MDL No. 2357 - IN RE: Zappos.com, Inc., Customer Data Security Breach Litigation

Filing 175

ORDER re 171 Supplemental case management report. The third and final communication to this limited group of Zappos' customers shall be sent by regular mail, and the parties shall revise Exhibit 2 to the supplemental case management report 171 accordingly. Signed by Magistrate Judge Valerie P. Cooke on 5/9/14. (Copies have been distributed pursuant to the NEF - DN)

1
2
3
4

UNITED STATES DISTRICT COURT

5

DISTRICT OF NEVADA

6

***

7
8
9
10

IN RE ZAPPOS SECURITY BREACH
LITIGATION,

Case No. 3:12-CV-0325-RCJ (VPC)
ORDER

______________________________________
This document relates to: ALL ACTIONS.

11
12
13
14
15
16
17
18
19

At the April 21, 2014, case management conference, the court directed plaintiffs and
defendant Zappos.com, Inc. (“Zappos”) to submit a proposed letter to be sent to customers who
previously complained about the January 2012, cyber-attack that Zappos suffered (the
“incident”) (#170). The parties jointly submitted a supplemental case management report in
response (#171), and this order follows.
The parties agree on to the following protocol:

20

1.

There will be a first notice emailed to Zappos customers
who complained about the incident, attached as Exhibit 1 to
the supplemental case management report (#171, Ex. 1).1

2.

This same notice will be emailed a second time to
customers who do not respond to it within one week.

21
22
23
24

However, the parties dispute whether the third and final notice to this group of customers should

25

once again be sent by email or regular mail.

26
27
28

1

The parties agree that if the initial email is returned as non-deliverable, the notice will be
delivered by regular mail to the customer billing address.

1

Plaintiffs wish to contact by regular mail those Zappos customers who have already

2

complained about the incident. Plaintiffs complain that Zappos has redacted customer contact

3

information in discovery that goes to the heart of this case, and this information will allow

4

witnesses the opportunity to share their stories with plaintiffs’ counsel. However, plaintiffs’

5

counsel acknowledges that because of the data breach in this case, customers may be sensitive to

6

having any information disclosed, which is why plaintiffs agreed to the two-email protocol to ask

7

the targeted group of customers whether they wish to share their contact information. Plaintiffs’

8

concern is that witnesses who have not responded to the first two emails may either be ignoring

9

Zappos, or they are no longer using the email address Zappos has on file. Therefore, it makes

10

sense to send the final communication by regular mail.

11

Zappos’ view is that in having all notices sent by email, those customers who wish to

12

contact plaintiffs’ counsel may do so without disclosing additional contact information. Zappos

13

argues that plaintiffs have shown no compelling reason to contact the customers, which

14

plaintiffs’ counsel characterized as “witnesses” at the April 2014, hearing, and the court should

15

insure the customers affirmatively consent to contact before such contact is allowed. Since

16

Zappos is an online retailer, its customers are more accustomed to receiving electronic

17

communications from Zappos, as opposed to traditional mail, and it is more likely they will

18

respond to email communications.

19

Before class certification occurs under Rule 23, discovery is within the discretion of the

20

court. Vinole v. Countrywide Home Loans, Inc., 571 F.3d 935, 942 (9th Cir. 2009). It is the

21

plaintiff’s burden either to make a prima facie showing that Rule 23's class action requirements

22

are satisfied, or to show that “discovery is likely to produce substantiation of the class

23

allegations.” Manolete v. Bolger, 767 F.2d 1416, 1424 (9th Cir. 1985). The court must decide

24

whether the action may be maintained as a class action as soon as practicable after the action is

25

filed. Fed.R.Civ.P. 23(c)(1). This means that discovery may be proper where it will resolve

26

factual issues required to decide whether the action should be maintained as a class action.

27

Kamm v. California City Development Co., 509 F.2d 205, 210 (9th Cir. 1975). “To deny

28

discovery where it is necessary to determine the existence of a class or set of subclasses would

-2-

1

be an abuse of discretion.” McArdle v. AT&T Mobility LLC, 2010 WL 1532334 at *2 (N.D.Cal.

2

2010) (citations omitted). The court may permit the disclosure of names, address, and telephone

3

numbers in the pre-certification class action context. Id. at *2, citing Sanbrook v. Office Depot,

4

2009 WL 840019 at *1 (N.D.Cal. 2009); Salazar v. Avis Budget Group, Inc., 2007 WL 2990281,

5

*1 (S.D.Cal. 2007).

6

need for the discovery. See, e.g., Pioneer Electronics v. Superior Court, 40 Cal.4th 360, 372

7

(2007).

However, the court must balance the right of privacy against the plaintiff’s

8

In this case, the parties agree that potentially aggrieved customers shall be contacted

9

twice by email because Zappos is an online company, and it is likely that customers routinely

10

communicate by email. The email notices will also safeguard their privacy rights. However, as

11

to the third and final communication, the court agrees that it should be sent by regular mail for

12

three reasons. First, since there was a data breach, Zappos customers may have changed their

13

email addresses to safeguard their security.

14

customers being contacted may ignore or delete emails sent by Zappos. Third, it is reasonable

15

that the third and final communication be sent by regular mail to insure notice is given to those

16

whose email addresses have changed or to customers do not wish to communicate with Zappos.

17

It seems likely they would open a letter sent to their homes.

Second, given the data breach, the group of

18

Based upon the foregoing, the court orders as follows:

19

1.

The third and final communication to this limited group of Zappos’ customers be

20

sent by regular mail, and the parties shall revise Exhibit 2 to the supplemental case management

21

report (#171) accordingly.

22

IT IS SO ORDERED.

23

Dated: May 9, 2014.

24
25

__________________________________________
UNITED STATES MAGISTRATE JUDGE

26
27
28

-3-