Opinion
Civil Action 20-11997-NMG
02-14-2022
Zoll Medical Corp., et al., Plaintiff, v. Barracuda Networks, Inc., et al. Defendant.
MEMORANDUM & ORDER
Nathaniel M. Gorton United States District Judge
This action arises out of a data breach which compromised certain confidential, protected health information (“PHI”) of more than 277, 000 patients of Zoll Services LLC, an indirect subsidiary of Zoll Medical Corporation (together, “Zoll”).
Pending before the Court is the motion of defendants Barracuda Networks, Inc. (“Barracuda”) and Sonian, Inc. (“Sonian” and together with Barracuda, “the defendants” or “the Barracuda parties”) to dismiss an intervenor complaint filed by Fusion, LLC (“Fusion” or “the intervenor”) (Docket No. 31) and the motion of Zoll, Fusion, and Axis Insurance Company (“Axis”) to substitute Axis for Zoll and Fusion. (Docket No. 43).
For the reasons that follow, both motions will be allowed, in part, and denied, in part.
I. Factual Background and Procedural History
A. Factual Background
The Court has previously recited the factual and procedural history of this action. See Zoll Med. Corp. v. Barracuda Networks, No. 20-11997, 2021 U.S. Dist. LEXIS 180761 at *2-6 (D. Mass. Sept. 21, 2021). In 2012, Fusion entered into a contract with Sonian to provide its customers (which later included Zoll) with software and related services for the management of customer communications and email (“the OEM Agreement”). Fusion alleges that although Barracuda represented that its data management capabilities would enable customers to identify and reduce risks it in fact lacked the “reasonable and readily available security protocols and products” to provide such security.
The Court will refer to Sonian and Barracuda as “the Barracuda parties” except where Sonian's individual corporate identity is relevant.
The data breach began on November 8, 2018, when a Barracuda employee allegedly left a data port open in its system during a standard migration of data within its network. None of Barracuda's supervisory, security or oversight mechanisms detected the error until approximately seven weeks later, on December 28, 2018. In the meantime, the confidential and protected health information of Zoll patients was apparently accessed by unauthorized third parties.
Barracuda finally contacted Fusion with respect to the data breach in January, 2019, advising that it
recently discovered that a very small number of user emails stored in an application known as Sonian EA were compromised as a result of unauthorized access to our system by a third party.Barracuda informed neither Fusion nor the Zoll plaintiffs that the data port had remained open and undetected for several weeks and, instead, allegedly misrepresented that the data breach was minor.
After receiving notice of the breach, Zoll began an investigation into the event to determine whether customer PHI had been accessed. As part of that investigation, it requested from Barracuda additional information regarding the data breach but Barracuda alleging refused to cooperate. Thereafter, Zoll hired an independent forensics firm, Kroll, Inc., to assist in the investigation.
In June, 2019, Fusion filed for bankruptcy protection under Chapter 11 of Title II of the United States Bankruptcy Code in the United States Bankruptcy Court for the Southern District of New York.
B. Procedural History
The data breach has engendered substantial litigation between Fusion, Zoll, their respective insurers, the individuals whose PHI was compromised by the breach and the Barracuda parties. Those disputes are, in relevant part, described below.
In April, 2019, a class action lawsuit was filed against Zoll in the Circuit Court of Kanawha County, West Virginia, by individuals claiming that their PHI had been the subject of the data breach. That action was settled, and Zoll has assumed liability for any injury to its patients resulting from the data breach.
i. The Arbitration
In August, 2019, Zoll filed a proof of claim in Fusion's bankruptcy proceeding in the Southern District of New York seeking damages allegedly arising out of the data breach. Fusion's bankruptcy plan, which became effective in January, 2020, contained language which provided that nothing in the plan would preclude Zoll from subsequently seeking damages from Fusion for harm suffered as a result of the data breach, provided that such damages were “solely to the extent of available insurance coverage and proceeds.”
In March, 2020, Zoll initiated arbitration proceedings with Fusion, asserting claims for negligence and breach of contract.Fusion's insurer, Axis, confirmed coverage of claims related to the data breach and assumed defense. After Zoll's insurer, Ace American Insurance Company (“Ace”) paid Zoll its claims for damages incurred due to the data breach, Ace was subrogated as the real party in interest in the arbitration.
Zoll also asserted claims against Barracuda before the arbitrator dismissed it as a party in December, 2020, for lack of privity.
In November, 2021, Fusion, Axis, Zoll and Ace settled the arbitration claims. Fusion and Zoll confirm that, pursuant to the settlement agreement, Zoll and Ace have assigned to Axis all claims that they have against Barracuda in connection with the data breach. They contend that Axis is therefore the real party in interest with respect to the claims asserted by Fusion and Zoll against Barracuda in this action as set forth hereafter.
ii. Claims of Zoll and Fusion against Barracuda
In November, 2020, Zoll filed the instant action against the Barracuda parties, alleging claims for 1) negligence (Count I), 2) breach of the implied warranty of merchantability (Count II), 3) breach of the implied warranty of fitness (Count III), 4) breach of contract (Count IV) and 5) equitable indemnification (Count V). The Barracuda parties moved to dismiss those claims and the Court allowed their motion except as to Count V.
In June, 2021, Fusion intervened in the action and filed an eight-count complaint against the Barracuda parties, alleging claims for 1) breach of contract, 2) breach of the implied covenant of good faith and fair dealing, 3) negligent misrepresentation, 4) tortious interference with contractual relations, 5) indemnification on the basis of a special relationship, 6) indemnification on the basis of tortious conduct, 7) breach of the implied warranty of merchantability and 8) breach of the implied warranty of fitness. Shortly thereafter, the Barracuda parties filed the pending motion to dismiss Fusion's intervenor complaint for failure to state a claim upon which relief can be granted.
In December, 2021, after the arbitration had concluded, Fusion and Zoll filed the pending motion to substitute Axis as plaintiff with respect to the original and intervenor complaints.
II. Barracuda's Motion to Dismiss
A. Legal Standard
To survive a motion under Fed.R.Civ.P. 12(b)(6), the subject pleading must contain sufficient factual matter to state a claim for relief that is actionable as a matter of law and “plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible if, after accepting as true all non-conclusory factual allegations, the court can draw the reasonable inference that the defendant is liable for the misconduct alleged. Ocasio-Hernandez v. Fortuno-Burset, 640 F.3d 1, 12 (1st Cir. 2011).
When rendering that determination, a court may not look beyond the facts alleged in the complaint, documents incorporated by reference therein and facts susceptible to judicial notice. Haley v. City of Boston, 657 F.3d 39, 46 (1st Cir. 2011). A court also may not disregard properly pled factual allegations even if actual proof of those facts is improbable. Ocasio-Hernandez, 640 F.3d at 12. Rather, the relevant inquiry focuses on the reasonableness of the inference of liability that the plaintiff is asking the court to draw. Id. at 13.
B. Application
The Barracuda parties have moved to dismiss Fusion's eight-count intervenor complaint for failure to state a claim upon which relief can be granted. The Court considers the counts of the complaint seriatim except with respect to Counts V and VI and Counts VII and VIII, which it treats together.
i. Breach of Contract (Count I)
A claim for breach of contract under Massachusetts law requires the plaintiff to show that:
[1] there was an agreement between the parties; [2] the agreement was supported by consideration; [3] the plaintiff was ready, willing, and able to perform his or her part of the contract; [4] the defendant committed a breach of the contract; and [5] the plaintiff suffered harm as a result.Bulwer v. Mount Auburn Hosp., 46 N.E.3d 24, 39 (Mass. 2016).
Fusion contends that Barracuda breached the parties' agreement by failing to provide the services required by the contract, i.e. data hosting that adequately protected the health information of Zoll's patients. Barracuda responds that Fusion cannot maintain its breach of contract claim because Fusion's agreement with Zoll (“the Hosting Agreement”) did not comply with the condition precedent imposed by paragraph 4.1(b) of the agreement between Barracuda and Fusion (“the OEM Agreement”).
A condition precedent defines an event that must occur before a contract becomes effective or before an obligation to perform arises under the contract. Petricca Development Ltd. Partnership v. Pioneer Development Co., 40 F.Supp.2d 49, 54 (D. Mass. 1999). If the condition precedent is not satisfied, the contract and the obligations set forth therein cannot be enforced. Massachusetts Mun. Wholesale Elec. Co. v. Town of Danvers, 577 N.E.2d 283, 288 (Mass. 1991).
Paragraph 4.1(b) of the OEM Agreement requires that Fusion's contracts with its customers, such as Zoll, include
terms consistent with [the OEM Agreement] and contain[] terms and conditions substantially in conformity with those set forth on Exhibit B [of that agreement].(stylization removed).
Barracuda contends that Fusion failed to incorporate into the Hosting Agreement language 1) requiring Zoll to indemnify Apptix, Inc. (“Apptix”), i.e. Fusion, and Sonian, i.e. Barracuda, for claims arising from Zoll's use of the product, and 2) limiting the liability of Barracuda to the lesser of actual damages or $1,000. Barracuda argues that because the Hosting Agreement did not contain such language (or substantially conforming language), Fusion has failed to satisfy the condition precedent and cannot bring the present breach of contract claim.
Apptix was later acquired by Fusion and the Court will refer to the two entities collectively as “Fusion” except insofar as the individual corporate identity of Apptix is relevant.
Fusion rejoins that the Hosting Agreement satisfied the condition precedent imposed by paragraph 4.1(b) because, even though the Hosting Agreement did not contain verbatim recitations of the terms and conditions at issue, it was consistent with the OEM Agreement and contained terms and conditions substantially in conformance with Exhibit B.
Furthermore, Fusion submits that if the Hosting Agreement failed to satisfy the condition precedent, such a failure would have excused Barracuda's performance under the OEM Agreement but would not constitute a waiver of Fusion's breach of contract claims. Rather, Fusion argues that because Barracuda continued to perform under the OEM Agreement, notwithstanding its contractual right to obtain information about the terms and conditions of the Hosting Agreement, Barracuda waived its right to interpose the condition precedent to defeat Fusion's breach of contract claims or, in the alternative, is equitably estopped from doing so. Barracuda denies that either doctrine precludes its condition precedent defense.
The Hosting Agreement does not satisfy the condition precedent imposed by paragraph 4.1(b) of the OEM Agreement. Exhibit B to the OEM Agreement contains a limitation of liability provision capping the damages of Apptix and Sonian at “the lesser of actual damages . . . or one thousand dollars”. (capitalization removed). The Hosting Agreement, however, limits the liability of a “party” to not more than
the amount paid to Apptix under [the Hosting Agreement] during the twelve (12) month period preceding the events giving rise to such liability.Here, that limitation apparently amounts to slightly less than One Million Dollars. Fusion argues that the Hosting Agreement is in substantial conformity with the OEM Agreement because liability thereunder is capped far below actual damages but that reality is insufficient where liability may nevertheless greatly exceed the limits imposed by the OEM Agreement. Moreover, the limitation of liability provision in the Hosting Agreement extends to each “party”, a defined term which does not include Barracuda or Sonian.
Nor is the indemnification provision of the same agreement in substantial conformity with Exhibit B to the OEM Agreement. Exhibit B's indemnification provision designates Sonian as an intended third-party beneficiary of that provision. By contrast, the Hosting Agreement fails to impose an obligation on Zoll to indemnify Barracuda.
Despite the failure of the condition precedent, Fusion's alternate argument of waiver is sufficient to preserve its breach of contract claim.
Fusion contends that Barracuda's failure to insist earlier on the satisfaction of the condition precedent constitutes waiver of the condition. Generally, a party may waive its contract rights such as a condition precedent in its favor. Millen Industries, Inc. v. Flexco-Accessories Co., Inc., 5 F.Supp.2d 72, 74 (D. Mass. 1998). Waiver under Massachusetts law requires the voluntary relinquishment of a known right. Boston Helicopter Charter, Inc. v. Agusta Aviation Corp., 767 F.Supp. 363, 372 (D. Mass. 1991). It can be either express or inferred from the party's conduct and the surrounding circumstances. Id. Where a waiver is implied, the waiving party's conduct must be indicative of an intent to relinquish voluntarily a particular right such that no other reasonable explanation of the conduct is possible. Bachorz v. Miller-Forslund, 703 F.3d 27, 32 (1st Cir. 2012).
Whether a waiver has occurred is usually a question of fact, Millen, 5 F.Supp.2d at 74, but here Barracuda contends that non-waiver language in the OEM Agreement disposes of Fusion's waiver arguments as a matter of law. The OEM Agreement provides that
[n]o failure or delay of [Barracuda] in exercising any right or remedy under this Agreement shall operate as a waiver of such right or remedy.
Massachusetts case law on the efficacy of non-waiver clauses is ambivalent. Another session of this Court has previously held such a clause effective, see Blue Hills Office Park LLC v. J.P. Morgan Chase Bank, 477 F.Supp.2d 366, 374 (D. Mass. 2007) (holding that non-waiver provision barred waiver of mortgagor's rights thereunder), while the Massachusetts Appeals Court has expressed skepticism, see M.J.G. Properties, Inc. v. Hurley, 537 N.E.2d 165, 167 (Mass. App. Ct. 1989) (stating that “we think the proper approach, and one which is in accord with our cases, is to look at the question of waiver as a question of fact in light of all the circumstances, including the existence of the antiwaiver clause”). Because the Court finds the Hurley approach more consistent with Massachusetts law, it declines to discount Fusion's waiver argument as a matter of law. Fusion has alleged facts sufficient to support its waiver defense, specifically by contending that for nine years Barracuda did not once inquire about Fusion's compliance with the condition precedent.
ii. Breach of Implied Covenant of Good Faith and Fair Dealing (Count II)
Under Massachusetts law, a covenant of good faith and fair dealing is implied in every contract. Shaulis v. Nordstrom, Inc., 120 F.Supp.3d 40, 54 (D. Mass. 2015) (citing Uno Rests. v. Boston Kenmore Realty Corp., 805 N.E.2d 957, 964 (Mass. 2004)). The scope of the covenant is, however, limited and it may not be invoked to create rights or benefits not contemplated by the contract. Robert & Ardis James Found. v. Meyers, 48 N.E.3d 450 (Mass. 2016). Moreover, a breach of contract does not necessarily constitute a corresponding breach of the covenant, Brand Group Int'l, LLC v. Established Brands Int'l, No. 10-11783, 2011 U.S. Dist. LEXIS 81507 (D. Mass. July 26, 2011). Rather, the covenant provides that in the course of the performance of a contract neither party will do anything to injure or destroy the right of the other to receive the fruits thereof. Anthony's Pier Four, Inc. v. HBC Assocs., 583 N.E.3d 806, 820 (Mass. 1991). A breach of the covenant thus occurs when one party violates the reasonable expectations of the other, Chokel v. Genzyme Corp., 867 N.E.2d 325, 329 (Mass. 2007).
In determining whether the covenant has been breached, the Court looks to whether there was a lack of good faith in the defendant's performance. Weiler v. PortfolioScope, 12 N.E.3d 354, 362 (Mass. 2014). The burden of showing a lack of good faith rests with the plaintiff. Id.
Fusion argues that Barracuda breached the covenant of good faith and fair dealing by a) failing to inform it of the breach for more than one week after its discovery, b) initially providing Fusion with explanations that understated the scope and severity of the breach and c) meaningfully failing to cooperate with Fusion and Zoll's attempts to investigate the breach. Barracuda retorts that Fusion's allegations sound merely in “human error” and lack the requisite absence of good faith to support a claim of breach of the implied covenant. That argument is unavailing for the purpose of the present motion. While further discovery may bear out Barracuda's assertion that nothing more nefarious than human error was at play in the weeks after the discovery of the breach, Fusion has pled facts sufficient to permit a reasonable inference that good faith was lacking. See Iqbal, 556 U.S. at 678, A.L. Prime Energy Consultant, Inc. v. Massachusetts Bay Transp. Auth., 95 N.E.3d 547, 560 (Mass. 2018) (holding that lack of good faith can be inferred from totality of the circumstances).
iii. Negligent Misrepresentation (Count III)
To maintain a claim of negligent misrepresentation, plaintiffs must allege facts indicating that the defendants
(1) in the course of [their] business, (2) supplied false information for the guidance of others (3) in their business transactions, (4) causing and resulting in pecuniary loss to those others (5) by their justifiable reliance on the information, and that [defendants] (6) failed to exercise reasonable care or competence in obtaining or communicating that information.Braunstein v. McCabe, 571 F.3d 108, 126 (1st Cir. 2009). Massachusetts courts treat negligent misrepresentation claims “more like negligence actions than deceit actions” and focus on the speaker's degree of care in making the statement. Cummings v. HPG Intern., Inc., 244 F.3d 16, 25 (1st Cir. 2001). The speaker need not have known that the statement was false if the truth could have been ascertained through “a modicum of diligence”. Zimmerman v. Kent, 575 N.E.2d 70, 74 (Mass. App. Ct. 1991).
Fusion has failed to state a claim for negligent misrepresentation. While it alleges that Barracuda made false statements regarding the data breach, it fails to allege that the harm it suffered was due to those allegedly false statements rather than the data breach itself.
iv. Tortious Interference with Contractual Relations (Count IV)
To maintain a claim for tortious interference with a contract or business relationship, the plaintiff must allege that
1) he had a contract with a third party, 2) the defendant knowingly induced the third party to break that contract, 3) the interference, in addition to being intentional, was improper in motive or means and 4) the plaintiff was harmed by the defendant's actions.Psy-Ed Corp. v. Klein, 947 N.E.2d 520, 536 (Mass. 2011).
Fusion's claim of tortious interference is incompatible with the facts it has alleged. As with its claim for negligent misrepresentation, Fusion has failed to allege that it suffered any harm from Barracuda's post-breach actions distinct from the harm occasioned by the data breach. Moreover, to the extent Fusion alleges that the data breach constituted tortious interference with contractual relations, it has not alleged that Barracuda acted with the requisite impropriety in its motive or means. See King v. Driscoll, 638 N.E.2d 488, 495 (Mass. 1994) (explaining that “improper motive or means” prong requires that defendant possess “actual malice, a spiteful malignant purpose, unrelated to the legitimate corporate interest”). Consequently, Fusion has not stated a claim for tortious interference with contractual relations.
v. Indemnification (Counts V and VI)
Under Massachusetts law, a right to indemnification may arise under three theories, namely 1) an express agreement, 2) a contractual right implied from the nature of the relationship between the parties and 3) a common law tort-based right. Araujo v. Woods Hole, Martha's Vineyard, Nantucket Steamship Auth., 693 F.2d 1, 2 (1st Cir. 1982). Fusion alleges it is entitled to indemnification by Barracuda under the second and third theories.
Implied contractual indemnification exists when there are “special factors” surrounding a contractual relationship which indicate an intention by one party to indemnify another. Fall River Housing Auth. v. H.V. Collins Co., 604 N.E.2d 1310, 1313 (Mass. 1992). Fusion contends that the OEM Agreement created a “special relationship” entitling it to implied contractual indemnification. Barracuda rejoins that the OEM Agreement provided only for indemnification of Barracuda by Fusion and that Fusion has no implied indemnification in its favor that the parties declined to include expressly.
The Court agrees with Barracuda. The parties' relationship does not indicate an intention of Barracuda to indemnify Fusion. Rather, the OEM Agreement exclusively provides for the indemnification of Barracuda. Under such circumstances, there is no implied right to indemnity on the part of Fusion. See Id. (finding no implied right to indemnification where express indemnity provision existed and limited indemnification only to the costs arising from its negligence).
Common law tort-based equitable indemnification is available to a party who did not join in the negligent act of another but, because of that act, was nevertheless exposed to liability. Hernandez v. City of Boston, 277 F.Supp.3d 176, 180 (D. Mass. 2017). That standard typically requires that the party seeking indemnity be, at most, passively or vicariously at fault. Araujo, 693 F.2d at 3. Where the party seeking indemnification instead was itself responsible for acts or omissions proximately causing plaintiff's injury, courts have found tort-based equitable indemnification to be inappropriate. Id.
Fusion fails to state a claim for tort-based equitable indemnification because it does not allege that it has been held liable as a tortfeasor, or will be. Rather, its potential liability appears to derive from its contractual relationship with Zoll. Under such circumstances tort-based equitable indemnity is inappropriate. See Walter v. Shuffain, P.C. v. CPA Mut. Ins. Co., No. 06-10163, 2008 U.S. Dist. LEXIS 25422 (D. Mass. Mar. 28, 2008) (explaining that liability “must spring from the same theory, not merely the same harms”), see also Stewart v. Roy Bros., 265 N.E.2d 357 (Mass. 1970).
vi. Breach of Implied Warranties of Merchantability (Count VII) and Fitness (Count VIII)
In its prior memorandum and order (“M&O”) allowing, in part, and denying, in part, Barracuda's motion to dismiss plaintiff Zoll's claims, the Court held that the Barracuda parties validly waived the implied warranties of merchantability and fitness in the OEM Agreement and that Zoll thus could not maintain its claims for breach of warranty. See Zoll Med. Corp., 2021 U.S. Dist. LEXIS 180761 at *10-14. Zoll was a third party to the OEM Agreement and as such its implied warranty claims were derivative of those of Fusion, the principal. See Id. (citing Theos & Sons, Inc. v. Mack Trucks, Inc., 729 N.E.2d 1113, 1118 (Mass. 2000) (holding that subsequent purchaser cannot possess greater warranty rights than original purchaser). In finding that Barracuda had waived the implied warranties as to Zoll, the Court concluded that Barracuda had made the same waiver as to Fusion. See Id. at 14. That holding controls here and thus for the reasons stated in the Court's prior M&O, Fusion has failed to state a claim for breach of the implied warranties of merchantability and fitness.
III. The Motion to Substitute
Zoll and Fusion have moved to substitute Axis as plaintiff. Federal Rule of Civil Procedure 25(c) provides that if an interest in the litigation is transferred after its commencement, the action
may be continued by . . . the original party unless the court, on motion, orders the transferee to be substituted in the action or joined with the original party.Fed. R. Civ. P. 25(c).
The court has “considerable leeway” to allow the substitution of parties so as to “facilitate the conduct of the litigation.” Potvin v. Speedway, LLC, 891 F.3d 410, 416 (1st Cir. 2010) (internal citations omitted), see Negron-Almeda v. Santiago, 579 F.3d 45, 53 (1st Cir. 2009) (describing Rule 25 as a “discretional procedural vehicle”).
Where an insurer has compensated its insured for a loss in full, the insurer is the sole real party in interest and must sue in its own name. See Woods Hole Oceanographic Inst. v. ATS Specialized, No. 17-12301, 2020 U.S. Dist. LEXIS 250077 at *9-10 (D. Mass. Dec. 22, 2020) (collecting cases). If the insured has been compensated only in part, however, both it and the insurer are real parties in interest. See Id. Where an interest has been otherwise assigned, Rule 25(c) allows for substitution of the assignee. See Citibank v. Grupo Cupey, Inc., 382 F.3d 29, 30-31 (1st Cir. 2004).
Fusion and Zoll represent that, pursuant to the November, 2021, settlement of the arbitration proceeding, they, along with Axis and Zoll's insurer, Ace, agreed to assign to Axis “all claims that Zoll and/or Ace may have against Barracuda in connection with [the breach]”. They consequently seek substitution under Rule 25. Barracuda opposes substitution on the ground that the settlement agreement has not been produced and its legal effect is therefore uncertain.
The Court is disinclined to declare the legal effect of documents it has not seen. See Woods Hole Oceanographic Inst. v. ATS Specialized, Inc., No. 17-12301, 2020 U.S. Dist. LEXIS 250077 at *5-10 (D. Mass. Dec. 22, 2020) (determining party-in-interest status for Rule 17 purposes after examination of operative documents). The Court will, therefore, in order to “facilitate the conduct of the litigation”, allow the joinder of Axis (which apparently possesses an interest of some kind in this litigation) as plaintiff and intervenor but will not dismiss Zoll and Fusion until it is shown that they retain no continuing interest in the action. Potvin, 891 F.3d at 416.
ORDER
For the foregoing reasons, defendants' motions to dismiss (Docket No. 31) is, with respect to Counts III, IV, V, VI, VII and VIII, ALLOWED, but otherwise, DENIED.
The joint motion of Zoll Services LLC, Zoll Medical Corporation and Fusion LLC to substitute Axis Insurance Company as plaintiff and intervenor (Docket No. 43) is, to the extent it seeks to introduce Axis Insurance Company into the action as plaintiff, ALLOWED, but otherwise, DENIED.
So ordered.