Opinion
Civil Action 20-11997-NMG
04-07-2023
AXIS INSURANCE COMPANY, a/a/o ZOLL MEDICAL CORPORATION and ZOLL SERVICES LLC, and a/s/o FUSION LLC, Plaintiff, v. BARRACUDA NETWORKS, INC., and SONIAN INC., Defendants.
MEMORANDUM & ORDER
Nathaniel M. Gorton United States District Judge
This case arises out of a data breach which compromised certain confidential, protected health information (“PHI”) of more than 277,000 patients of Zoll Services LLC, an indirect subsidiary of Zoll Medical (together, “Zoll”). Pending before the Court is the motion of defendant Barracuda Networks, Inc. ("Barracuda") for leave to file a third-party complaint against Fusion LLC (“Fusion”).
I. Background
The Court has recited the lengthy and complex background of this action in its prior memoranda and orders and the parties are undoubtedly well-aware of it. See Zoll Med. Corp. v. Barracuda Networks, Inc., 585 F.Supp.3d 128, 133-34 (D. Mass. 2022); Zoll Med. Corp. v. Barracuda Networks, Inc., 2021 U.S. Dist. LEXIS 180761 at *2-6 (D. Mass. Sept. 21, 2021). The Court will therefore address only the factual and procedural background of particular relevance to the pending motion.
A. Factual Background
Zoll develops and markets medical devices and software solutions, including the "LifeVest wearable cardioverter defibrillator". In the course of commercializing that product, Zoll received emails from physicians containing patient information, such as patient names, addresses, demographics and health information. In 2012, Zoll entered into an agreement with Apptix, Inc. ("Apptix") whereby Apptix agreed to provide Zoll with a product that would safely store its emails and safeguard its PHI. Apptix was later acquired by Fusion.
For its part, Apptix had entered into an original equipment manufacturer agreement with Sonian Inc. (“Sonian”) according to which Sonian provided software and related services for the management of customer communications and email ("the OEM Agreement"). Sonian was later acquired by Barracuda. As a result, emails and patient PHI from Zoll were stored on Barracuda's network.
The data breach at issue began in early November, 2018, when a Barracuda employee allegedly left a data port open in its system during a standard migration of data within its network. None of Barracuda's supervisory, security or oversight mechanisms detected the error until approximately seven weeks later. In the meantime, the confidential PHI of Zoll's patients was apparently accessed by unauthorized third parties.
B. Procedural Background
In June, 2019, Fusion filed for bankruptcy protection under Chapter 11 of Title 11 of the United States Bankruptcy Code in the United States Bankruptcy Court for the Southern District of New York. Zoll filed a proof of claim in the bankruptcy proceeding shortly thereafter and, in January, 2020, Fusion's bankruptcy reorganization plan became effective. The plan permitted Zoll to seek damages from Fusion for harm suffered as a result of the data breach “to the extent of available insurance coverage and proceeds.”
Zoll initiated arbitration with Fusion in March, 2020, asserting claims for negligence and breach of contract. Zoll also attempted to assert claims against Barracuda which were dismissed for lack of privity. Zoll's insurer, Ace American Insurance Co. (“Ace”) paid Zoll on its claims for damages incurred due to the data breach and was subrogated as the real party in interest in the arbitration. Fusion's insurer, Axis Insurance Co. (“Axis”), confirmed coverage of claims against Fusion related to the data breach and provided a defense.
On November 6, 2020, Zoll initiated this action against Barracuda in the District of Massachusetts. Fusion moved to intervene as a Rule 20 party shortly thereafter and its motion was allowed in June, 2021.
Zoll, Ace, Fusion and Axis settled the claims at issue in their arbitration in November, 2021. Pursuant to that settlement, any claims that Zoll/Ace had against Barracuda in connection with the data breach were assigned to Axis and any claims that Fusion had were subrogated to Axis. Axis, the remaining real party in interest in the case at bar, was substituted as the plaintiff in April, 2022, at which time Fusion and Zoll were dismissed as parties.
Several months later, Barracuda brought the pending motion for leave to file a third-party complaint against Fusion under Fed.R.Civ.P. 14(a)(1).
II. Motion for Leave to File a Third-Party Complaint
A. Legal Standard
Fed. R. Civ. P. 14(a)(1) provides that
[a] defending party may, as third-party plaintiff, serve a summons and complaint on a nonparty who is or may be liable to it for all or part of the claim against it. But the third-party plaintiff must, by motion, obtain the court's leave if it files the third-party complaint more than 14 days after serving its original answer.
The decision of whether to permit a defendant to file a third-party complaint more than 14 days after the original answer has been filed
is left to the informed discretion of the district court, which should allow impleader on any colorable claim of derivative liability that will not unduly delay or otherwise prejudice the ongoing proceedings.Lehman v. Revolution Portfolio L.L.C., 166 F.3d 389, 393 (1st Cir. 1999).
B. Application
Barracuda seeks leave of this Court to file a third-party complaint against Fusion. In Count I of the proposed complaint, Barracuda asserts a claim for breach of contract based upon Fusion's purported failure to include certain terms in contracts entered into with customers, including Zoll. According to Barracuda, such terms were required by the OEM Agreement between Barracuda and Fusion. In Count II of the proposed complaint, Barracuda asserts that it is entitled to indemnification from Fusion under the OEM Agreement for damages it may owe to Zoll.
Although Axis contends that the Court should refuse to allow Barracuda to file its proposed third-party complaint because it is not derivative of the claims pending in the case at bar, “a contractual right of indemnification” is a proper basis upon which a third-party plaintiff may bring a claim against a third-party defendant. See Zurich Am. Ins. v. Lord Elec. Co., 828 F.Supp.2d 462, 468 (D.P.R. 2011) (citation omitted). Barracuda alleges that such a right of indemnification exists between itself and Fusion and therefore advocates that the proposed third-party complaint is appropriate.
Barracuda does not, however, satisfactorily address the issue of whether the filing of a third-party complaint would result in undue delay and prejudice. The complicated relationships and legal histories between Zoll, Fusion (and its predecessor), Barracuda (and its predecessor) and their various insurers have already contributed to a protracted course of litigation. The underlying data breach occurred in November, 2018, and Barracuda was served with Zoll's initial arbitration demand in March, 2020. The case at bar against Barracuda was filed in the District of Massachusetts in November, 2020.
Barracuda's dilatory effort to implead Fusion as a third-party defendant and to assert multiple contractual claims against it would, if allowed, implicate complex, tangential questions of bankruptcy law with respect to Fusion's January, 2020, reorganization plan. Such an allowance would also lead to further discovery, dispositive motions and legal contentions which would otherwise be outside the scope of this litigation. The Court will, therefore, deny Barracuda's motion to file a third-party complaint against Fusion because of the undue delay and significant prejudice that it would cause.
ORDER
For the foregoing reasons, defendant's motion for leave to file a third-party complaint (Docket No. 73) is DENIED.
So ordered.