 1992) (generally impracticable to join 40 plaintiffs and therefore a class of 40 should normally satisfy the numerosity requirement). While the named plaintiffs need not plead or prove the exact number of class members, speculation is insufficient, and they must positively show the impracticability of joinder. 7A Charles Alan Wright & Arthur R. Miller, Mary Kay Kane, Federal Practice And Procedure § 1762 (3d Ed.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Cite This Page — Counsel Stack

Bluebook (online)
293 F.R.D. 21, 2013 WL 1182733, 2013 U.S. Dist. LEXIS 39055, Counsel Stack Legal Research, https://law.counselstack.com/opinion/in-re-hannaford-bros-med-2013.