In re SuperValu, Inc.

Full title: IN RE: SuperValu, Inc., Customer Data Security Breach Litigation This…

Court: UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MINNESOTA

Date published: Apr 20, 2016

Court File No. 14-MD-2586 ADM/TNL (D. Minn. Apr. 20, 2016)

Opinion

Court File No. 14-MD-2586 ADM/TNL

04-20-2016

IN RE: SuperValu, Inc., Customer Data Security Breach Litigation This Document Relates to: All Actions

Ben Barnow, Esq., Barnow and Associates, P.C., Chicago, IL; Edwin J. Kilpela, Jr., Esq., Carlson Lynch Sweet & Kilpela, LLP, Pittsburgh, PA; Rhett A. McSweeney, Esq., and David Langevin, Esq., McSweeney/Langevin, LLC, Minneapolis, MN; Karen Hanson Riebel, Esq., Lockridge Grindal Nauen P.L.L.P., Minneapolis, MN; Richard L. Coffman, Esq., The Coffman Law Firm, Beaumont, TX; Aron D. Robinson, Esq., Law Office of Aron D. Robinson, Chicago, IL; John J. Dricoll, Esq., and Christoper J. Quinn, Esq., The Driscoll Firm, P.C., St. Louis, MO; and John S. Steward, Esq., Steward Law Firm, LLC, St. Louis, MO, on behalf of Plaintiffs. Harvey J. Wolkoff, Esq., and Kathryn E. Wilhelm, Esq., Ropes & Gray LLP, Boston, MA; Stephen P. Safranski, Esq., Robins Kaplan LLP, Minneapolis, MN, on behalf of Defendant SuperValu, Inc. John L. Landolfi, Esq., and Christopher L. Ingram, Esq., Vorys, Sater, Seymour and Pease LLP, Columbus, OH; and Marc A. Al, Esq., Stoel Rives LLP, Minneapolis, MN, on behalf of Defendants AB Acquisition, LLC and New Albertson's Inc.

ANN D. MONTGOMERY U.S. DISTRICT JUDGE

MEMORANDUM OPINION AND ORDER

Ben Barnow, Esq., Barnow and Associates, P.C., Chicago, IL; Edwin J. Kilpela, Jr., Esq., Carlson Lynch Sweet & Kilpela, LLP, Pittsburgh, PA; Rhett A. McSweeney, Esq., and David Langevin, Esq., McSweeney/Langevin, LLC, Minneapolis, MN; Karen Hanson Riebel, Esq., Lockridge Grindal Nauen P.L.L.P., Minneapolis, MN; Richard L. Coffman, Esq., The Coffman Law Firm, Beaumont, TX; Aron D. Robinson, Esq., Law Office of Aron D. Robinson, Chicago, IL; John J. Dricoll, Esq., and Christoper J. Quinn, Esq., The Driscoll Firm, P.C., St. Louis, MO; and John S. Steward, Esq., Steward Law Firm, LLC, St. Louis, MO, on behalf of Plaintiffs. Harvey J. Wolkoff, Esq., and Kathryn E. Wilhelm, Esq., Ropes & Gray LLP, Boston, MA; Stephen P. Safranski, Esq., Robins Kaplan LLP, Minneapolis, MN, on behalf of Defendant SuperValu, Inc. John L. Landolfi, Esq., and Christopher L. Ingram, Esq., Vorys, Sater, Seymour and Pease LLP, Columbus, OH; and Marc A. Al, Esq., Stoel Rives LLP, Minneapolis, MN, on behalf of Defendants AB Acquisition, LLC and New Albertson's Inc.

I. INTRODUCTION

The above-entitled matter is before the undersigned United States District Judge on Plaintiffs' Motion to Alter or Amend Judgment and for Other Relief [Docket No. 54] brought pursuant to Federal Rule of Civil Procedure 59(e). For the reasons stated herein, Plaintiffs' Motion is denied.

II. BACKGROUND

In this multidistrict litigation case, sixteen named plaintiffs ("Plaintiffs") alleged they were harmed as the result of hackers breaching the payment-processing network for payment card transactions at more than 1,000 retail grocery stores owned and operated by Defendants SuperValu, Inc. ("SuperValu"), AB Acquisition, LLC ("AB Acquisition"), and New Albertson's Inc.'s ("Albertson's") (collectively, "Defendants"). See Consolidated Am. Class Action Compl. ("Amended Complaint") [Docket No. 28] ¶¶ 16-45. The hackers gained access to and installed malicious software on the payment-processing network in June 2014 and again in late July or early September 2014. Id. ¶¶ 4-6.

Plaintiffs alleged that the malicious software released and disclosed the Personal Identifying Information ("PII") of Plaintiffs and Class Members who used their payment cards for purchases at the affected stores. Id. ¶ 36. The PII included cardholder names, account numbers, expiration dates, and PINs. Id. ¶¶ 1, 42. The Amended Complaint stated claims for negligence, negligence per se, breach of implied contract, unjust enrichment, and violations of state consumer protection and data breach notification laws. Id. ¶¶ 13, 96-159. Plaintiffs asserted their claims as class actions. Id. ¶¶ 83-95.

Although customer data at over 1,000 of Defendants' stores was accessed, the only alleged misuse of any Plaintiffs' PII following the data breach was a single unauthorized charge on one Plaintiff's credit card. Id. ¶¶ 4-6, 31. The Amended Complaint did not specify the amount or date of the fraudulent charge and did not allege that the charge was unreimbursed or that the Plaintiff incurred bank fees or other monetary losses related to the charge. See id. ¶ 31.

On January 7, 2016, the Court dismissed the Amended Complaint without prejudice under Rule 12(b)(1) based on Plaintiffs' failure to allege facts sufficient to establish Article III standing. See Mem. Op. & Order [Docket No. 52] ("Dismissal Order"). The Court concluded that Plaintiffs had not plausibly alleged a cognizable injury because they failed to allege misuse of their PII or other harm that was traceable to the data breach. Dismissal Order at 7-16. Additionally, Plaintiffs did not allege facts that plausibly suggested a substantial risk of future harm. Id. at 10-11. Because the Amended Complaint alleged only a singular incident in which any Plaintiff's PII had been misused in the year and a half since the data breach had occurred, any future harm was speculative and depended upon whether the hackers who accessed Defendants' network actually succeeded in capturing the information, whether the hackers would attempt to use the information, and whether those attempts would be successful. Id. The Court also rejected Plaintiffs' additional theories of standing, including Plaintiffs' argument of standing to recover the lost expectation of a bargained-for benefit. See id. at 16. Plaintiffs' failed to sufficiently allege Article III standing. Thus, the Amended Complaint was dismissed without prejudice and final judgment was entered. Id. at 17; Judgment [Docket No. 53].

Plaintiffs now bring this post-judgment motion under Rule 59(e), seeking to vacate the judgment and dismissal of the Amended Complaint. Plaintiffs argue: (1) the Court erred by not drawing the inference from Plaintiffs' factual allegations that their PII was stolen by the hackers during the data breach and used to commit fraud; (2) the Court overlooked Plaintiffs' benefit of the bargain theory of standing; and (3) newly discovered evidence supports standing. Alternatively, Plaintiffs seek leave to once again amend the Complaint.

III. DISCUSSION

Rule 59(e) motions "serve the limited function of correcting manifest errors of law or fact or to present newly discovered evidence. Such motions cannot be used to introduce new evidence, tender new legal theories, or raise arguments which could have been offered or raised prior to entry of judgment." United States v. Metro. St. Louis Sewer Dist., 440 F.3d 930, 933 (8th Cir. 2006) (internal quotations and citations omitted). A motion under Rule 59 "is not intended to routinely give litigants a second bite at the apple, but to afford an opportunity for relief in extraordinary circumstances." Dale & Selby Superette & Deli v. U.S. Dep't Ag., 838 F. Supp. 1346, 1348 (D. Minn. 1993).

A. No Manifest Error of Fact or Law

Plaintiffs first argue that the Court erred by not considering the Amended Complaint's allegations as true and "by not drawing the reasonable inference from Plaintiffs' factual allegations that the PII was taken by thieves during the Data Breach and used to commit fraud." Pls.' Mot. Alter Am. J. at 4. The Court did accept all factual allegations in the Amended Complaint as true. The allegations identified only one instance in which one Plaintiff's data had been misused in the year and a half following the breach. This single incident was not sufficient to plausibly allege that future harm from data misuse was "certainly pending" or that there was a "substantial risk that the harm [would] occur." Dismissal Order at 11 (citing Clapper v. Amnesty Int'l USA, 133 S.Ct. 1138, 1147, 1150 n.5 (2013)). Plaintiffs' allegations that third-party hackers were able to steal their PII were conclusory and alleged "[o]n information and belief." See, e.g., Am. Compl. ¶¶ 8-9. The Court is not required to accept conclusory allegations as true or engage in speculation as to what third-parties may or may not have accomplished as a result of the data breach. Plaintiffs have supplemented their reconsideration motion with a letter alerting the Court to a recent Seventh Circuit decision on standing in a data breach case. See Letter, Apr. 18, 2016 [Docket No. 65] (citing Lewert v. P.F. Chang's China Bistro, Inc., No. 14-3700, 2016 WL 1459226 (7th Cir. Apr. 14, 2016)). However, Lewert is not binding authority on this Court. The Court is unpersuaded by the rationale in Lewert to change its conclusion that Plaintiffs failed to meet their burden of establishing an injury in fact for purposes of Article III standing.

Plaintiffs also argue that the Court improperly accepted as true the statements made by Defendants in their press releases that Defendants had not determined whether cardholder data had in fact been stolen. The Court did not accept those statements as true. The purpose in referencing the press releases was to show that, to the extent Plaintiffs were relying on the releases as a factual basis for their allegations that customer data had been stolen, the press releases did not support that contention. See Dismissal Order at 10 n.2. The Court did not rely on the press releases in concluding that the Amended Complaint failed to plausibly allege an injury in fact. Rather, this conclusion was "[b]ased on the absence of any other allegations that Plaintiffs' PII ha[d] been misused." Dismissal Order at 10.

Plaintiffs further argue the Court "overlooked" their benefit of the bargain theory of standing. Mot. Alter Am. J. at 12 (citing Pls.' Opp'n Br. [Docket No. 40] at 16). Not so. After consideration was given to the arguments and non-binding caselaw presented in Plaintiffs' opposition brief, the Court concluded that Plaintiffs failed to "allege facts showing that the price they paid for goods included an amount that both parties understood would be allocated toward protecting customer data." Dismissal Order 16 (emphasis added). Plaintiffs' effort to reargue its benefit of the bargain theory is an impermissible attempt to take a "second bite at the apple." Dale & Selby Superette & Deli, 838 F. Supp. at 1348 (D. Minn. 1993).

B. Newly Discovered Evidence Standard Not Met

Plaintiffs also premise their motion on "new evidence" that purportedly indicates "that the hackers obtained PII and used it to commit fraud." Pls.' Mem. Supp. Mot. Recon. at 9. The evidence consists of three declarations (one accompanying Plaintiffs' reconsideration motion and two accompanying Plaintiffs' reply brief) by officers of financial institutions. See Pls.' Mem Supp. Mot. Recon. Ex. 3 ("Anderson Decl."); Pls.' Index [Docket No. 61] Ex. 1 ("Malinowski Decl."), Ex. 2 ("Williams Decl."). The officers each aver that some payment cards issued by their respective institution incurred fraudulent charges following the data breach. See id.

To prevail on a Rule 59(e) motion based on newly discovered evidence, a movant must show: "(1) the evidence was discovered after final judgment; (2) the movant exercised due diligence to discover the evidence prior to final judgment; (3) the evidence is material and not cumulative; and (4) considering the new evidence 'would probably produce a different result.'" In re Medtronic Inc., No. 07-4564, 2009 WL 1536108, at *2 (D. Minn. May 29, 2009) (quoting Metro. St. Louis, 440 F.3d at 933).

Plaintiffs have not satisfied the second factor of this test—that the evidence could not have been discovered earlier with due diligence. Plaintiffs argue that they made reasonable efforts to obtain this information from Defendants, but that Defendants delayed responding to their discovery requests and ultimately produced inadequate responses. However, Plaintiffs did not serve their first discovery requests until October 7, 2015—nearly two weeks after they filed their opposition to Defendants' motion to dismiss. See Pls.' Mem. Supp. Mot. Recon. at Ex. 1. While this alone establishes Plaintiffs' lack of diligence, Plaintiffs were also aware as of December 29, 2015 (nine days before the entry of judgment) that the documents produced by Defendants did not include documents relating to the number of payment cards affected by the breach or to known instances of payment card misuse. See Pls.' Mem. Supp. Mot. Recon. at 7. Plaintiffs do not explain why they waited until after the entry of final judgment to attempt to obtain this discovery from other sources.

Plaintiffs also suggest that their discovery of the new evidence was hampered by limitations placed on discovery in the early stages of this case. See id. at 5 (citing Pretrial Order No. 2 [Docket No. 15]). However, the Court expressly ordered that "Plaintiffs shall be entitled to serve discovery requests upon Defendants at any time after filing their Consolidated Class Action Complaint seeking information on . . . when the data breach occurred, the number of cards affected by the data breach and whether data was taken or used." Pretrial Order No. 2 ¶ 3. Thus, no limitations were placed on this category of discovery.

Plaintiffs also fail to satisfy the fourth factor of the newly discovered evidence test—that consideration of the new evidence would probably produce a different result. None of the tardily submitted declarations allege that the compromised cards belonged to a named Plaintiff. Nor do the declarations state that any cardholder incurred unreimbursed fraudulent charges or other bank charges. Indeed, one declaration admits that the fraudulent charges on cards issued by that financial institution were all "absorbed" by the institution, meaning that no cardholder suffered any injury. Anderson Decl. ¶ 6. Thus, the declarations do not establish that any named Plaintiff or potential class member suffered actual harm or faces a substantial risk of imminent future harm from the potential misuse of their PII.

C. No Post-Judgment Leave to Amend

Plaintiffs alternatively request leave to file a Second Amended Complaint. "Although a pretrial motion for leave to amend one's complaint is to be liberally granted, different considerations apply to motions filed after dismissal." Humphreys v. Roche Biomedical Labs., Inc., 990 F.2d 1078, 1082 (8th Cir. 1993). "[I]nterests of finality dictate that leave to amend should be less freely available after a final order has been entered." United States ex rel. Roop v. Hpyoguard USA, Inc., 559 F.3d 818, 823 (8th Cir. 2009). Post judgment leave to amend will only be granted "if it is consistent with the stringent standards governing the grant of Rule 59(e) and Rule 60(b) relief." United States v. Mask of Ka-Nefer-Nefer, 752 F.3d 737, 743 (8th Cir. 2014) (citing Dorn v. State Bank of Stella, 767 F.2d 442, 443-44 (8th Cir. 1985)).

Plaintiffs have failed to satisfy the stringent standards governing Rule 59(e) relief. Therefore, the request for leave to file a Second Amended Complaint is denied.¹

1 The request for leave to amend also fails because Plaintiffs have not complied with the Court's Local Rules. Under Local Rule 15.1(b), a motion to amend a pleading must include "a copy of the proposed amended pleading" and "a version of the proposed amended pleading that shows . . . how the proposed amended pleading differs from the operative pleading." L.R. 15.1(b). No proposed Second Amended Complaint was submitted with this Motion. Thus, leave to amend is properly denied. See Ellis v. City of Minneapolis, 518 F. App'x 502, 504-05 (8th Cir. 2013) ("[A] district court does not abuse its discretion in denying leave to amend when the party seeking leave has failed to follow procedural rules or failed to attach the proposed complaint."). --------

IV. CONCLUSION

Based upon the foregoing, and all the files, records, and proceedings herein, IT IS HEREBY ORDERED that Plaintiffs' Motion to Alter or Amend Judgment and for Other Relief [Docket No. 54] is DENIED.

BY THE COURT:

s/Ann D. Montgomery

ANN D. MONTGOMERY

U.S. DISTRICT JUDGE Dated: April 20, 2016.