In re Practice Resources, LLC, Data Security Breach Litigation

• Court: District Court, N.D. New York
• Decided: November 22, 2022
• Docket: 6:22-cv-00890
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF NEW YORK

JAMES STEWART and SUSAN STEWART, on behalf of themselves and all others similarly situated,

Plaintiffs,

-against- 6:22-CV-0890 (LEK/DJS)

PRACTICE RESOURCES, LLC,

Defendant.

JOHN BACHURA, individually and on behalf of all others similarly situated,

Plaintiff,

-against- 5:22-CV-0905 (LEK/DJS)

MEMORANDUM-DECISION AND ORDER I. INTRODUCTION The Plaintiffs in these two related actions, each acting on behalf of a putative class, have asserted various claims against Practice Resources, LLC (“Defendant”) for failing to secure and safeguard patients’ and employees’ sensitive personal data. See Stewart et al. v. Practice Resources, LLC, No. 22-CV-0890, Dkt. No. 1 (“Stewart Complaint”) ¶ 1; Bachura v. Practice Resources, LLC, No. 22-CV-0905, Dkt. No. 1 (“Bachura Complaint”) ¶ 4. Currently before the Court is an unopposed Motion seeking to consolidate the two above-captioned actions and to have the Court appoint interim co-lead counsel for the class. Stewart, Dkt. No. 9-1 (“Motion”) at 1–2. For the reasons set forth below, the Court grants the requests to consolidate the two actions and to appoint interim co-lead counsel for the class; specifically, the Court appoints Migliaccio & Rathod, LLP and Weitz & Luxenberg, P.C. (hereinafter, “Proposed Interim Co-Lead Counsel”) as interim co-lead counsel for the class. II. BACKGROUND On August 25, 2022, James Stewart and Susan Stewart (collectively, the “Stewarts”), by

and through their attorney Nicholas A. Migliaccio of Migliaccio & Rathod LLP, filed the first lawsuit “on behalf of individuals whose sensitive [personally identifiable information (‘PII’)] was stolen by cybercriminals in a cyber-attack on [Defendant’s] systems that took place in or around April 12, 2022 . . . .” Stewart Compl. ¶ 2. According to the Stewarts, this attack “resulted in the access and exfiltration of sensitive patient and employee information (the ‘Data Breach’).” Id. The Stewarts allege that “Defendant did not beg[i]n notifying affected individuals until at least August []4, 2022,” id. ¶ 4, and that because of this failure, the Stewarts “and Class members have experienced and will experience various types of misuse of their PII in the coming months and years, including but not limited to, unauthorized credit card charges, unauthorized access to email accounts, identity theft, and other fraudulent use of their Private Information,” id. ¶ 5.

The Stewart class action asserts claims on behalf of a Nationwide Class, as well as a New York Subclass. Id. ¶ 126. The Stewarts define the Nationwide Class as “[a]ll persons residing in the United States whose Private Information was compromised as a result of the Data Breach discovered on or about April of 2022 and who were sent notice of the Data Breach.” Id. The Stewarts define the New York Subclass as the same but limited to “[a]ll persons residing in New York . . . .” Id. The Stewarts further assert that this Court has jurisdiction over their claims under the Class Action Fairness Act (“CAFA”), 28 U.S.C. § 1332(d), “because (a) there are 100 or more class members, (b) at least one class member is a citizen of a state that is diverse form Defendant’s citizenship, and (c) the matter in controversy exceeds $5,000,000, exclusive of interest and costs.” Id. ¶ 9. The Stewart Complaint seeks monetary, declaratory, and injunctive relief, including an order “requiring Defendant to, inter alia, (i) strengthen its data security systems and monitoring procedures; (ii) submit to future annual audits of those systems and

monitoring procedures; and (iii) immediately provide free credit monitoring to all Class members indefinitely . . . .” Id. at 57. On August 30, 2022, John Bachura, by and through his attorney, James J. Bilsborrow of Weitz & Luxenberg, P.C., commenced a second action regarding the Data Breach in this District on behalf of himself and all others similarly situated. In that action, Bachura identifies one class that is virtually identical to the Stewarts’ Nationwide Class: “All persons whose Private Information was compromised as a result of the Data Breach announced by [Defendant] on or about August 4, 2022 . . . .” Bachura Compl. ¶ 122. Bachura also asserts this Court has CAFA jurisdiction, adding that “the number of Class Members is nearly a million (942,138 affected individuals), many of whom have different citizenship from Defendant.” Id. ¶ 14.

On October 17, 2022, counsel for the Stewart and Buchara Plaintiffs jointly filed a Motion seeking to consolidate the pending actions and to have their counsel’s two law firms— Migliaccio & Rathod, LLP, and Weitz & Luxenberg, P.C.—appointed as interim co-lead counsel for the class. Dkt. No. 9 (“Notice of Motion”). Defendant’s “counsel has advised Plaintiffs’ counsel that they do not oppose the instant motion or the briefing schedule set forth in the Proposed Order.” Id. at 2. III. CONSOLIDATION First, the Court will deal with the unopposed request to consolidate these two actions. A. Standard for Consolidating Class Actions Federal Rule of Civil Procedure 42 empowers district courts to “consolidate . . . actions” that “involve a common question of law or fact . . . .” Fed. R. Civ. P. 42(a)(2). The Second Circuit has interpreted this rule broadly, stating that Rule 42 gives district courts “broad

discretion to determine whether consolidation is appropriate.” Johnson v. Celotex Corp., 899 F.2d 1281, 1284 (2d Cir. 1990) (citations omitted). “In the exercise of [that] discretion, courts have taken the view that considerations of judicial economy favor consolidation.” Id. at 1285 (citation omitted). “However, the discretion to consolidate is not unfettered.” Id. (citation omitted). “Considerations of convenience and economy must yield to a paramount concern for a fair and impartial trial.” Id. (citation omitted). District courts have “consolidated [class actions] in a variety of circumstances.” 3 Newberg and Rubenstein on Class Actions § 10:35 (6th ed. 2022). Consolidating class actions “may be appropriate when related cases exhibit ‘sufficiently common questions of fact and law’ even if causes of action, parties, or class periods differ between the cases.” Id. (footnotes

omitted) (citing Nat’l Ass’n of Mortg. Brokers v. Board of Governors of Federal Reserve System, 770 F. Supp. 2d 283, 286 (D.D.C. 2011) (observing that parties need not be identical so long as cases present identical questions of law)); see also Kaplan v. Gelfond, 240 F.R.D. 88, 91 (S.D.N.Y. 2007) (“Differences in causes of action, defendants, or the class period do not render consolidation inappropriate if the cases present sufficiently common questions of fact and law, and the differences do not outweigh the interests of judicial economy served by consolidation.”). In addition, “[c]ases may be deemed to be consolidated even if there is no formal order if the court and parties treat the cases as consolidated.” 3 Newberg and Rubenstein § 10:35 (footnote omitted). Under General Order 12 of this District, “[w]hen it is determined that in the interest of judicial economy that civil cases should be consolidated, the cases shall be consolidated under the original lead case (typically the first of the series of cases filed).” General Order 12(G)(6). B. The Court’s Analysis

Here, the gravamen of the Stewart and Bachura Complaints is the same Data Breach. See Stewart Compl. ¶¶ 24–33; Bachura Compl. ¶¶ 17–27. Both Complaints name the same Defendant. See Stewart Compl. at 1; Bachura Compl. at 1.1 Crucial factual and legal questions regarding the Data Breach and its causes and consequences are common to both actions. See, e.g., Stewart Compl. ¶ 32 (alleging that “[t]he Breach occurred because Defendant failed to take reasonable measures to protect the PII it collected and stored”); Bachura Compl. ¶ 4 (alleging that “the Data Breach was a direct result of Defendant’s abject failure to implement and to maintain adequate and reasonable cybersecurity procedures and protocols”). Although some variations exist in the parameters of both Complaints, such as the precise causes of action or contours of the class, such minor differences are not enough to preclude consolidation. Cf.

Constance Sczesny Tr. v. KPMG LLP, 223 F.R.D. 319, 322 (S.D.N.Y. 2004) (finding that small “variations . . . in the parameters of the alleged class periods” were “insufficient to preclude consolidation” (internal quotations and citation omitted)). Moreover, Defendant does not oppose the request to consolidate. Notice of Mot. at 2. Accordingly, the Court consolidates the Stewart and Bachura actions, as well as any future related actions, under the docket number of the first filed case, Stewart, No. 22-CV-0890, and under the new title, In re Practice Resources, LLC, Data Security Breach Litigation (otherwise, referred to herein as the “Consolidated Action”). See General Order 12(G)(6) (“[T]he

1 Both cases have already been deemed “related” under this District’s General Order 12(G). cases shall be consolidated under the original lead case (typically the first of the series of cases filed).”); see also Mot. at 2 (Plaintiffs requesting this “new name”). The Clerk of the Court is directed to modify the caption accordingly. No further filings shall be made in Bachura, No. 22- CV-0905, which shall be administratively closed.

IV. INTERIM CLASS COUNSEL PROPOSAL Next, the Court deals with the joint request for appointment of interim co-lead counsel for the class. Specifically, the Stewarts and Bachura, through their counsel, propose appointment of Migliaccio & Rathod, LLP, and Weitz & Luxenberg, P.C., as co-lead interim class counsel. Notice of Mot. at 2. A. Standard for Appointing Interim Class Counsel Federal Rule of Civil Procedure 23(g) provides that “[t]he court may designate interim counsel to act on behalf of a putative class before determining whether to certify the action as a class action.” Fed. R. Civ. P. 23(g)(3). When considering the appointment of interim class counsel under Rule 23(g)(3), the Court considers the same factors that a court appointing lead counsel for a certified class must consider under Rule 23(g)(1)(A). See Buonasera v. Honest Co.,

Inc., 318 F.R.D. 17, 18 (S.D.N.Y. 2016); In re Mun. Derivatives Antitrust Litig., 252 F.R.D. 184, 186 (S.D.N.Y. 2008); In re Air Cargo Shipping Servs. Antitrust Litig., 240 F.R.D. 56, 57 (E.D.N.Y. 2006). Those factors include: (i) the work counsel has done in identifying or investigating potential claims in the action;

(ii) counsel’s experience in handling class actions, other complex litigation, and the types of claims asserted in the action;

(iii) counsel’s knowledge of the applicable law; and

(iv) the resources that counsel will commit to representing the class. Fed. R. Civ. P. 23(g)(1)(A)(i)–(iv). The Court may also examine anything else that is “pertinent to counsel’s ability to fairly and adequately represent the interests of the class.” Fed. R. Civ. P. 23(g)(1)(B). Ultimately, the court’s task in deciding a motion for appointment of interim class counsel is “to protect the interests of the plaintiffs, not their lawyers.” In re Parking Heaters

Mem. Antitrust Litig., 310 F.R.D. 54, 57 (E.D.N.Y. 2015) (quoting In re Payment Card Interchange Fee & Merch. Disc. Antitrust Litig., 2006 WL 2038650, at *4 (E.D.N.Y. Feb. 24, 2006)). B. The Court’s Analysis First, as demonstrated by the detailed allegations set forth in the Stewart and Bachura Complaints, the two law firms seeking appointment as interim co-lead class counsel have spent considerable time, effort, and resources “identifying or investigating potential claims in the action.” Fed. R. Civ. P. 23(g)(1)(A)(i). These efforts have included “(1) interviewing potential plaintiffs; (2) identifying potential experts; (3) spending numerous hours investigating and researching the factual and legal merits of the claims; and (4) discussing initial scheduling issues

with Defendant.” Mot. at 5–6. Second, the Proposed Interim Co-Lead Counsel also possess relevant “experience in handling class actions,” Fed. R. Civ. P. 23(g)(1)(A)(ii), and “litigating large-scale and complex data breach class actions in federal and state court across the country.” Mot. at 6. For instance, the attorneys at Migliaccio & Rathod LLP “represented Facebook users after a data breach affecting approximately 50 million consumers.” Id. at 7 (citing Bendetowies et al. v. Facebook, Inc., No. 18-CV-6263 (N.D. Cal.)). James J. Bilsborrow of Weitz & Luxenberg, P.C., “was appointed co-lead class counsel in Fero v. Excellus Health Plan, Inc., No. []15-CV-6569 [] (W.D.N.Y.), an action involving the breach of protected health information of approximately ten million individuals.” Mot. at 7. In addition, “both firms [represent that they] have recently led data breach class actions which have resulted in large monetary recoveries for the class.” Id. Third, “Proposed Interim Co-Lead Counsel . . . have particularized knowledge of applicable data breach and privacy law.” Id. Their relevant expertise is further evinced by their

prior appointments and litigation successes presented in Plaintiffs’ Motion. See Mot. at 7–8. Fourth, the Court has no doubt that the Proposed Interim Co-Lead Counsel will expend the resources necessary to represent the class. They have “already expended significant resources in investigating and identifying the claims asserted in the litigation[]” to date, Mot. at 9, and both “firms are well equipped to expend the professional time and financial resources necessary to aggressively and effectively prosecute this litigation on behalf of Plaintiffs and the Class,” id. Finally, the Court sees no issue with appointing two firms as interim co-lead counsel for the class. District courts within this Circuit routinely appoint multiple firms to work as interim lead counsel in complex class actions. See, e.g., In re Cargo Shipping, 240 F.R.D. 56 (appointing four law firms as interim co-lead class counsel); Buonasera, 318 F.R.D. 17 (same). Moreover,

the Proposed Interim Co-Lead Counsel, to date, have demonstrated their ability to cooperate with each other and work efficiently on behalf of the putative class. Accordingly, Plaintiffs’ joint request for appointment of interim co-lead counsel is granted. V. CONCLUSION Accordingly, it is hereby: ORDERED, that this Memorandum-Decision and Order be docketed in each of the above-captioned cases; and it is further ORDERED, that pursuant to Federal Rule of Civil Procedure 42(a)(2) and General Order 12(G)(6), the above-captioned cases, as well as any future related actions, are consolidated under the docket number of the first filed case, Stewart, No. 22-CV-0890, and under the new title, In re Practice Resources, LLC, Data Security Breach Litigation. The Clerk of the Court is directed to modify the caption of that case, accordingly; and it is further ORDERED, that the Clerk of the Court administratively close Bachura, No. 22-CV- 0905. No further filings shall be made on that docket, but all pleadings therein maintain their

legal relevance until the filing of a consolidated complaint; and it is further ORDERED, that any new civil action filed in this District that seeks relief against Defendant for the Data Breach will be reviewed by the Court on a case-by-case basis in order to determine, at the time of its filing, whether it should be consolidated into the Consolidated Action; and it is further ORDERED, that, having given due consideration to the relevant factors pursuant to Federal Rule of Civil Procedure 23(g)(1), the following are appointed and shall serve as Plaintiffs’ Interim Co-Lead Class Counsel, in accordance with Federal Rule of Civil Procedure 23(g)(3): 1. Nicholas A. Migliaccio, Esq. Jason S. Rathod, Esq. MIGLIACCIO & RATHOD LLP 412 H Street NE, Ste. 302 Washington, DC 20002,

and

2. James J. Bilsborrow, Esq. WEITZ & LUXENBERG, P.C. 700 Broadway New York, NY 10003.

IT IS FURTHER ORDERED, that Plaintiffs’ Interim Co-Lead Class Counsel will be responsible for and have plenary authority to prosecute any and all claims of the Plaintiffs and putative class and to provide general supervision of the activities of Plaintiffs’ counsel in the Consolidated Action. Specifically, Interim Co-Lead Class Counsel shall have the following responsibilities, duties and sole authority: A. Draft and file the master consolidated complaint, and have final authority regarding what claims and parties are to be included;

B. Determine and present in pleadings, briefs, motions, oral argument, or such other fashion as may be appropriate, personally or by a designee, to the Court and opposing parties the position of Plaintiffs and the putative class on matters arising during the pretrial proceedings: C. Coordinate and conduct discovery on behalf of Plaintiffs and the putative class consistent with the requirements of the Federal Rules of Civil Procedure and the Local Rules for the Northern District of New York; D. Consult with and employ expert witnesses; E. Draft and file the motion for class certification on behalf of Plaintiffs and the putative class;

F. Conduct all pre-trial proceedings on behalf of Plaintiffs and the putative class; G. Enter into Stipulations with Defendant; H. Sign all papers filed on behalf of Plaintiffs and the putative class; I. Convene meetings of all Plaintiffs’ counsel, as necessary; J. Form task-specific subcommittees of Plaintiffs’ counsel, as appropriate; K. Conduct settlement negotiations with Defendant, and if there is a settlement, propose a claims protocol and/or plan of allocation; L. Maintain an up-to-date service list of all Plaintiffs’ counsel for all cases that have been consolidated into the Consolidated Action, and promptly advise the Court and Defendant’s counsel of changes thereto; M. Receive and distribute to Plaintiffs’ counsel, as appropriate, discovery, pleadings,

correspondence, and other documents from Defendant’s counsel or the Court that are not electronically filed; N. Appear at Court-noticed status conferences; O. Be the contact persons for all Plaintiffs’ counsel and as the attorneys of record with whom the Court will be dealing throughout the course of the litigation; P. Delegate specific tasks to other Plaintiffs’ counsel in a manner to avoid duplicative efforts and ensure that pretrial preparation for Plaintiffs and the putative class is conducted effectively, efficiently, and economically; Q. Otherwise coordinate the work of all Plaintiffs’ counsel, and perform such other duties as the Interim Co-Lead Class Counsel deem necessary to advance the litigation

or as authorized by further Order of the Court; R. Maintain and collect time and expense records for work performed, time billed, costs incurred, and other disbursements made by Plaintiffs’ counsel whose work Interim Co-Lead Class Counsel has specifically authorized, and submit at the Court’s request, in writing, ex parte and in camera reports to the Court regarding time billed in the prosecution of this action; and it is further ORDERED, that all other counsel are prohibited from taking any action on behalf of the Plaintiffs and putative class in this Consolidated Action without advance authorization from Co- Lead Interim Class Counsel, except for application to modify or be relieved from this Memorandum-Decision and Order; and it is further ORDERED, that the mere communication of otherwise privileged information among and between Plaintiffs’ counsel shall not be deemed a waiver of the attorney-client privilege or

the attorney work product immunity, as the Court recognizes that cooperation by and among counsel is essential for the orderly and expeditious resolution of this litigation; and it is further ORDERED, that, pursuant to Federal Rule of Civil Procedure 1, counsel for all parties are directed to cooperate with one another, wherever possible, to promote the expeditious handling of pretrial proceedings in the Consolidated Action, and related civility principles governing lawyers in the State of New York; and it is further ORDERED, that a master consolidated complaint be filed in the lead case, In re Practice Resources, LLC, Data Security Breach Litigation, No. 22-CV-0890, by Co-Lead Interim Class Counsel within thirty (30) days of the filing date of this Memorandum-Decision and Order; and it is further

ORDERED, that Defendant is not required to respond to the presently operative complaints in the two cases captioned above, and shall have thirty (30) days from the date on which Plaintiffs file the consolidated complaint to file its response; and it is further ORDERED, that in the event that Defendant’s response is a Motion to Dismiss, Plaintiffs shall have thirty (30) days to file their opposition brief, and Defendant shall have twenty-one (21) days to file its reply brief; and it is further ORDERED, that this Memorandum-Decision and Order be served on all named parties in accordance with the Local Rules. IT IS SO ORDERED.

DATED: November 22, 2022 Albany, New York LAWRENCE E. KAHN United States District Judge