Accellion Faces Consolidated Litigation Over Kroger Data Breach

File-sharing company Accellion Inc. will face consolidated litigation in California of 15 class complaints over the Kroger Co. 2020 data breach, after a federal judge ruled that all of the privacy claims filed are similar enough to handle in one proceeding.

The California company, now known as Kiteworks, was slapped with numerous lawsuits in 2021 after hackers in 2020 broke into Kroger’s files, which used Accellion’s file-transfer tool, and allegedly exposed customer and employee sensitive health data.

On Monday, Judge Edward J. Davila of the U.S. District Court for the Northern District of California granted plaintiff Grace Beyer’s motion to consolidate, ruling that all of the cases filed against Accellion have substantially similar factual and legal issues.

The complaints all contain claims for negligence, invasion of privacy, and violations of consumer protection and data privacy laws, Davila said. They also are all still in the procedural stages because Accellion hasn’t filed any responses.

“There appears to be no basis to find that consolidation would cause inconvenience, delay, or expense, especially since the parties appear to agree with the consolidation request,” Davila wrote.

Although nine of the cases list Accellion as the only defendant, and six list Accellion in addition to either Kroger, Flagstar Bank, or Health Net, Davila rejected some plaintiffs’ concerns that those six cases contain unique questions.

“The factual and legal issues as they pertain to Accellion are the same in every case,” Davila wrote.

Over a dozen other lawsuits against Accellion stemming from the data breach are pending in various district courts.

Plaintiffs are represented by HammondLaw PC, Susman Godfrey LLP, Arnold Law Firm, Blood Hurst & O’Reardon LLP, and Cozen O’Connor PC. Accellion Inc. is represented by Latham & Watkins LLP.

The case is Brown v. Accellion Inc., N.D. Cal., No. 5:21-cv-01155, 3/14/22.