This is the latest opinion in the ongoing litigation arising out of a massive data breach suffered by Hannaford Bros. grocery stores. In re Hannaford Bros. Privacy Litigation, __F. Supp. 2d __, Case No. 2:08-MD-1954-DBH, 2013 WL 1182733 (D. Me. Mar. 20, 2013).
The litigation arises out of a criminal attack on the payment card systems at the Hannaford Bros. grocery chain in late 2007 and 2008, which potentially affected over 4 million card numbers. The district court initially dismissed the action after the plaintiffs stipulated that none of the plaintiffs had incurred fraudulent charges that had not been reimbursed. The court certified a question to the Maine Supreme Judicial Court, which agreed that in the absence of physical harm, economic loss or identity theft, the time and effort spent to avoid or remediate reasonably foreseeable harm did not constitute cognizable injuries for which damages may be recovered under Maine law.[1]
On appeal, the U.S. Court of Appeals for the First Circuit reversed with regard to two of the claims, finding that the plaintiffs had alleged sufficient injury for their negligence and implied breach of contract claims because "fees for replacing cards and the cost of identity theft protection products were foreseeable costs to mitigate any harm arising from the data breach.”
Finding themselves back before the district court, plaintiffs moved to certify a class consisting of those “Hannaford customers who incurred out-of-pocket costs in mitigation efforts that they undertook in response to learning of the data intrusion.” The court addressed each of the factors provided in Federal Rule of Civil Procedure 23 and ultimately denied certification based only on a finding that plaintiffs’ failure to provide expert testimony supporting its theory of classwide damages meant that common issues would not predominate with regard to damages. The plaintiffs moved for reconsideration on April 4, 2013, further clarifying their theory of damages and asking for 60 days to obtain and tender to the court appropriate expert evidence.[2] Because data breach class actions rarely get to this point, a summary of the court’s review of each element follows.
Numerosity: First, the court found numerosity satisfied based on evidence from several banks indicating that thousands of affected Hannaford customers had purchased identity protection products or had been charged for replacement cards. The court was careful to note that this evidence was merely a correlation and did not demonstrate causation. While the court stated that it could not be confident that the Hannaford incident was the sole cause for all the noted expenses, this fact was sufficient to conclude that the number of Hannaford customers who incurred fees satisfied the numerosity requirement.
Hannaford argued that it was likely that only a tiny percentage of class members would file paperwork for reimbursement of the relatively small fees at issue, citing testimony from a former named plaintiff who stated that she did not know whether she had been reimbursed for the $5 card replacement fee and did not bother to check her statement because it was not worth her time to verify whether she had received the refund. The court expressed...
