In re Aceellion, Inc. Data Breach Litigation

4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 7 Case No. 21-cv-01155-EJD (SVK) IN RE ACEELLION, INC. DATA BREACH LITIGATION ORDER RE DISCOVERY DISPUTE AT 9 DKT. 400 10 Re: Dkt. No. 400

13 Before the Court is the Joint Submission of Plaintiffs and third-party Washington State Auditor’s Office (“WA SAO”) regarding the scope of two subpoenas served on WA SAO seeking documents and a deposition. Dkt. 400. The Parties have met and conferred and largely resolved the issues regarding production of documents, provided certain privacy concerns are addressed.

17 See Dkt. 400 at 1-3, 10. The Parties dispute the need for a deposition, which directly relates back to the document production. The Court has reviewed the Parties submissions and the relevant law, including Federal Rule of Civil Procedure 45 and determines that this matter may be resolved without oral argument. Civ. L.R. 7-1(b).

Plaintiffs seek two categories of documents: (i) files WA SAO collected during its investigation that it determined were on the FTA at the time of the Data Breach; and (ii) documents that WA SAO already produced in the related action Stone, et al. v. The Office of the Washington State Auditor, et al., No. 21-2-01439 (Sup. Ct. WA.) (the “Stone Action”).

It is the first category from which the dispute regarding the need for a deposition arises.

1 generate a spreadsheet identifying the specific categories of data disclosed by class member.” In re Accellion, Inc. Data Breach Litig., 2025 WL 2799102, at *15 (N.D. Cal. Sept. 30, 2025).

3 Plaintiffs state that they need the deposition, in part, to confirm “that a spreadsheet can be reliably created using the underlying records on the FTA and the time of the Data Breach.” Dkt. 400 at 5.

5 WA SAO explains the background as to its efforts to reconstruct the identification of files on the FTA at the time of the breach, along with the limitations on those reconstruction efforts. Id. at 7- 8. WA SAO also points to a declaration that it already provided in this action, that lays out its reconstruction efforts, and the limitations thereon, and therefore a deposition is unnecessary and burdensome, particularly in light of its status as a public agency and a third party to this action.

10 Id. WA SAO seeks cost-shifting, if a deposition is ordered.

11 Noting that this case is still in the discovery phase, considering the general parameters of relevance and proportionality of Rule 26, which also apply to subpoenas served pursuant to Rule 45, (see Fed. R. Civ. P. 45, 1970 Advisory Committee Notes (“[T]he scope of discovery through a subpoena is the same as that applicable to Rule 34 and the other discovery rules.”)), and keeping in mind the subpoenaed-party’s status as a third-party, the Court ORDERS as follows: 16 1. No later than January 28, 2026, WA SAO will produce both categories of documents: 17 (i) files WA SAO collected during its investigation that it determined were on the 18 FTA at the time of the Data Breach; and 19 (ii) documents that WA SAO already produced in the related action Stone, et al. v. The 20 Office of the Washington State Auditor, et al., No. 21-2-01439 (Sup. Ct. WA.) (the 21 “Stone Action”).

22 2. The production will be subject to the Protective Order in this action (Dkt. 189): (i) Plaintiffs will store this information on an air-gapped (i.e., not connected to the internet), encrypted hard drive maintained by Plaintiffs’ expert. (ii) Plaintiffs’ Counsel will not create a copy of the information or handle the information independently of their expert.

3. Before February 27, 2026, WA SAO shall make a corporate witness available to be ] Subpoena to Testify at Deposition, only to the extent such questions arise from or relate to 2 the document production. The Deposition shall be conducted remotely, be limited to 3 topics 11 and 12 (b)-(c) and be no more than 2.5 (two and one half) hours on the record.

4 The Parties are cautioned that WA SAO can only testify as to what information 1s in its 5 custody and control and the witness may or may not be able to confirm that “a spreadsheet 6 can be reliability created” from the produced data.

7 4. In light of WA SAO’s status as a third party and the declaration it previously provided, g cost shifting is appropriate in this case. Plaintiffs shall remburse WA SAO for costs and 9 fees, including attorneys’ fees, associated with the deposition not to exceed $5,000.

SO ORDERED.

D Dated: January 14, 2026

2B Seam yet Y 14 SUSAN VAN KEULEN 15 United States Magistrate Judge

Oo Z 18