Allen et al v. Blackbaud Inc
Filing
133
ORDER AND OPINION denying (216) Motion; denying as moot (230) Motion; dismissing (232) Sealed Motion; dismissing (233) Motion. Signed by Honorable J Michelle Childs on 4/18/2022.Associated Cases: 3:20-mn-02972-JMC et al.(asni, )
3:20-cv-02930-JMC
Date Filed 04/18/22
Entry Number 133
Page 1 of 9
IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF SOUTH CAROLINA
COLUMBIA DIVISION
)
)
IN RE: BLACKBAUD, INC.,
)
CUSTOMER DATA BREACH
)
LITIGATION
)
)
____________________________________)
Case No.: 3:20-mn-02972-JMC
MDL No. 2972
ORDER AND OPINION
THIS DOCUMENT RELATES TO: ALL ACTIONS:
This matter is before the court on Plaintiffs’ Motion for Corrective Notice. (ECF No. 216.)
Plaintiffs assert that curative relief is necessary because Blackbaud has made “few, if any, accurate
statements [] to class members about the data breach, and the information class members have
received suggests that their risk of identity theft, fraud, or data misuse is much lower than it
actually is.” (ECF No. 216-1 at 25.) For the reasons set forth below, the court DENIES Plaintiffs’
Motion for Corrective Notice. (ECF No. 216.) 1
I.
RELEVANT BACKGROUND
Plaintiffs in this action represent a putative class of individuals whose data was provided
to Blackbaud’s customers and managed by Blackbaud. (See ECF No. 194 at 9 ¶ 16.) Thus,
Plaintiffs are patrons of Blackbaud’s customers rather than direct customers of Blackbaud. (ECF
Nos. 92-1 at 9; 109 at 7–8.) Plaintiffs assert that, from February 7, 2020 to May 20, 2020,
cybercriminals infiltrated Blackbaud’s computer networks, copied Plaintiffs’ data, and held it for
ransom. (ECF No. 194 at 5 ¶ 8, 14 ¶ 29.) Blackbaud ultimately paid the ransom in an undisclosed
The unredacted version of Plaintiffs’ Motion for Corrective Notice was filed under seal as ECF
No. 204. The court’s holding applies to both versions of Plaintiffs’ Motion for Corrective Notice.
(ECF Nos. 204, 216.)
1
1
3:20-cv-02930-JMC
Date Filed 04/18/22
Entry Number 133
Page 2 of 9
amount of Bitcoin in exchange for a commitment that any data previously accessed by the
cybercriminals was permanently destroyed. (Id. at 3 ¶ 1.)
Plaintiffs maintain that the breach resulted from Blackbaud’s “deficient security
program[.]” (ECF No. 194 at 95 ¶ 351.) They assert that Blackbaud failed to comply with industry
and regulatory standards by neglecting to implement security measures to mitigate the risk of
unauthorized access, utilizing outdated servers, storing obsolete data, and maintaining unencrypted
data fields. (Id. at 95–96 ¶ 351, 124 ¶ 422, 130 ¶ 441.) Plaintiffs further allege that after the
breach, Blackbaud launched a narrow internal investigation into the attack that analyzed a limited
number of Blackbaud systems and did not address the full scope of the attack. (Id. at 194–95 ¶
445.) Plaintiffs contend that Blackbaud failed to provide them with timely and adequate notice of
the breach and the extent of the resulting data breach. (Id. at 112–13 ¶ 391.) After the breach was
made public, putative class actions arising out of the intrusion into Blackbaud’s systems and
subsequent data breach were filed in state and federal courts across the country. (ECF No. 1 at 1.)
On December 15, 2020, the Judicial Panel on Multidistrict Litigation consolidated all federal
litigation related to the breach into this district for coordinated pretrial proceedings. (Id. at 3.)
On February 16, 2022, Plaintiffs filed their sealed Motion for Corrective Notice, seeking
the court’s approval of their dissemination of a corrective notice to “prevent further harm to class
members.” (ECF No. 204.) On March 1, 2022, Plaintiffs filed the redacted version of their Motion
for Corrective Notice on the public docket. (ECF No. 216.)2 Plaintiffs allege that Blackbaud made
numerous misrepresentations to the public, including the representation that the stolen information
2
The court notes that, although Plaintiffs filed their sealed Motion for Corrective Notice on
February 16, 2022 (ECF No. 204), they did not file their redacted version until March 1, 2022
(ECF No. 216), after Blackbaud filed its Response (ECF Nos. 214, 215). As such, the chronology
of the redacted versions Plaintiffs’ Motion and Blackbaud’s Response does not accurately reflect
the timing of the filings with the court.
2
3:20-cv-02930-JMC
Date Filed 04/18/22
Entry Number 133
Page 3 of 9
had been deleted even though Blackbaud had not confirmed this, misrepresenting the type of data
stolen, and performing an unreliable risk of harm analysis that did not actually take into account
the harm class members faced as a result of the breach. (ECF No. 216-1 at 5.) To “rectify the
harm caused by Blackbaud’s deficient—and inaccurate—notice to its customers and the public,”
Plaintiffs move the court to cure these misrepresentations by dissemination of a corrective notice.
(Id. at 6.) Plaintiffs contend that the court’s approval is permissible under its “inherent authority
and Federal Rule [of] Civil Procedure 23(d).” (Id. at 3.)
On March 1, 2022, Blackbaud filed a sealed Response to Plaintiffs’ Motion for Corrective
Notice (ECF No. 214) as well as a redacted version of its Response (ECF No. 215). In its
Response, Blackbaud emphasizes that it has never directly communicated with individual
members of the putative class concerning the ransomware attack and has never asked them to
arbitrate, waive, or otherwise compromise their claims. (ECF No. 214 at 9.) Blackbaud argues
that Plaintiffs’ proposed notice would not serve any purpose because Plaintiffs’ counsel have
already publicized this case and that Plaintiffs’ Motion is improper because they are essentially
requesting that the court enforce their litigation position before the issues are decided on the
merits.3 (Id. at 11.) The court heard arguments from the parties on March 23, 2022. On March
30, 2022, Blackbaud notified the court that it had removed all summaries of the security incident
from its website.4
Blackbaud also asserts that the Motion should be dismissed based on Plaintiffs’ failure to comply
with Local Rule 7.03’s meet and confer requirements prior to filing the motion. (ECF No. 214 at
11 n.2.) Because the court denies Plaintiffs’ Motion on other grounds, it declines to address this
basis for denial.
4
Plaintiffs also filed a Supplement to their Motion for Corrective Notice (ECF No. 233) on April
14, 2022, over a month after the deadline to file a reply brief to Blackbaud’s Response had passed.
Plaintiffs did not provide an excuse for their belated filing, and it is well within the court’s
discretion to disregard this filing as untimely under the Federal Rules of Civil Procedure. See,
e.g., Davidson v. O’Reilly Auto Enters., LLC, 968 F.3d 955, 963 (9th Cir. 2020); United States v.
3
3
3:20-cv-02930-JMC
Date Filed 04/18/22
II.
Entry Number 133
Page 4 of 9
LEGAL STANDARD
Federal Rule of Civil Procedure 23(d)(1) provides that in conducting a class action, “the
court may issue orders that: (C) impose conditions on the representative parties or on intervenors;
. . . or (E) deal with similar procedural matters.” Fed. R. Civ. P. 23(d)(1). “Because of the potential
for abuse, a district court has both the duty and the broad authority to exercise control over a class
action and to enter appropriate orders governing the conduct of counsel and parties.” Gulf Oil Co.
v. Bernard, 452 U.S. 89, 100 (1981). However, such discretion is not unlimited. In a class action,
“a district court may not order restraints on speech under [Rule] 23(d) except when justified by
actual or threatened misconduct of a serious nature.” Great Rivers Co-Op. of Se. Iowa v. Farmland
Indus., Inc., 59 F.3d 764, 766 (8th Cir. 1995). The entry of such an order must be “based on a
clear record and specific findings that reflect a weighing of the need for a limitation and the
potential interference with the rights of the parties.” Gulf Oil Co., 452 U.S. at 101. “Misleading
communications to class members concerning the litigation pose a serious threat to the fairness of
the litigation process, the adequacy of representation and the administration of justice generally.”
In re Sch. Asbestos Litig., 842 F.2d 671, 680 (3d Cir. 1988) (citing Gulf Oil, 452 U.S. at 101 n.2).
III.
ANALYSIS
Plaintiffs contend corrective notice is necessary because Blackbaud’s own notice of the
data breach was inaccurate and misleading. (ECF No. 216-1 at 22.) Plaintiffs’ Motion primarily
focuses on disputed issues in this case, namely how the breach occurred, Blackbaud’s response,
and the veracity of Blackbaud’s public statements on its website. Further, a review of the record
$70,670.00 in U.S. Currency, 929 F.3d 1293, 1302 (11th Cir. 2019) (“District courts have the
discretion not to consider belated arguments”); Stephenson v. Cox, 223 F. Supp. 2d 119, 121
(D.D.C. 2002). (“A district court may exercise its discretion and decide not to consider a late-filed
response that falls short of the requirements of Rule 6(b).”). In the interest of promoting the
efficiency of this litigation, the court declines to consider the supplemental filing.
4
3:20-cv-02930-JMC
Date Filed 04/18/22
Entry Number 133
Page 5 of 9
establishes that Plaintiffs have not shown that Blackbaud improperly communicated with putative
class members regarding this litigation such that the court’s interference is warranted at this time.
Courts typically grant curative relief where the record shows that one of the parties has
communicated with putative class members in a way that misleads them about their rights related
to the pending litigation. See, e.g., Romano v. SLS Residential Inc., 253 F.R.D. 292, 297
(S.D.N.Y. 2008) (finding corrective notice necessary because defendants developed and executed
a plan through which they sought to coerce putative class members to opt out of the class by
providing class members with “patently false and misleading information about what this Court
has done, what the Court will do and what will come to pass during the litigation of this case”);
Ralph Oldsmobile, Inc. v. Gen. Motors Corp., No. 99 CIV. 4567 (AGS), 2001 WL 1035132, at *3
(S.D.N.Y. Sept. 7, 2001) (remedial action warranted based on the record, which supported findings
of potential coercion and potentially unknowing waivers of the rights asserted in the action);
Goody v. Jefferson Cnty., No. CV-09-437-E-BLW, 2010 WL 3834025, at *3 (D. Idaho Sept. 23,
2010) (“the Court finds that corrective notice is necessary to ensure that all putative plaintiffs know
about their right to join the collective action”). Plaintiffs have alleged no comparable conduct by
Blackbaud that has interfered with their ability to bring this lawsuit or misled potential class
members regarding their rights in this litigation.
Although courts have sometimes found
communications to be inherently coercive where there is an ongoing business relationship between
the defendant and potential class members, see Tolmasoff v. Gen. Motors, LLC, No. 16-11747,
2016 WL 3548219, at *11 (E.D. Mich. June 30, 2016) (citing Sorrentino v. ASN Roosevelt Ctr.
LLC, 584 F. Supp. 2d 529, 533 (E.D.N.Y. 2008)), in this case, there is no direct relationship
between Blackbaud and potential class members.
5
3:20-cv-02930-JMC
Date Filed 04/18/22
Entry Number 133
Page 6 of 9
The court also notes that Plaintiffs seek to disseminate the corrective notice to Blackbaud’s
customers, who are not parties to this case nor are they putative class members. In fact, Plaintiffs
have not put forth any evidence that Blackbaud communicated directly with putative class
members regarding this litigation or otherwise. As such, the proposed notice does not implicate
the court’s authority under Rule 23(d) to address improper communications with potential class
members or to protect the legal interests of potential class members in this case. Plaintiffs also
have not shown how preventing their distribution of this notice would interfere with their
prosecution of the case.5 See In re Pella Corp., Architect & Designer Series Windows Mktg., Sales
Pracs. & Prods. Liab. Litig., No. 2:14-mn-00001-DCN, 2014 WL 12622421, at *3 (D.S.C. Nov.
20, 2014).
Further, the court “must strive to avoid authorizing injurious class communications that
might later prove unnecessary.” Jackson v. Motel 6 Multipurpose, Inc., 130 F.3d 999, 1004 (11th
Cir. 1997). An order authorizing communication in a class action is improper when “(1) the
communication authorized by the order is widespread and clearly injurious and (2) a certification
decision is not imminent or it is unlikely that a class will in fact be certified.” Id. “In such
circumstances, the danger of abuse that always attends class communications—the possibility that
plaintiffs might use widespread publication of their claims, disguised as class communications, to
coerce defendants into settlement—is not outweighed by any need for immediate
communications.” Id. Here, Plaintiffs intend to distribute the corrective notice to Blackbaud’s
customers via email, internet advertising, social media, a website, and a press release with the
assistance of a qualified claims administrator. (ECF No. 204-36 at 3–9 ¶¶ 12–34.) As such,
Because this order does not limit “communications regarding ongoing litigation between a class
and class opponents” or ban any other communications, Plaintiffs’ First Amendment rights are not
implicated. See Kleiner v. First Nat. Bank of Atl., 751 F.2d 1193, 1205 (11th Cir. 1985).
5
6
3:20-cv-02930-JMC
Date Filed 04/18/22
Entry Number 133
Page 7 of 9
Plaintiffs also ask the court to order Blackbaud to provide the e-mail addresses of the customers
whose clients’ information was exfiltrated in the data breach. (ECF No. 216-1 at 28.) Such a
broad dissemination of the corrective notice is likely to cause serious harm to Blackbaud’s general
reputation and to its relationships with its customers.
Additionally, the proposed notice adopts Plaintiffs’ position on substantive, disputed issues
at the crux of this matter concerning Blackbaud’s conduct and representations surrounding the data
breach. “Rule 23(d)(2) authorizes notice to protect class members’ right to participate in the
litigation it does not authorize substantive orders protecting the very rights class members seek to
vindicate.” Cobell v. Kempthorne, 455 F.3d 317, 324–25 (D.C. Cir. 2006); see also DW Volbleu,
LLC v. Honda Aircraft Co., Inc., No. 4:21-cv-637-SDJ, 2021 WL 5826536, at *4 (E.D. Tex. Dec.
8, 2021) (“Nothing in Rule 23(d) authorizes such a pre-certification notice addressing issues to be
decided on the merits, much less a notice that overtly endorses the litigation position of one of the
parties before any class has been certified.”); Payne v. Goodyear Tire & Rubber Co., 207 F.R.D.
16, 20 (D. Mass. 2002) (“The text, however, concerns disputed issues of fact in this case and may
not for that reason alone be characterized as ‘misleading.’”). At bottom, Plaintiffs invite the court
to step into the purview of the jury by making credibility determinations, weighing the evidence,
and drawing inferences from the facts in Plaintiffs’ favor. E.g., Reeves v. Sanderson Plumbing
Prods., Inc., 503 U.S. 133, 135 (2000). The court declines to overstep its authority in this way.
Further, the court observes that Plaintiffs seek to disseminate information based on
discovery materials that have been designated as protected material pursuant to the Stipulated
Confidentiality Order (ECF No. 63). The Confidentiality Order provides that “Discovery Material
shall be used by a Receiving Party solely for purposes of this litigation.” (ECF No. 63 at 4; see
also id. at 17 (“Persons obtaining access to Protected Material pursuant to this Protective Order
7
3:20-cv-02930-JMC
Date Filed 04/18/22
Entry Number 133
Page 8 of 9
shall use the information in connection with this Litigation only[.]”).)6 The Confidentiality Order
specifically prohibits disclosure of Protected Material designated as CONFIDENTIAL to putative
class members “other than the named plaintiffs, class representatives, and proposed class
representatives unless and until one or more classes have been certified[.]” (Id. at 7.) Although
Plaintiffs contend that they are in the process of challenging Blackbaud’s confidential designations
with the Special Master in this case, they have not shown that they have any right to use
confidential information produced in discovery to broadcast their position in this litigation. See,
e.g., In re Pella, 2014 WL 12622421, at *3.
Ultimately, the Federal Rules of Civil Procedure do not authorize Plaintiffs’ request to
widely disseminate a notice endorsing their position on dispositive issues to Blackbaud’s
customers, who are not parties or putative class members in this case, where Plaintiffs have not
shown that Blackbaud made misleading communications regarding this litigation.
IV.
CONCLUSION
For the foregoing reasons, the court DENIES Plaintiffs’ Motion for Corrective Notice.
(ECF No. 216.)7 Because the court declines to consider Plaintiffs’ supplemental filing, it also
DENIES AS MOOT Blackbaud’s Motion to Seal its Response (ECF No. 230) and DISMISSES
Plaintiffs’ Supplement to their Motion (ECF Nos. 232, 233).
IT IS SO ORDERED.
United States District Judge
“Protected Material” means Discovery Material “designated as CONFIDENTIAL,
CONFIDENTIAL – TRIAL COUNSEL ONLY, or CONFIDENTIAL – TRIAL COUNSEL
ONLY – SECURITY SENSITIVE pursuant to [the] Confidentiality Order.” (ECF No. 63 at 3.)
7
The court’s holding also applies to the sealed version of Plaintiffs’ Motion for Corrective Notice
(ECF No. 204).
6
8
3:20-cv-02930-JMC
Date Filed 04/18/22
April 18, 2022
Columbia, South Carolina
9
Entry Number 133
Page 9 of 9
Disclaimer: Justia Dockets & Filings provides public litigation records from the federal appellate and district courts. These filings and docket sheets should not be considered findings of fact or liability, nor do they necessarily reflect the view of Justia.
Why Is My Information Online?