Zoll Med. Corp. v. Barracuda Networks, Inc.

• Decision Date: 14 February 2021
• Docket Number: Civil Action No. 20-11997-NMG
• Citation: 585 F.Supp.3d 128
• Parties: ZOLL MEDICAL CORP., et al., Plaintiff, v. BARRACUDA NETWORKS, INC., et al., Defendant.
• Court: U.S. District Court — District of Massachusetts

585 F.Supp.3d 128

ZOLL MEDICAL CORP., et al., Plaintiff,
v.
BARRACUDA NETWORKS, INC., et al., Defendant.

Civil Action No. 20-11997-NMG

United States District Court, D. Massachusetts.

Signed February 14, 2021
Filed February 14, 2022

585 F.Supp.3d 133

Michael P. Burke, DarrowEverett LLP, Benjamin W. O'Grady, Gordon Rees Scully Mansukhani, LLP, Boston, MA, Jennifer A. Guidea, Pro Hac Vice, Ronald A. Giller, Gordon Rees Scully Mansukhani LLP, Florham Park, NJ, for Plaintiff Zoll Medical Corporation.

Michael P. Burke, DarrowEverett LLP, Boston, MA, Jennifer A. Guidea, Pro Hac Vice, Ronald A. Giller, Gordon Rees Scully Mansukhani LLP, Florham Park, NJ, for Plaintiff Zoll Services LLC.

Mark S. Resnick, The Resnick Law Group P.C., Boston, MA, for Plaintiff Axis Insurance Company.

Angelo A. Stio, III, Pro Hac Vice, Troutman Pepper Hamilton Sanders LLP, Princeton, NJ, Joseph L. DeMeo, Allison L. Huppe, DeMeo LLP, Jaclyn M. Essinger, Troutman Pepper Hamilton Sanders LLP, Boston, MA, Mia S. Rosati, Pro Hac Vice, Troutman Pepper Hamilton Sanders LLP, Philadelphia, PA, Ronald I. Raether, Pro Hac Vice, Troutman Pepper Hamilton Sanders LLP, Irvine, CA, for Defendant.

MEMORANDUM & ORDER

GORTON, United States District Judge

This action arises out of a data breach which compromised certain confidential, protected health information ("PHI") of more than 277,000 patients of Zoll Services LLC, an indirect subsidiary of Zoll Medical Corporation (together, "Zoll").

Pending before the Court is the motion of defendants Barracuda Networks, Inc. ("Barracuda") and Sonian, Inc. ("Sonian" and together with Barracuda, "the defendants" or "the Barracuda parties") to dismiss an intervenor complaint filed by Fusion, LLC ("Fusion" or "the intervenor") (Docket No. 31) and the motion of Zoll, Fusion, and Axis Insurance Company ("Axis") to substitute Axis for Zoll and Fusion. (Docket No. 43).

For the reasons that follow, both motions will be allowed, in part, and denied, in part.

I. Factual Background and Procedural History

A. Factual Background

The Court has previously recited the factual and procedural history of this action. See Zoll Med. Corp. v. Barracuda Networks, No. 20-11997, 565 F.Supp.3d 101, 105–07 2021 U.S. Dist. LEXIS 180761 at *2-6 (D. Mass. Sept. 21, 2021). In 2012, Fusion entered into a contract with Sonian to provide its customers (which later included Zoll) with software and related services for the management of customer communications and email ("the OEM Agreement").¹ Fusion alleges that although

585 F.Supp.3d 134

Barracuda represented that its data management capabilities would enable customers to identify and reduce risks it in fact lacked the "reasonable and readily available security protocols and products" to provide such security.

The data breach began on November 8, 2018, when a Barracuda employee allegedly left a data port open in its system during a standard migration of data within its network. None of Barracuda's supervisory, security or oversight mechanisms detected the error until approximately seven weeks later, on December 28, 2018. In the meantime, the confidential and protected health information of Zoll patients was apparently accessed by unauthorized third parties.

Barracuda finally contacted Fusion with respect to the data breach in January, 2019, advising that it

recently discovered that a very small number of user emails stored in an application known as Sonian EA were compromised as a result of unauthorized access to our system by a third party.

Barracuda informed neither Fusion nor the Zoll plaintiffs that the data port had remained open and undetected for several weeks and, instead, allegedly misrepresented that the data breach was minor.

After receiving notice of the breach, Zoll began an investigation into the event to determine whether customer PHI had been accessed. As part of that investigation, it requested from Barracuda additional information regarding the data breach but Barracuda alleging refused to cooperate. Thereafter, Zoll hired an independent forensics firm, Kroll, Inc., to assist in the investigation.

In June, 2019, Fusion filed for bankruptcy protection under Chapter 11 of Title II of the United States Bankruptcy Code in the United States Bankruptcy Court for the Southern District of New York.

B. Procedural History

The data breach has engendered substantial litigation between Fusion, Zoll, their respective insurers, the individuals whose PHI was compromised by the breach and the Barracuda parties. Those disputes are, in relevant part, described below.

In April, 2019, a class action lawsuit was filed against Zoll in the Circuit Court of Kanawha County, West Virginia, by individuals claiming that their PHI had been the subject of the data breach. That action was settled, and Zoll has assumed liability for any injury to its patients resulting from the data breach.

i. The Arbitration

In August, 2019, Zoll filed a proof of claim in Fusion's bankruptcy proceeding in the Southern District of New York seeking damages allegedly arising out of the data breach. Fusion's bankruptcy plan, which became effective in January, 2020, contained language which provided that nothing in the plan would preclude Zoll from subsequently seeking damages from Fusion for harm suffered as a result of the data breach, provided that such damages were "solely to the extent of available insurance coverage and proceeds."

In March, 2020, Zoll initiated arbitration proceedings with Fusion, asserting claims for negligence and breach of contract.² Fusion's insurer, Axis, confirmed coverage of claims related to the data breach and assumed defense. After Zoll's insurer, Ace

585 F.Supp.3d 135

American Insurance Company ("Ace") paid Zoll its claims for damages incurred due to the data breach, Ace was subrogated as the real party in interest in the arbitration.

In November, 2021, Fusion, Axis, Zoll and Ace settled the arbitration claims. Fusion and Zoll confirm that, pursuant to the settlement agreement, Zoll and Ace have assigned to Axis all claims that they have against Barracuda in connection with the data breach. They contend that Axis is therefore the real party in interest with respect to the claims asserted by Fusion and Zoll against Barracuda in this action as set forth hereafter.

ii. Claims of Zoll and Fusion against Barracuda

In November, 2020, Zoll filed the instant action against the Barracuda parties, alleging claims for 1) negligence (Count I), 2) breach of the implied warranty of merchantability (Count II), 3) breach of the implied warranty of fitness (Count III), 4) breach of contract (Count IV) and 5) equitable indemnification (Count V). The Barracuda parties moved to dismiss those claims and the Court allowed their motion except as to Count V.

In June, 2021, Fusion intervened in the action and filed an eight-count complaint against the Barracuda parties, alleging claims for 1) breach of contract, 2) breach of the implied covenant of good faith and fair dealing, 3) negligent...