{"id":1440,"date":"2024-05-19T19:28:25","date_gmt":"2024-05-19T23:28:25","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/classactiondefense\/?p=1440"},"modified":"2024-05-19T19:29:03","modified_gmt":"2024-05-19T23:29:03","slug":"south-carolina-federal-court-denies-class-certification-in-massive-data-breach-class-action","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/classactiondefense\/2024\/05\/19\/south-carolina-federal-court-denies-class-certification-in-massive-data-breach-class-action\/","title":{"rendered":"South Carolina Federal Court Denies Class Certification In Massive Data Breach Class Action"},"content":{"rendered":"

\"\"<\/a>By Gerald L. Maatman, Jr., Jennifer A. Riley, and Emilee N. Crowther<\/b><\/p>\n

Duane Morris Takeaways<\/i><\/b>: In a data breach lawsuit entitled In Re Blackbaud, Inc., Customer Data Breach Litigation, MDL No.2972, Case No. 3:20-MN-02972, 2024 WL 2155221 (D.S.C. May 14, 2024), Judge Joseph F. Anderson, Jr. of the U.S. District Court for the District of South Carolina <\/i>denied <\/a><\/em>Plaintiff\u2019s motion for class certification. The Court found that the Plaintiffs failed to meet their burden of proof as to ascertainability since they could not demonstrate an administratively reasonable method by which to ascertain the estimated 1.5 billion putative class members. This case serves as an important reminder that a plaintiff\u2019s failure to provide a court with an administratively reasonable way to ascertain a class can be an effective tool when combatting class certification motions.<\/i><\/p>\n

Case Background<\/b><\/p>\n

Defendant Blackbaud, Inc. provides data collection and storage services to a wide variety of organizations (\u201ccustomers\u201d). Id<\/i>. at 2. Defendant collects and stores personally identifiable information and protected health information of individuals on behalf of its clients. Id<\/i>.<\/p>\n

Between February and May 2020, a cybercriminal breached Defendant\u2019s systems, capturing 90,000 backup files containing data belonging to 13,000 of Defendant\u2019s customers, and data belonging to approximately 1.5 billion individuals worldwide. Id<\/i>. at 3-4.<\/p>\n

Various plaintiffs filed suits nationwide, and on December 15, 2020, all of the lawsuits were combined into a multidistrict litigation in the District of South Carolina. Id<\/i>. at 5. Thereafter, the Plaintiffs moved to certify one main nationwide class, and four other sub-classes, including two in California, one in New York, and one in Florida. Id<\/i>. at 5-6.<\/p>\n

The Court\u2019s Decision<\/b><\/p>\n

The Court denied Plaintiffs\u2019 motion for class certification. It held that Plaintiffs failed to meet their burden of proof as to Rule 23\u2019s ascertainability requirement. Id<\/i>. at 1. As a threshold requirement to any class certification, a plaintiff must demonstrate that a class is \u201cascertainable\u201d, i.e<\/i>., \u201cthat there will be an administratively feasible way for the court to determine whether a particular individual is a class member.\u201d Id<\/i>. at 16.<\/p>\n

Plaintiffs argued four primary points in support of ascertainability, including: (i) the method proposed by their expert; (ii) Defendant\u2019s ability to create a fact sheet about the named Plaintiffs; (iii) Defendant\u2019s ability to give notice to its customers; and (iv) Defendant\u2019s use of a program called Wirewheel. Id<\/i>. at 17.<\/p>\n

As to Plaintiffs\u2019 first point, the Court granted Defendant\u2019s motion to exclude the Plaintiffs\u2019 expert\u2019s testimony on the grounds that the expert failed to sufficiently test his method, was unable to replicate his method, failed to sufficiently document his method, and could not provide the Court with an error rate consistent with generally accepted statistical practices. Id<\/i>. at 18.<\/p>\n

As to Plaintiffs\u2019 second point, the Court found that the Defendant\u2019s ability to create a fact sheet containing information about 34 named<\/i> Plaintiffs did not weigh in favor of ascertainability, as the Defendant\u2019s process was \u201cnot proof that Plaintiffs [could] undertake the larger task of ascertaining the proposed classes and sub-classes\u201d for 1.5 billion individuals. Id<\/i>. at 45-46. In its decision, the Court placed particular emphasis on the fact that Plaintiffs had not \u201ctested, briefed, or otherwise demonstrated how they would collect information from putative plaintiffs to conduct a process similar to the process Defendant undertook\u201d in creating its fact sheet.\u00a0 Id<\/i>. at 40-41.<\/p>\n

As to Plaintiff\u2019s third point, the Court similarly found that the Defendant\u2019s ability to give notice of the breach did not weigh in favor of ascertainability, because \u201c[t]he steps Defendant took to give notice to its customers [is] not comparable to the steps Plaintiffs would need to take to ascertain a class.\u201d\u00a0 Id<\/i>. at 48-49. The Court emphasized the distinction between Defendant\u2019s task to provide notice to its 13,000 customers<\/i> versus Plaintiffs\u2019 task to identify all of the 1.5 billion individual constituents<\/i> of Defendant\u2019s customers.\u00a0 Id<\/i>. at 46, 49.<\/p>\n

As to Plaintiff\u2019s fourth and final point, the Court again held that it did not weigh in favor of ascertainability, as \u201cthe Defendant\u2019s ability to utilize a singular, live database that it maintains for the sole purpose of responding to [certain] requests does not in any way indicate that Defendant is necessarily able to restore and query 90,000 backup files of databases that were customized, maintained, and controlled by 13,000 separate customers.\u201d\u00a0 Id<\/i>. at 49-50.<\/p>\n

In sum, the Court found that the Plaintiffs failed to demonstrate that their \u201cproposed classes and sub-classes\u201d were able to be ascertained \u201cwithout significant individualized inquiry at a scale that [was] not administratively feasible for Plaintiffs, th[e] Court, Defendant, or any individuals or entities acting at their direction to undertake.\u201d\u00a0 Id<\/i>.<\/p>\n

Implications For Companies<\/b><\/p>\n

The Court\u2019s ruling in In Re Blackbaud, Inc., Customer Data Breach Litigation<\/i> underscores the importance of ascertainability in large-scale data breach class actions. The reality is that companies across the world face threats of large scale cyber-attacks to capture their data daily, whether it be through their own servers or through the technologies and tools they utilize. Since a majority of these cyber threats focus on personally identifiable information or personal health information, each data breach could now potentially affect millions (or billions) of individuals.<\/p>\n

It is natural for a company to experience trepidation in light of these threats and the likelihood of a class action that could follow. However, it is important to remember that in any class action, Rule 23 requires a plaintiff<\/i> to demonstrate that putative class members are identifiable without extensive and individualized fact-finding. The broader the swath Plaintiff wants to brush, the harder it will be for that Plaintiff to demonstrate and plausibly claim to the Court that their class is ascertainable.<\/p>\n

\n","protected":false},"excerpt":{"rendered":"

By Gerald L. Maatman, Jr., Jennifer A. Riley, and Emilee N. Crowther Duane Morris Takeaways: In a data breach lawsuit entitled In Re Blackbaud, Inc., Customer Data Breach Litigation, MDL No.2972, Case No. 3:20-MN-02972, 2024 WL 2155221 (D.S.C. May 14, 2024), Judge Joseph F. Anderson, Jr. of the U.S. District Court for the District of … <\/p>\n

Continue reading “South Carolina Federal Court Denies Class Certification In Massive Data Breach Class Action”<\/span><\/a><\/p>\n","protected":false},"author":583,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[91],"tags":[],"ppma_author":[30],"class_list":["post-1440","post","type-post","status-publish","format-standard","hentry","category-data-breach-class-actions"],"authors":[{"term_id":30,"user_id":583,"is_guest":0,"slug":"classactiondefense","display_name":"Class Action Defense","avatar_url":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-content\/uploads\/sites\/56\/2020\/10\/dmlogo.jpg","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/users\/583"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/comments?post=1440"}],"version-history":[{"count":0,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/posts\/1440\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/media?parent=1440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/categories?post=1440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/tags?post=1440"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blogs.duanemorris.com\/classactiondefense\/wp-json\/wp\/v2\/ppma_author?post=1440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}