UNITED STATES JUDICIAL PANEL

on

MULTIDISTRICT LITIGATION

IN RE: MOVEIT CUSTOMER DATA

SECURITY BREACH LITIGATION MDL No. 3083

TRANSFER ORDER

Before the Panel: Plaintiffs in three actions pending in the Eastern District of Arkansas and the Northern and Southern Districts of California and defendant M&T Bank Corporation in two Western District of New York actions (the M&T Bank actions) move under Panel Rule 7.1 to vacate the Panel’s orders conditionally transferring their respective actions, which are listed on the attached Schedule A, to MDL No. 3083. Principal MDL defendant Progress Software Corporation (Progress) and its subsidiary Ipswitch, Inc., oppose all four motions to vacate. Defendant Pension Benefit Information, LLC (PBI) in the Eastern District of Arkansas LOPFI action, and plaintiffs in six MDL No. 3083 actions also naming PBI as a defendant oppose the motion to vacate involving LOPFI. Defendant Medical Eye Services, Inc. (MESVision) in the Northern District of California Lew action and the Southern District of California Bosley action oppose the motions to vacate as to Lew and Bosley. Plaintiff in an MDL No. 3083 action also naming California Physicians’ Service d/b/a Blue Shield of California (Blue Shield) as a defendant also opposes the motion as to Lew, and plaintiffs in MDL No. 3083 actions against customer-facing defendants represented by MDL No. 3083 lead counsel oppose the motion as to Bos/ey. Plaintiffs in one MDL No. 3083 action and other plaintiffs in MDL No. 3083 actions against customer-facing defendants, represented by MDL No. 3083 lead counsel, oppose the motion as to the M&T Bank actions. After considering the arguments of counsel, we find that these actions involve common questions of fact with the actions previously transferred to MDL No. 3083, and that transfer under 28 U.S.C. § 1407 will serve the convenience of the parties and witnesses and promote the just and efficient conduct of the litigation. In our order directing centralization, we held that the District of Massachusetts was an appropriate Section 1407 forum for actions sharing factual questions concerning allegations that “a vulnerability in Progress Software Company’s MOVEIit Transfer and MOVEit Cloud file transfer services was exploited by a Russian cybergang in May 2023, which to date is estimated to have compromised the personally identifying information (PID) of over 55 million people.” In re MOVEit Customer Data Sec. Breach Litig., MDL No. 3083, _F. Supp. 3d___, 2023 WL 6456749 at *2 (J.P.M.L. Oct. 4, 2023) (citations omitted). “On May 31, 2023, Progress posted a notice on its website stating it had discovered an SQL injection vulnerability in its MOVEIt file transfer services and a related breach in its network and systems. Plaintiffs are individuals whose PII was potentially compromised. They bring largely overlapping putative nationwide or statewide class actions on behalf of persons impacted by the exploitation of the MOVEit software vulnerability.” /d. The actions before us arise from the MOVEit data breach and thus fall within the MDL’s ambit.

-2-

That these actions do not name Progress as a defendant—or that some do not even mention Progress or MOVEit—does not weigh against transfer. We consistently have rejected arguments in this docket that unique defendant-specific factual questions weigh against centralization. See Id. *3 (“While ... there may be allegations specific to each defendant’s role in the breach of a particular plaintiffs data, this litigation—regardless of whether Progress is named as defendant in a particular case—poses significant questions about Progress’s role (and, in many cases, the role of direct users like PBI) in the ultimate exploitation of the MOVEit Transfer vulnerability.”). The Panel also has rejected individual convenience-based arguments against transfer to MDL No. 3083, such as those advanced by the LOPFT plaintiff and defendant M&T Bank, finding that “we must consider the needs of all parties and view the litigation as a whole.” Jd. The Eastern District of Arkansas LOPFI plaintiff argues that its claims are focused exclusively on PBI’s conduct towards plaintiff, particularly its conduct in responding to the breach. But the LOPFT complaint alleges that PBI “failed to use reasonable care in selecting, designing, implementing, and using the software and reporting platform that it provided for the sharing of data with LOPFI.” LOPF/ Compl. at 417. Thus, the security of the MOVEit file transfer software will be at issue. And PBI’s response to the MOVEit data breach will be common to many other MDL No. 3083 actions, as there are numerous actions with claims against PBI. Transfer is warranted in light of the substantial factual overlap with the MDL actions. See Jn re Blue Cross Blue Shield Antitrust Litig., 908 F. Supp. 2d 1373, 1376 (J.P.M.L. 2012) (“the presence of additional facts or differing legal theories is not significant when the actions still arise from a common factual core”). In opposing transfer of two Western District of New York actions, defendant M&T Bank argues that the actions are unique because the information compromised tn the breach is not “PII” under the MDL No. 3083 Transfer Order’s definition. But the language of the Panel’s Transfer Order clearly contemplated that other information could be at issue in a related action. See In re it, 2023 WL 6456749 at *2, n.4 ( “Plaintiffs PI includes such things as their names, Social Security numbers, birthdates, demographic information, insurance policy numbers, and other financial information.”) (emphasis added). And whether plaintiffs have standing to bring suit against defendants based on the information compromised will be at issue in many MDL No. 3083 actions. In fact, the MDL No. 3083 parties are due to brief Article III standing as a threshold omnibus motion based on allegations that may include those “regarding certain categories of Defendants, such as allegations regarding the types of information compromised and/or the relationships between Progress and certain categories of Defendants (i.e., Direct Users, Vendors, and so forth, as proposed by Defendants).”! M&T Bank also argues these actions are unique because they concern M&T Bank’s relationship with its third party vendor. But the Panel’s initial transfer order in this litigation contemplated that the MDL would include actions against “customer-facing companies (many of whom did not use MOVEit software but instead contracted or subcontracted with a company that did).” In re MOVEit, 2023 WL 6456749 at *2. Despite the presence of some unique factual issues, transfer of these actions is warranted, in light of the substantial factual overlap.

See Joint Proposal Regarding Briefing of Threshold Issues, MDL No. 3083 (D. Mass. Apr. 5, 2024), ECF No. 851, at p. 4.

-3-

Plaintiffs in the Northern District of California Lew and Southern District of California Bosley actions oppose transfer primarily based on jurisdictional arguments, arguing that their motions to remand likely will be granted. But we consistently have held that the pendency of a remand motion is insufficient to warrant vacating a CTO. See, e.g., In re Ford Motor Co. DPS6 PowerShift Transmission Prods. Liab. Litig., 289 F. Supp. 3d 1350, 1352 (J.P.M.L. 2018) (“It is well-established that jurisdictional objections, including objections to removal, are not relevant to transfer. This is so even where, as here, plaintiffs assert that the removals were patently improper.”). Plaintiffs can present their motions to remand to the transferee court.” IT IS THEREFORE ORDERED that these actions are transferred to the District of Massachusetts and, with the consent of that court, assigned to the Honorable Allison D. Burroughs for inclusion in the coordinated or consolidated pretrial proceedings.

PANEL ON MULTIDISTRICT LITIGATION

fi : Caldwell Chair Nathaniel M. Gorton Matthew F. Kennelly David C. Norton Roger T. Benitez Dale A. Kimball Madeline Cox Arleo

Panel Rule 2.1(d) expressly provides that the pendency of a conditional transfer order does not limit the pretrial jurisdiction of the court in which the subject action is pending. Between the date a remand motion is filed and the date that transfer of the action to the MDL is finalized, a court generally has adequate time to rule on a remand motion if it chooses to do so. Both courts have stayed the actions before them.

IN RE: MOVEIT CUSTOMER DATA

SECURITY BREACH LITIGATION MDL No. 3083

SCHEDULE A

Eastern District of Arkansas ARKANSAS LOCAL POLICE AND FIRE RETIREMENT SYSTEM v. PENSION BENEFIT INFORMATION LLC, C.A. No. 4:24-00168 Northern District of California LEW v. MEDICAL EYE SERVICES, INC., ET AL., C.A. No. 4:24—-00532 Southern District of California BOSLEY, ET AL. v. CALIFORNIA PHYSICIANS' SERVICE, ET AL., C.A. No. 3:24—00229 Western District of New York TWOGUNS v. M&T BANK CORPORATION, C.A. No. 1:23-00892 WORMACK v. M&T BANK CORPORATION, C.A. No. 1:23-00912

Certified to be a true and correct copy of the original Robert M. Farrell, Clerk U.S. District Court District of Massachusetts / By: — fhe Date: 06/12/2024