In re Hannaford Bros. Co. Customer Data Sec., MDL Docket No. 2:08-md-1954.

• Decision Date: 24 November 2009
• Docket Number: MDL Docket No. 2:08-md-1954.
• Citation: 671 F.Supp.2d 198
• Parties: In re HANNAFORD BROS. CO. CUSTOMER DATA SECURITY BREACH LITIGATION.
• Court: U.S. District Court — District of Maine

671 F.Supp.2d 198

In re HANNAFORD BROS. CO. CUSTOMER DATA SECURITY BREACH LITIGATION.

MDL Docket No. 2:08-md-1954.

United States District Court, D. Maine.

November 24, 2009.

Peter L. Murray, Esq., Murray, Plumb & Murray, Lewis J. Saul, Lewis Saul & Associates, Portland, ME, for Plaintiffs.

Clifford Ruprecht, John K. Hatch, Gavin G. McCarthy, Pierce Atwood LLP, Portland, ME, Cynthia L. May, Peter W. Zinober, Greenberg Traurig LLP, Tampa, FL, Michael A. Oakes, Richard L. Wyatt, Jr., Akin Gump Strauss Hauer & Feld LLP, Washington, DC, for Defendants.

CERTIFICATE OF QUESTIONS OF STATE LAW TO THE SUPREME JUDICIAL COURT OF MAINE SITTING AS THE LAW COURT

D. BROCK HORNBY, District Judge.

The United States District Court for the District of Maine finds that this case involves questions of law of the State of Maine that may be determinative of the cause and that there are no clear controlling precedents thereon in the decisions of the Supreme Judicial Court of Maine sitting as the Law Court.

Accordingly, this court hereby CERTIFIES two questions to the Supreme Judicial Court of Maine sitting as the Law Court and respectfully requests the Law Court to provide instructions concerning such questions of state law pursuant to 4 M.R.S.A. § 57 and Maine Rule of Appellate Procedure 25(a).

PROCEDURAL BACKGROUND

In this action, the plaintiffs assert state law claims arising from third-party data theft of financial information held by the defendant grocer, Hannaford Bros. Co. ("Hannaford").¹ I have determined that Maine law applies to the plaintiffs' claims for relief.

In ruling upon the defendant's motion to dismiss for failure to state a claim, I ruled that the plaintiffs successfully stated substantive liability claims under Maine law for breach of implied contract to take reasonable measures to protect consumers' account information, negligence, and unfair trade practices law. However, I ruled that generally they stated no recoverable damages claims under those three theories of liability because the damages they claimed were uncertain, remote, not reasonably foreseeable, speculative, and, for Maine's Unfair Trade Practices Act ("UTPA") purposes, not substantial. I therefore granted Hannaford's motion to dismiss the claims of all plaintiffs but one. That sole plaintiff, I ruled, had a cognizable injury in fraudulent postings of charges to her account that the bank had not removed. That lone plaintiff stated later that she had been reimbursed by her bank, however, effectively ending the case.

I noted in my decision that Maine law was uncertain on some of the issues. The plaintiffs then moved for reconsideration so that I could certify any uncertain issues of Maine law to the Maine Supreme Judicial Court sitting as the Law Court.

STATEMENT OF FACTS

The Law Court may consider as true the following assertions based upon the federal pleading standards I applied to the plaintiffs' Consolidated Complaint. (Hannaford contests the assertions but maintains that the plaintiffs' claims must fail as a matter of law even if the assertions are true.)

The plaintiffs are customers who used debit cards and credit cards issued by banks and other financial institutions to make purchases in Maine, Florida, New Hampshire, and Vermont at Hannaford grocery stores, at Sweetbay supermarkets owned by Hannaford's sister corporation, and at independent stores where Hannaford provides electronic payment processing services. Hannaford was unsuccessful in protecting the private and confidential financial information transmitted to Hannaford during credit and debit card purchases. As a result, from December 2007 until March 2008, data thieves breached Hannaford's computer system and stole up to 4.2 million debit card and credit card numbers, expiration dates, security codes, PIN numbers and other information belonging to customers including the plaintiffs. The thieves did not acquire customer names. The credit card association, Visa, Inc., notified Hannaford on February 27, 2008, that Hannaford's information technology system had been breached. Hannaford discovered the means of the thieves' access on March 8, 2008, contained it, notified financial institutions on March 10, 2008, and publicly disclosed the breach on March 17, 2008.

There was no identity theft as such, but as a result of the data theft, a number of plaintiffs in this case initially suffered fraudulent and unauthorized charges to their credit card accounts or bank accounts. These plaintiffs spent time and effort identifying the fraudulent charges. They also expended time and effort convincing their banks and credit card companies that the charges were fraudulent and that the fraudulent and unauthorized charges should be reversed. All such charges were eventually reversed. Ultimately, no plaintiff had to pay the fraudulent charges, and none of the named plaintiffs claims specific expenses incurred to remove the fraudulent charges. The plaintiffs have not placed a monetary value upon the time and effort that they spent dealing with credit companies or banks regarding the reversal of the fraudulent charges to their accounts.

QUESTIONS OF LAW TO BE ANSWERED

Although I have ruled that they have not alleged compensable out-of-pocket losses, the plaintiffs seek to recover damages for the value of time and effort that they expended to avoid or remediate harm from fraudulent charges posted to their accounts. They contend that damages for such time and effort are cognizable injuries under Maine law regardless of whether they suffered other forms of cognizable losses. I am not certifying any question under Maine's UTPA, 5 M.R.S.A. § 205-A et seq., because I have concluded that Maine law on damages under that statute and attendant Maine Law Court decisions is clear. But the plaintiffs point out that such damages are said to be recoverable in tort according to the Restatement (Second) of Torts § 919 (1979) and that the Massachusetts Appeals Court has held that such damages may be recovered. See Kuhn v. Capital One Financial Corp., 67 Mass.App.Ct. 1111, 2006 WL 3007931, at *3 (Mass.App.Ct. Oct. 23, 2006) (unpublished). The defendant argues that such damages are remote, unforeseeable, or speculative;...