UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

CHANTAL ATTIAS, et al.,

Plaintiffs,

v. Case No. 15-cv-882 (CRC)

CAREFIRST, INC., et al.,

Defendants.

OPINION AND ORDER

In April 2014, hackers gained unauthorized access to the internal computer systems of

health insurance company CareFirst, Inc. Plaintiffs, a group of CareFirst’s customers whose

information was exposed in the breach, filed this class action lawsuit alleging claims for breach

of contract and violations of the consumer protection laws of Maryland and Virginia. Post-

summary judgment, only their breach-of-contract claim remains. And in its most recent opinion,

the Court certified a contract class whose recovery is likely limited to nominal damages because,

as the Court held in another prior opinion, mitigation expenses associated with a data breach are

not considered actual damages under D.C. law.

Plaintiffs now ask the Court to permit them to pursue an interlocutory appeal to clarify

whether mitigation expenses are actual damages for their breach-of-contract claim. In the

alternative, Plaintiffs request reconsideration of the Court’s holding that they may not recover

those expenses.

For the reasons detailed in this opinion, the Court will deny Plaintiffs’ request for

immediate appeal under

(b). The Court will also deny Plaintiffs’ motion for

reconsideration. I. Background

The Court presumes familiarity with its six prior opinions describing the procedural and

legal background of this case, so it provides only a summary of the relevant details here. See

Attias v. CareFirst, Inc. (Attias I),

(D.D.C. 2016); Attias v. CareFirst, Inc.

(Attias II),

(D.D.C. 2019); Attias v. CareFirst, Inc. (Attias III),

(D.D.C. 2021); Attias v. CareFirst, Inc. (Attias IV),

(D.D.C. 2023); Attias v.

CareFirst, Inc. (Attias V), No. 15-cv-882 (CRC),

(D.D.C. Sept. 13, 2023);

Attias v. CareFirst, Inc. (Attias VI),

(D.D.C. 2024).

Plaintiffs are District of Columbia, Maryland, and Virginia residents whose health

insurance was provided by Defendant CareFirst, Inc. during the time relevant to this lawsuit.

Attias VI, 346 F.R.D. at 3. In April 2014, hackers infiltrated CareFirst’s computer system

through an email-based spear phishing campaign and gained access to the following information

from individual CareFirst customers: first and last (and sometimes middle) names, subscriber ID

numbers, dates of birth, email addresses, and usernames used to log into CareFirst’s online

member portal. Id. CareFirst did not learn the extent of the data breach until May 2015. Id. At

that point, CareFirst sent letters to the affected customers notifying them of the breach and

offering them two years of free credit monitoring and identity-theft protection through a third-

party service. Id.

In June 2015, Plaintiffs brought this class action lawsuit, originally consisting of eleven

claims including breach of contract, negligence, violation of D.C., Maryland, and Virginia

consumer protection laws, violation of the D.C. Data Breach Notification Act, negligence per se,

unjust enrichment, breach of duty of confidentiality, fraud, and constructive fraud. Attias V,

2

, at *2. The Court initially dismissed the case for lack of standing, but the

D.C. Circuit reversed in Attias v. Carefirst, Inc.,

(D.C. Cir. 2017).

On remand, the Court found that only Plaintiffs Curt and Connie Tringler had adequately

alleged actual damages as required for most of Plaintiffs’ claims. Attias II, 365 F. Supp. 3d at 5–

6. So, the Court dismissed for failure to state a claim all causes of action but for the breach of

contract and Maryland consumer protection claims brought by the Tringlers. Id. at 6. As

relevant here, the Court held that under the D.C. Court of Appeals’ decision in Randolph v. ING

Life Ins. & Annuity Co.,

(D.C. 2009), “time and money spent protecting

against future identity theft cannot constitute damage in their own right” for any of Plaintiffs’

claims. Attias II,

.

On Plaintiffs’ motion for reconsideration, the Court reinstated the breach-of-contract

claim as to all Plaintiffs. Attias III, 518 F. Supp. 3d at 51–57. In doing so, the Court observed

that although some D.C. Court of Appeals authority suggests that damages are required to state a

contract claim, other authority holds that “‘[e]ven where monetary damages cannot be proved’

the prevailing party may be entitled to nominal damages, specific performance, or declaratory

relief.”

at 52 (quoting Wright v. Allen,

, 753 & n.3 (D.C. 2013)). The Court also

rejected Plaintiffs’ argument that intervening D.C. Circuit precedent In re: U.S. Office of

Personnel Management Data Security Breach Litigation,

(D.C. Cir. 2019) (“OPM”),

had displaced its prior holding that mitigation costs are not actual damages under D.C. law.

at 54–55. To the contrary, OPM could not overturn D.C. Court of Appeals’ precedent holding

that ““actual damages’ exclude a data-breach plaintiff’s mitigation costs absent any actual

misuse of the plaintiff’s data.’”

. The Court also revived all Plaintiffs’ Maryland and

Virginia statutory claims under those states’ consumer protection laws.

at 55–57.

3 Next, Plaintiffs moved to certify three classes under Federal Rule of Civil Procedure 23

corresponding to their breach-of-contract claims, Maryland statutory claims, and Virginia

statutory claims. See Attias IV, 344 F.R.D. at 43. The Court denied the motion for class

certification because it had “serious concerns about whether common issues [would]

predominate over individual inquires in this case . . . in light of the Supreme Court’s recent

decision in TransUnion LLC v. Ramirez,

(2021).” Id. at 42. The Court then moved

ahead with Defendants’ summary judgment motion. In September 2023, the Court granted

summary judgment to CareFirst on Plaintiffs’ two statutory claims. Attias V,

, at *15–21.

Plaintiffs’ breach-of-contract claim, however, survived summary judgment. “Although

the evidence on which Plaintiffs rely is thin,” the Court found that “a reasonable jury could

conclude that CareFirst breached an implied promise to take reasonable steps to safeguard their

personal information.”

; see

at *4–15. In so holding, the Court recognized that

“recovery is almost certainly limited to nominal damages.”

. But the Court reiterated

its holding in Attias III that, under D.C. law, Plaintiffs are entitled to pursue their contract claim

to recover nominal damages alone.

.

In its most recent opinion, the Court took up Plaintiffs’ renewed motion for class

certification. The Court first held that the alleged breach of contract supplied all class members

with Article III standing because “the breach of a contractual obligation to perform some duty

has always been understood as a concrete injury” enabling parties to bring suit “regardless of

whether they have suffered actual damages as a result.” Attias VI, 346 F.R.D. at 9–10.

The Court then considered whether to certify the contract class “when nominal damages

are likely the only form of recompense on the table.”

. The Court observed that

4 “[c]ertification of classes for nominal damages is routine in the constitutional-tort sphere,”

adding that the limitation to nominal damages “will streamline proceedings by dispensing with

the need for individualized damage calculations.”

at 11–12. It further noted that notification

protocols, opt-out provisions, and the creation of subclasses were available if any class member

wished to pursue actual damages other than mitigation expenses.

. Having assured itself

that the nominal-damages limitation was no barrier, the Court certified the contract class.

at

12–13.

Now, after explicitly asking the Court to certify a contract class whose recovery is limited

to nominal damages, Plaintiffs request the Court to certify for immediate appeal the question of

whether mitigation expenses associated with the breach also may be recovered. Pl.’s Mot.

Certify Interlocutory Appeal (“MCIA”). In the alternative, they ask the Court, for the second

time, to reconsider its 2019 holding that mitigation costs are not recoverable in a breach-of-

contract action under D.C. law.

at 13–14. Plaintiffs have also filed a Rule 23(f) motion in the

D.C. Circuit, which the Circuit has held in abeyance pending this Court’s resolution of Plaintiffs’

present motions before it.

For the reasons explained in this opinion, the Court declines to permit Plaintiffs to pursue

an interlocutory appeal and will also deny Plaintiffs’ motion for reconsideration.

II. Legal Standards

The Court may permit a party to pursue an interlocutory appeal if, in its discretion, it

determines that a non-final order “[1] involves a controlling question of law [2] as to which there

is substantial ground for difference of opinion and that [3] an immediate appeal from the order

may materially advance the ultimate termination of the litigation.”

(b). “The

party seeking interlocutory review has the burden of persuading the Court that the

5 ‘circumstances justify a departure from the basic policy of postponing appellate review until

after the entry of a final judgment.’” APCC Servs., Inc. v. Sprint Commc’ns Co.,

(D.D.C. 2003) (quoting In re Vitamins Antitrust Litig., No. 99–197 (TFH),

, at *1 (D.D.C. Nov. 22, 2000)). Even after the district court “confirm[s] that the

moving party has satisfied all of the elements of [S]ection 1292(b) . . . , it must also conclude

that certification is appropriate as a discretionary matter.” Azima v. RAK Inv. Auth.,

(D.D.C. 2018). Interlocutory appeals are “infrequently allowed,” for the movant

must demonstrate “exceptional circumstances” justifying piecemeal appeal. Graham v.

Mukasey,

(D.D.C. 2009).

Plaintiffs have moved, in the alternative, for reconsideration of the Court’s prior holding

that mitigation damages are unavailable to them. Pl.’s MCIA 13–15. Under Federal Rule of

Civil Procedure 54(b), any order or decision that is not a final judgment “may be revised at any

time before the entry of a judgment adjudicating all the claims and all the parties’ rights and

liabilities.” Courts grant motions for reconsideration of interlocutory orders only “as justice

requires.” Shea v. Clinton,

(D.D.C. 2012) (quoting Hoffman v. Dist. of

Columbia,

(D.D.C. 2010)) (internal quotation marks omitted). While

courts enjoy significant discretion under Rule 54(b), “in order to promote finality, predictability

and economy of judicial resources,” they generally should not revisit prior interlocutory

decisions “in the absence of extraordinary circumstances such as where the initial decision was

clearly erroneous and would work a manifest injustice.”

at 157–58 (quoting Pueschel v. Nat’l

Air Traffic Controllers’ Ass’n,

(D.D.C. 2009)) (internal quotation marks

omitted). In deciding whether “justice requires” reversal of its prior interlocutory order, a court

considers whether it

6 [1] “patently misunderstood a party,” [2] “has made a decision outside the adversarial issues presented to the Court by the parties,” [3] “has made an error not of reasoning but of apprehension,” or [4] whether “a controlling or significant change in the law or facts [has occurred] since the submission of the issue to the Court.”

United States v. Slough,

(D.D.C. 2014) (alteration in original) (quoting

Singh v. George Washington Univ.,

(D.D.C. 2005)). A motion for

reconsideration should therefore be denied “when it merely asserts ‘arguments for

reconsideration [that] the court has already rejected on the merits.’” BEG Invs., LLC v. Alberti,

(D.D.C. 2015) (alteration in original) (quoting McLaughlin v. Holder,

(D.D.C. 2012)).

III. Analysis

A. Interlocutory Appeal

The Court begins by declining to certify the question of whether data-breach mitigation

costs are recoverable as actual damages under D.C. law. Plaintiffs have satisfied only two of the

three elements required under Section 1292(b). Even if Plaintiffs had satisfied all three elements,

the Court would exercise its discretion to decline certification.

As an initial matter, CareFirst suggests that Plaintiffs have not identified which order they

would like the Court to certify for interlocutory appeal. Def.’s Opp’n 6–7. Although Plaintiffs’

briefing is not a model of clarity, they request certification of the question “whether future

mitigation expenses and time lost . . . are actual damages that are cognizable in a breach of

contract action in the District of Columbia.” Pl.’s MCIA 15. In their reply brief, Plaintiffs

suggest they are requesting certification of “every opinion this Court has issued” indicating that

the class’s recovery is limited to nominal damages. Pl.’s Reply 1. From this, the Court

7 concludes that Plaintiffs request certification of the class certification order, which relies on the

Court’s prior orders to hold that only nominal damages are available to the class.

With that, the Court turns to the elements of Section 1292(b). Plaintiffs have satisfied the

first element: The question they seek to certify is a controlling question of law. “A question of

law is an abstract legal issue or what might be called one of ‘pure’ law, matters the court of

appeals can decide quickly and cleanly without having to study the record.” United States v.

Honeywell Int’l Inc., No. 08-cv-0961 (PLF),

, at *3 (D.D.C. June 18, 2021)

(citation and quotation marks omitted). Whether the rule set forth in Randolph v. ING Life Ins.

& Annuity Co.,

(D.C. 2009), precludes recovery of Plaintiffs’ mitigation

expenses presents a question of pure law that does not depend on facts specific to the record.

That the Court first rendered the holding at issue to resolve CareFirst’s motion to dismiss

confirms the point. Attias II, 365 F. Supp. 3d at 14–15.

And the question is controlling. It “would require reversal if decided incorrectly.”

Honeywell,

, at *5 (citation omitted). Resolving whether mitigation expenses

are available as damages would “significantly impact the action,”

at *3 (quoting Air Transp.

Ass’n v. U.S. Dep’t of Agric.,

(D.D.C. 2018)), because, as the Court

has observed previously, Plaintiffs are otherwise almost certainly limited to recovering nominal

damages. Attias VI, 346 F.R.D. at 11. Indeed, several judges within this district have treated

issues relating to the measure of damages as controlling for certification purposes. See

Honeywell,

, at *5 (listing cases).

Second, the Court considers whether there is a “substantial ground for difference of

opinion” on the disputed legal question.

(b). In doing so, the Court emphasizes

that the disputed question here is whether data-breach mitigation expenses are recoverable in a

8 breach-of-contract action under D.C. law, not under the law of any other jurisdiction. And as the

Court has explained in several prior opinions, the D.C. Court of Appeals has squarely held that

absent actual misuse of the plaintiff’s data, mitigation expenses cannot be recovered as actual

damages. Randolph v. ING Life Ins. & Annuity Co.,

(D.C. 2009). Those

costs are “an injury that is ‘not the result of any present injury, but rather the [result of] the

anticipation of future injury that has not materialized.’”

(citation omitted) (alteration in

original). So, such costs are not compensable.

To be sure, some courts in other jurisdictions have moved toward permitting the recovery

of mitigation expenses in data-breach cases. See, e.g., Johnson v. Nice Pak Prods., Inc., No. 23-

CV-01734-JMS-CSW,

, at *4 (S.D. Ind. June 5, 2024) (holding that time and

effort spent monitoring accounts after a data breach are compensable damages); Stasi v.

Inmediata Health Grp. Corp.,

, 918 (S.D. Cal. 2020) (“In data breach cases

involving negligence claims, district courts have found it sufficient to allege out-of-pocket

expenses in purchasing identity theft protection services to show damages.”). But no out-of-state

precedent can displace Randolph’s holding. Nor can, as the Court has said before, the D.C.

Circuit’s holding in OPM. The Court reiterates: “Randolph remains binding D.C. law and

continues to govern plaintiffs’ D.C. law claims.” Attias III, 518 F. Supp. 3d at 55.

Plaintiffs’ most persuasive argument is that Randolph’s rule for negligence and breach-

of-fiduciary-duty claims should not extend to breach-of-contract claims. Pl.’s MCIA 10–11. At

first glance, Plaintiffs’ argument has some force. Randolph held that money spent on “credit

monitoring or other security measures” is “not the result of any present injury, but rather the

[result of] the anticipation of future injury that has not materialized.”

(citation

omitted) (alteration in original). Thus, mitigation expenses alone could not satisfy the injury

9 element of the plaintiffs’ negligence or breach-of-fiduciary duty claims. Here, in contrast, the

Court has already held that “the breach of a contractual obligation to perform some duty has

always been understood as a concrete injury that enables the aggrieved contracting party to

proceed in an American court.” Attias VI, 346 F.R.D. at 9.

Randolph holds that mitigation expenses alone may not create an injury when one does

not otherwise exist. But the question here is whether a plaintiff who has already demonstrated an

injury sufficient to seek nominal contract damages may also recover reasonable mitigation

expenses. The Court concludes that Randolph dictates the same result regardless of whether the

plaintiff relies entirely on mitigation expenses to establish his injury. Randolph made clear that

mitigation expenses are not a harm attributable to the initial data breach. They stem only from

the risk of future harm. By that logic, credit monitoring does not “compensate a party for the

loss incurred by the other’s breach,” as all contract damages are intended to do. See Bay Gen.

Indus., Inc. v. Johnson,

, 1057 n.19 (D.C. 1980). Instead, mitigation services seek

to prevent loss before it happens. Until that harm is realized, it cannot be compensated.

None of this is to say that Randolph’s holding is unassailable. Some courts have reached

the same conclusion. See, e.g., Collins v. Athens Orthopedic Clinic,

, 19 (2018),

judgment rev’d in part,

(2019); Doe v. Henry Ford Health Sys.,

,

921–22 (Mich. App. 2014). Others—a majority perhaps—have come out the other way. See,

e.g., Moore v. Centrelake Med. Grp., Inc.,

, 560 (2022); In re Anthem, Inc.

Data Breach Litig., No. 15-MD-02617-LHK,

, at *26 (N.D. Cal. May 27,

2016). Were it writing on a blank slate and having (just barely) green lit Plaintiffs’ implied

breach claim, this Court might have landed in the latter camp. The question before the Court,

however, is not whether there’s a substantial ground for a difference of opinion over the wisdom

10 of Randolph’s rule. It is whether there’s a substantial ground for a difference of opinion on

whether the D.C. Court of Appeals would extend Randolph to a breach of contract claim. The

Court has already answered that question in the negative. See Attias II,

(“there is no reason to believe the D.C. Court of Appeals would treat plaintiffs’ other D.C. law

claims any differently”). And it does so again now. Accordingly, the Court finds no substantial

ground for difference of opinion.

Third, certification would not “materially advance the ultimate termination of the

litigation.”

(b). This long-running case dates to 2016, and “[a]ny appeal will

almost certainly prolong . . . the resolution of the litigation.” Arias v. DynCorp,

(D.D.C. 2012). And as the Court has observed elsewhere, the third factor “requires a

showing that the decision below might well be reversed on appeal, as evidenced by ‘substantial

ground for difference of opinion’ on the disputed legal question.” Kennedy v. D.C.,

(D.D.C. 2015) ) (Cooper, J.). As just explained, Plaintiffs have not made that showing.

Moreover, a reversal would create problems of its own by implicating the same predominance

concerns the Court identified previously and require the parties to return to the drawing board on

class certification. See Attias IV, 344 F.R.D. at 53–54.

Even if Plaintiffs had satisfied all three elements, the Court would exercise its discretion

to decline certification. The Court first held that Plaintiffs could not recover mitigation expenses

under Randolph in 2019, over five years ago. Attias II, 365 F. Supp. 3d at 13–16. Plaintiffs

moved for reconsideration, making many of the same arguments made here. Compare Pl.’s

Memo., ECF No. 66, at 2–4, 6–8, with Pl.’s MCIA 8–9. The Court rejected those arguments and

reaffirmed its holding that mitigation damages are not recoverable under D.C. law. Attias III,

518 F. Supp. 3d at 52–55.

11 Then, in opposing CareFirst’s motion for summary judgment, Plaintiffs once again

attempted to distinguish Randolph and argued that mitigation expenses constitute actual

damages. Pl.’s Opp’n, ECF 98, at 24. Once more, the Court reiterated its holding that mitigation

expenses do not constitute actual damages under D.C. law. Attias V,

, at *15.

The Court then explicitly asked Plaintiffs at the class certification hearing following summary

judgment if they were “still pursuing class certification even if the Court holds that . . . they

would only be entitled to nominal damages[.]” Opp’n, Ex. A (Jan. 30, 2024 Hrg. Transcript), at

7:4-7. Plaintiffs responded: “We are pursuing the class.”

. Relying on that

representation, the Court took up their renewed certification motion and ultimately certified a

contract class for which “nominal damages are likely the only form of recompense.” Attias VI,

346 F.R.D. at 11. Plaintiffs may not wait until after class certification to seek interlocutory

appeal on an issue that has been the law of the case since 2019 and has been reaffirmed by the

Court in three subsequent opinions.

This exercise of the Court’s discretion is informed by its view of the merits of Plaintiffs’

claim. See Attias V,

, at *1 (observing that “the evidence on which Plaintiffs

rely is thin”). The Court finds relevant, as well, the relatively minimal mitigation measures (on

top of the two years of free credit monitoring and identity-theft protection CareFirst gave to all

affected customers) that would have been appropriate under the circumstances. No Social

Security or credit card numbers were leaked in the breach. Attias IV, 344 F.R.D. at 54. Thus, as

the Court observed before, it is not clear that most standard mitigation measures like credit

monitoring or freezing “would relate to combatting the much narrower form of medical identity

theft potentially implicated here.” Id. at 54–55.

12 For all these reasons, the Court will not permit Plaintiffs to pursue an interlocutory appeal

under Section 1292(b).

B. Motion for Reconsideration

In the alternative, Plaintiffs ask the Court to reconsider its holding that mitigation

expenses do not constitute actual damages under D.C. law. As just explained, that holding has

been the law of the case since 2019. The Court therefore denies Plaintiffs’ motion because it

“merely asserts ‘arguments for reconsideration [that] the court has already rejected on the

merits.’” BEG Invs., LLC v. Alberti,

(D.D.C. 2015) (alteration in

original). And “‘where litigants have once battled for the court’s decision,’ they should not be

permitted, ‘without good reason[,] . . . to battle for it again.’” Kennedy v. D.C.,

(D.D.C. 2015) (Cooper, J.) (quoting Casey v. Ward,

(D.D.C.

2015)).

Plaintiffs also request clarification of whether they may recover mitigation expenses as

actual damages. Pl.’s MCIA 13-14. True, the Court said in its summary-judgment opinion that

recovery will “likely be limited to nominal damages.” Attias VI, 346 F.R.D. at 12 (emphasis

added). But that is so because the Court “cannot entirely rule out the possibility that there may

be some class members who believe they suffered financial harms (other than mitigation

expenses) stemming from the CareFirst data breach.” Id. (emphasis added). As to mitigation

expenses, the Court has been crystal clear: the class members cannot recover them under D.C.

law.

IV. Conclusion

For these reasons, it is hereby

13 ORDERED that [Dkt. No. 112] Plaintiffs’ Motion for Reconsideration and Motion for

Leave to Bring an Interlocutory Appeal is DENIED.

SO ORDERED.

CHRISTOPHER R. COOPER United States District Judge

Date: August 20, 2024

14