In re Ashley Madison Customer Data Security Breach Litigation

TRANSFER ORDER

Before the Panel:* Plaintiff in an action pending in the Eastern District of Missouri moves under 28 U.S.C. § 1407 to *1379centralize pretrial proceedings in this litigation in the Eastern District of Missouri. This litigation consists of five actions — two actions pending in the Central District of California and one action each in the Northern District of Alabama, the Eastern District of Missouri, and the-Northern District of. Texas — as - listed on Schedule A. The Panel also has been- notified of thirteen related actions pending in 'eight districts.1

With one exception, all responding parties agree that centralization is warranted, but disagree about the most appropriate transferee district.. Plaintiffs, in two actions and Defendants Avid Life Media, Inc., and Avid Dating Life, Inc; (collectively, Avid) support the motion to centralize in the Eastern District of Missouri. Plaintiffs in the two actions on the motion pending in the Central District of California and plaintiffs in three potential tag-along actions favor centralization in the Central District of California. Plaintiffs in .one of these actions alternatively suggests the Northern District of Texas as the transferee district. Plaintiffs in two potential tag-along actions pending in the Northern District of Illinois propose centralization in that district.

The plaintiff in a potential tag-along action pending in the District of Maryland (Russell) opposes inclusion of that action in any centralized proceedings. The opposing plaintiff argues that Russell is a consumer fraud lawsuit, that is not based on the same factual core as the data breach actions that are the subject of the motion for centralization. Alternatively, the opposing plaintiff proposes centralization, in the District of Maryland. At the hearing on this matter, Avid argued that Russell should be included in any centralized proceedings.

On the basis of the papers filed 'and the hearing session held, we find that these actions involve common questions of fact, and that centralization in the Eastern District of Missouri will serve the convenience of the parties and witnesses and promote the just and efficient conduct1 of this litigation'. These actions share factual questions arising from a data security breach that allegedly occurred on or about July 15, 2015, involving AshleyMadison.com, a “dating” website designed to facilitate intimate relationships for individuals who are either married or in a committed relationship. Avid owns and operates the website. According to plaintiffs, this data breach resulted in the electronic theft of personally identifiable and financial information of some 37 million users of AshleyMadi-son.com. The information compromised in the data breach purportedly was released on the Internet on August 18 and 20, 2015. Plaintiffs in- these actions similarly allege, on behalf of similar putative nationwide or state classes, that Avid failed to adequately secure their-personal and financial information; marketed a “Full Delete Removal” service that did not, in fact, purge user account information from the Ashley Madison database; and made extensive use of artificial intelligence “bots” and other mechanisms to mimic fake users (specifically, female users) on the Ashley Madison website in order to induce actual (predominantly male) users to make purchases. Centralization thus will eliminate duplica-tive discovery, prevent inconsistent pretrial rulings, particularly with respect to *1380class certification, and conserve the resources of the parties, their counsel, and the judiciary.

Typically, we would find consideration of the opposing plaintiffs request to exclude the Russell action from the MDL to be premature. See In re DePuy Orthopaedics, Inc., Pinnacle Hip Implant Prods. Liab. Litig., 787 F.Supp.2d 1358, 1360 (J.P.M.L. 2011). In this instance, though, it is apparent that inclusion of Russell in the centralized proceedings is appropriate. The opposing plaintiff argues that Russell involves allegations different from those in the other actions subject to this Transfer Order because he asserts only fraud claims based upon Avid’s alleged use of artificial intelligence “bots” and falsified user profiles to induce users to make purchases on the Ashley Madison website. Contrary to plaintiff s argument, this allegation is not unique — at least five other related actions assert similar, if not identical, consumer fraud claims on behalf of putative nationwide classes.2 One of these, the Poyet action pending in the Central District of California, like Russell asserts only consumer fraud claims based on the false user profiles. Additionally; plaintiffs learned of this alleged fraudulent scheme through analysis of the data disclosed in the Ashley Madison data breach. Thus; Russell likely will involve common factual questions regarding the data breach and the operation of the Ashley Madison website. In any event, transfer under Section 1407 does not require a -complete identity or even a majority of common factual issues as a prerequisite to transfer. See In re National Sec. Agency Telecomms. Records Litig., 444 F.Supp.2d 1332, 1334 (J.P.M.L. 2006). To the extent that Russell involves unique issues, the transferee judge has the discretion to handle those issues through the use of appropriate pretrial devices, such as separate-tracks for discovery and motion practice. -

We select the Eastern District of Missouri as the transferee district for this litigation. This district is a geographically central and accessible forum for-, this nationwide litigation. The Eastern District of Missouri also is relatively convenient for defendants, which are located in Toronto, Canada. The first-filed action is pending in this district, and this district has the support of both plaintiffs and defendants. Finally, centralization in the Eastern District of- Missouri allows us to appoint the Honorable John A. Ross, an experienced transferee judge with the'- willingness and ability to efficiently manage this litigation, to preside over this matter.

IT IS THEREFORE ORDERED that the actions listed on Schedule A and pending outside the Eastern District of Missouri are transferred to the Eastern District of Missouri and, with the consent of that court, assigned to the Honorable John A. Ross for coordinated or consolidated pretrial proceedings.

SCHEDULE A

MDL No. 2669 — IN RE: ASHLEY MADISON CUSTOMER DATA SECURITY BREACH LITIGATION

Northern District of Alabama

DOE v. AVID LIFE MEDIA, INC., ET AL., C.A. No. 6:15-01464

Central District of California

DOE v. AVID LIFE MEDIA, INC., ET AL., C.A. No. 2:15-06405

*1381DOE 1, ET AL. v. AVID LIFE MEDIA, INC., ET AL., C.A. No. 8:15-01347

Eastern District of Missouri

DOE v. AVID LIFE MEDIA, INC., C.A. No. 4:15-01132

Northern District of Texas

DOE v. AVID LIFE MEDIA, INC., C.A. No. 3:15-02750