In re Supervalu, Inc. Customer Data Security Breach Litigation

67 F. Supp. 3d 1377, 2014 U.S. Dist. LEXIS 174623, 2014 WL 7263354

• Court: United States Judicial Panel on Multidistrict Litigation
• Decided: December 16, 2014
• Docket: MDL No. 2586
• Status: Published

Opinion

TRANSFER ORDER

SARAH S. VANCE, Chair.

Before the Panel:

* Defendant Super-valu, Inc. (Supervalu) moves under 28 U.S.C. § 1407 to centralize pretrial proceedings in this litigation in the District of Idaho. This litigation currently consists of two actions — one in the Southern District of Illinois and one in the District of Minnesota — as listed on Schedule A. These actions arise from an alleged data security breach suffered in mid-2014 by Supervalu, a grocery wholesaler that owns, licenses, franchises, or is otherwise affiliated with more than a thousand grocery retailers across the United States. Plaintiffs allege that this data security breach compromised the personal financial information of customers who used debit or credit cards to make purchases at a number of those stores between June 22 and July 17, 2014.

2 1

Plaintiffs in the action and potential tag-along action pending in the District of Minnesota support centralization, but propose that the litigation be centralized in either the District of Idaho or the District of Minnesota: Plaintiffs in the action pending in the Southern District of Illinois oppose centralization. Alternatively, they suggest that we select either the Southern District of Illinois, the Eastern District of Missouri, or the District of Minnesota as the transferee district. AB Acquisition LLC, a holding company for more than one thousand grocery stores that allegedly were affected by Supervalu data breach³ and a co-defendant in the two potential tag-along actions, supports centralization in the District of Idaho.

On the basis of the papers filed and the hearing session held, we find that these actions involve common questions of fact, and that centralization in the District of Minnesota will serve the convenience of the parties and witnesses and promote the just and efficient conduct of this litigation. These actions share factual questions arising from a data security breach affecting certain stores owned, licensed, franchised, or otherwise affiliated with Supervalu between June 22 and July 17, 2014. All of the actions involve allegations that customers’ personal financial information was compromised as a result of this data security breach. Although the opposing plaintiffs argue that given the minimal number of actions, alternatives exist that render centralization unnecessary, we are not persuaded. These actions involve overlapping putative classes of consumers, and the discovery may be quite technical and contentious. Centralization will eliminate duplicative discovery; prevent inconsistent pretrial rulings, particularly with respect to class certification; and conserve the resources of the parties, their counsel, and the judiciary.

We find that the District of Minnesota is the most appropriate transferee district for pretrial proceedings in this litigation. Supervalu’s corporate headquarters is located within the district, and therefore relevant documents and witnesses are likely to be located there. As many of the plaintiffs also are located in the Midwest, the district is both convenient and accessible for the majority of the parties. Centralization in this district also provides us the opportunity to assign this litigation to the Honorable Ann D. Montgomery, an experienced jurist who will no doubt ably preside over this litigation.

IT IS THEREFORE ORDERED that the action listed on Schedule A and pending outside the District of Minnesota is .transferred to the District of Minnesota and, with the consent of that court, assigned to the Honorable Ann D. Montgomery for coordinated or consolidated pretrial proceedings.

SCHEDULE A

MDL No. 2586 — IN RE: SUPERVALU, INC., CUSTOMER DATA SECURITY BREACH LITIGATION

Southern District of Illinois

MCPEAK, ET AL. v. SUPERVALU, INC., C.A. No. 3:14-00899

District of Minnesota

HANFF, ET AL. v. SUPERVALU INC, C.A. No. 0:14-03252

Judge Charles R. Breyer took no part in the decision of this matter. Certain Panel members who could be members of the putative classes in this litigation have renounced their participation in these classes and have participated in this decision.

1 . The Panel has been notified of two related actions pending in the District of Idaho and the District Minnesota. These and any other related actions are potential tag-along actions. See Panel Rules 1.1(h), 7.1, and 7.2.

2 . Plaintiff in the recently-noticed related action pending in the District of Idaho also alleges that a second data security breach of Supervalu’s payment processing systems occurred in August and September of 2014. Plaintiff contends that this second data breach is related to the initial data breach at issue in all the actions.

3 . It is alleged that Supervalu provided payment processing services for the stores owned by AB Acquisition LLC.