Stephenson v. Rackspace Technology, Inc

CourtDistrict Court, W.D. Texas
DecidedMay 18, 2023
Docket5:22-cv-01296
StatusUnknown

This text of Stephenson v. Rackspace Technology, Inc (Stephenson v. Rackspace Technology, Inc) is published on Counsel Stack Legal Research, covering District Court, W.D. Texas primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Stephenson v. Rackspace Technology, Inc, (W.D. Tex. 2023).

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF TEXAS SAN ANTONIO DIVISION

GARRETT STEPHENSON, et al. § Plaintiffs § § SA-22-CV-01296-XR -vs- § § RACKSPACE TECHNOLOGY, INC, § Defendant §

ORDER ON MOTION TO COMPEL ARBITRATION On this date, the Court considered Defendant Rackspace Technology, Inc.’s motion to compel individual arbitration (ECF No. 23), Plaintiffs’ response (ECF No. 30), Defendant’s reply (ECF No. 31), and the parties’ arguments at the hearing held on April 6, 2023. After careful consideration, the Court issues the following order. BACKGROUND These consolidated, putative class action cases arise from a cybersecurity incident purportedly discovered and announced by Defendant Rackspace Technology, Inc. (“Rackspace”) on or about December 2, 2022 (the “Security Incident”), in which unauthorized individuals gained access to its information network through a ransomware attack that allegedly affected over 30,000 Rackspace customers.1 Rackspace, a cloud services provider, offers a Hosted Exchange environment, which allows clients to avoid hosting email on their own computers or network servers. Thirty-seven Named Plaintiffs purport to represent both nationwide and various state putative classes, alleging claims for damages and injunctive relief relating to the disruption

1 Garrett Stephenson and Gateway Recruiting, LLC (“Gateway”) filed a class action on December 5, 2022, seeking damages, injunctive and equitable relief in connection with the security incident. Garrett Stephenson et al.. Rackspace Technology, Inc., No. 5:22-cv-1296-XR (“Stephenson Action”), ECF No. 1. The subsequent actions were filed under the Stephenson Action. See Ondo v. Rackspace Technology, Inc., No. 5:22-cv-1306-XR (“Ondo Action”), ECF No. 9; Q Industries, Inc. v. Rackspace Technology, Inc., No. 5:22-cv-1322-XR (“Moser Action”), ECF No. 9; Lethe v. Rackspace Technology, Inc., No. 5:22-cv-1378-XR (“Lethe Action”), ECF No. 4. of their email services, which allegedly resulted in the permanent loss of some communications and potential disclosure of sensitive information.2 The parties present competing theories of the cause of Plaintiffs’ alleged damages. Plaintiffs assert that the third parties were able to access Rackspace’s network because it failed to

deploy a security patch provided by Microsoft on November 8, 2022, and that Rackspace’s mismanaged response to and communications about the ransomware attack further interrupted their business operations. ECF No. 30 at 9–10.3 Rackspace observes that its agreements with Hosted Exchange clients provide that (1) clients are responsible for maintaining routine back-ups of their data, (2) neither party is liable to the other for data loss, (3) Rackspace can suspend email services in the event of an attack, and (4) account credits are the sole remedy for service interruptions. ECF No. 23 at 10–11. All prospective Hosted Exchange clients must agree to the then-current version of Rackspace’s governing terms, including a Master Services Agreement (“MSA”), in order to complete the transaction to begin using the services. See ECF No. 23-2, Decl. of Josh Prewitt

(Chief Product Officer of Rackspace) ¶ 15. Hosted Exchange customers typically sign up for Hosted Exchange services through the online cart on the Rackspace website (the “Online Signup Process”). See id. ¶¶ 16–17. The Online Signup Process involves four steps. See id. ¶¶ 20–23. (1) The customer must first confirm the services requested and click a button labeled “Next Step” in order to proceed. See id. ¶ 20; Ex. 3. (2) The customer must enter account and contact information and again click a button labeled “Next Step” in order to proceed: See id. ¶ 21; Ex. 4. (3) The customer must provide an address, and again click a button labeled “Next Step” in order to proceed. See id. ¶ 22; Ex. 5.

2 Rackspace acknowledges that 27 of its customers also had files moved during the Security Incident but maintains that none of the Named Plaintiffs were among the clients whose data was moved without their authorization and, accordingly, cannot purport to represent a putative class of such customers. 3 Page numbers in citations to the record refer to PDF page numbers as the document was filed on CM/ECF, which are not necessarily the same as the page numbers in the underlying documents. (4) Finally, the customer must provide payment information, check a statement agreeing to be bound by each of three hyperlinked agreements— the MSA, the Mail Terms of Service, and the Office 365 Services Terms of Service—and click a button labeled “submit” to complete the transaction. See id. ¶ 23; Ex. 6. While the vast majority of Hosted Exchange customers sign up for services through the Online Signup Process, some customers register by signing and returning the then-governing terms through an electronic signature program (“eSig Process”). See id. ¶¶ 16–17; Ex. 2. The service order used in the eSig Process expressly incorporates the then-current MSA by reference. Id. ¶ 17. It also requires the customer to agree to the following language: The Agreement constitutes the complete and exclusive agreement between the parties regarding the subject matter and supersedes and replaces any prior understanding or communication, written or oral. The individual signing represents to Rackspace that they are authorized to sign on behalf of Customer. Customer accepts the terms of the Agreement, including any document or terms referenced above.

Id. ¶ 17; Ex. 2. Rackspace asserts that, at all relevant times, the governing terms have required Hosted Exchange customers to agree that Rackspace can periodically update its terms, and the updates become effective on the customer’s next renewal date, through a provision substantially similar to the language below: Some terms are incorporated into the Agreement by reference to pages on the Rackspace website and Rackspace may revise those terms from time to time (including the MSA). Except where otherwise designated, such revisions are effective and supersede and form part of the Agreement as of the time: (i) Customer enters into a new Service Order referencing the revised terms; (ii) a Service Order automatically renews pursuant to the Agreement; or (iii) the parties enter into an agreement for a Renewal Term or account transfer (in which case Customer acknowledges that it has reviewed and accepted the then-current version of the terms).

Id. ¶ 26; Ex. 8 (emphasis added). The “Agreement” as defined in the MSA, “means, collectively, the MSA and any terms incorporated by reference in the MSA, and any applicable Service Order, Product Terms, or other addenda which govern the provision of Services.” Id., Ex. 8 at Schedule 1 (Defined Terms). For Hosted Exchange customers, these collective agreements and terms include, among others, the MSA, the Mail Terms of Service, and the Global Security & Privacy Practices. See id. ¶ 34.

Thus, according to Rackspace, if a Hosted Exchange customer allows its services, which are renewed monthly, to continue after Rackspace’s governing terms have been updated, that customer agrees to be bound by the updated terms as of the date of the service renewal. Id. see also id. ¶ 28; id., Ex. 7 (Service Order related to an Agreement executed through the Online Signup Process reflecting a monthly term); id., Ex. 2 (Service Order related to an Agreement executed through the eSig Process reflecting a monthly term). Because Rackspace updated its MSA on June 21, 2022, Rackspace asserts that the June 2022 version of the MSA became effective for all Hosted Exchange Customers no later than July 21, 2022. See id. ¶ 28; Ex. 8. Therefore, Rackspace argues, every Hosted Exchange Customer that was affected by the December 2, 2022 Security Incident is bound by the June 21, 2022 MSA. See id.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Apache Bohai Corp. v. Texaco China, B.V.
330 F.3d 307 (Fifth Circuit, 2003)
Washington Mutual Finance Group, LLC v. Bailey
364 F.3d 260 (Fifth Circuit, 2004)
Carter v. Countrywide Credit Industries, Inc.
362 F.3d 294 (Fifth Circuit, 2004)
Banc One Acceptance Corp. v. Hill
367 F.3d 426 (Fifth Circuit, 2004)
Iberia Credit Bureau, Inc. v. Cingular Wireless LLC
379 F.3d 159 (Fifth Circuit, 2004)
Stinger v. Chase Bank, USA, NA
265 F. App'x 224 (Fifth Circuit, 2008)
Jones v. Halliburton Co.
583 F.3d 228 (Fifth Circuit, 2009)
Gilmer v. Interstate/Johnson Lane Corp.
500 U.S. 20 (Supreme Court, 1991)
Doctor's Associates, Inc. v. Casarotto
517 U.S. 681 (Supreme Court, 1996)
Green Tree Financial Corp.-Alabama v. Randolph
531 U.S. 79 (Supreme Court, 2000)
Buckeye Check Cashing, Inc. v. Cardegna
546 U.S. 440 (Supreme Court, 2006)
Kilgore v. KeyBank, National Ass'n
673 F.3d 947 (Ninth Circuit, 2012)
Matthew Kilgore v. Keybank, National Association
718 F.3d 1052 (Ninth Circuit, 2013)
In Re AdvancePCS Health L.P.
172 S.W.3d 603 (Texas Supreme Court, 2005)
In Re Palm Harbor Homes, Inc.
195 S.W.3d 672 (Texas Supreme Court, 2006)
Sea-Land Service, Inc. v. Sea-Land of Puerto Rico, Inc.
636 F. Supp. 750 (D. Puerto Rico, 1986)

Cite This Page — Counsel Stack

Bluebook (online)
Stephenson v. Rackspace Technology, Inc, Counsel Stack Legal Research, https://law.counselstack.com/opinion/stephenson-v-rackspace-technology-inc-txwd-2023.