IN RE: MOVEit Customer Data Security Breach Litigation

UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS
IN RE: MOVEIT CUSTOMER DATA
SECURITY BREACH LITIGATION
This Document Relates To:
ALL CASES
MDL No. 1:23-md-03083-ADB-PGL
MDL Order No. 24
(Welltok, Inc.’s Motion for Partial Reconsideration of the Court’s MDL Order No. 23)
BURROUGHS, D.J.
Bellwether Defendant Welltok, Inc. (“Welltok”) moves for partial reconsideration of
MDL Order No. 23 (“Order No. 23”), [ECF No. 1517], specifically as to the Court’s decision to
apply Rhode Island law to claims asserted by Bellwether Plaintiffs against Welltok. [ECF Nos.
1551, 1552]. For the reasons stated below, Welltok’s motion is DENIED.
I. 	BACKGROUND
Bellwether Plaintiffs filed their Corrected Bellwether Consolidated Class Action
Amended Complaint (“CAC”) on January 9, 2025. [ECF No. 1332 (“CAC”)].1 Welltok, Inc. is
a patient engagement company “with its principal place of business located at 75 Fountain Street,
Suite 310, Providence, Rhode Island 02902.” [Id. ¶ 939]. It has been a subsidiary of Virgin
Pulse since November 2021, and “[p]rior to being acquired by Virgin Pulse in November 2021,
Welltok’s principal place of business was located at 1515 Arapahoe Street, Tower 3 – Suite 700,
1 At this stage of the proceedings, the Court accepts as true allegations in the CAC. See United
States ex rel. Hutcheson v. Blackstone Med., Inc., 647 F.3d 377, 383 (1st Cir. 2011).
Case 1:23-md-03083-ADB Document 1617 Filed 10/29/25 Page 1 of 6

2
Denver, Colorado 80202.” [Id.]. The data breach at issue occurred in approximately late May
2023. [Id. ¶¶ 1, 14, 1120, 1261].
Welltok Bellwether Plaintiff Sherrie Rodda (“Plaintiff Rodda”) is a resident and citizen
of Texas who, as relevant here, brings claims against Welltok on behalf of herself and on behalf
of the proposed Welltok Nationwide Class and Welltok Texas Class. [CAC ¶¶ 323, 3486–87,
3503–816].
Welltok moved to dismiss the CAC on February 4, 2025, [ECF No. 1377]; Bellwether
Plaintiffs opposed on April 7, 2025, [ECF No. 1441]; and Welltok replied on April 28, 2025,
[ECF No. 1465]. In the reply, Welltok states, “[Bellwether Plaintiffs] are wrong on a critical
fact. [Bellwether Plaintiffs] claim that Welltok is headquartered in Rhode Island. This is
incorrect. . . . Rhode Island’s law is inapplicable because it is not where Welltok is located.”
[ECF No. 1465 at 12–13].
On July 31, 2025, the Court issued MDL Order No. 22 (“Order No. 22”) concerning
Defendant Progress Software Corporation’s (“Progress’s”) motion to dismiss allegations against
it contained in the CAC. [ECF No. 1516]. Applying the “most significant relationship” choice-
of-law test, the Court concluded that the place of the defendant’s domicile properly determined
the controlling law for tort claims that would have been or were originally filed in Texas, among
other states. See [id. at 14–16 (concluding that the law of Massachusetts, the place of Progress’s
domicile, applies to common law claims raised by Plaintiff Rodda, among other plaintiffs)].
On July 31, 2025, the Court also issued Order No. 23 concerning the non-Progress
Bellwether Defendants’ motions to dismiss the allegations against them contained in the CAC,
[ECF No. 1517], including Welltok’s motion to dismiss, [ECF No. 1377]. The Court
incorporated the choice-of-law principles set forth in Order No. 22. [ECF No. 1517 at 14].
Case 1:23-md-03083-ADB Document 1617 Filed 10/29/25 Page 2 of 6

3
Accordingly, treating Welltok as a Rhode Island–based corporation, [id. at 6], the Court
determined that Rhode Island law controls the common law claims against Welltok, [id. at 14].
The Court dismissed Plaintiff Rodda’s unjust enrichment claim against Welltok, [id. at 40–42],
and denied Welltok’s motion to dismiss the negligence per se claim, [id. at 23–24].
On September 10, 2025, Welltok filed the instant motion for reconsideration. [ECF No.
1551]. In the supporting brief, Welltok states:
To the extent MDL Order No. 23 applies Rhode Island law to Bellwether Plaintiffs’
claims, including Bellwether Plaintiff Rodda, against Welltok, it is based on factual
inaccuracies. 	Specifically, at the time of the MOVEit Incident, Welltok was not
headquartered in Rhode Island and did not have its principal place of business in
Rhode Island. At the time of the MOVEit Incident, Welltok was headquartered in
Colorado, and its principal place of business was located in Colorado. If the Court
determines that the law of the state in which Welltok is “domiciled” is the
appropriate law, then Colorado law should apply.
[ECF No. 1552 at 3]. As an exhibit, Welltok submitted a declaration made by the general
counsel for Welltok’s parent company, [ECF No. 1552-1], that states that, at the time of the data
breach, Welltok was headquartered in Colorado, it did not have a registered agent in Rhode
Island, and its principal place of business was not in Rhode Island. [Id. ¶¶ 6–8].
On September 24, 2025, Bellwether Plaintiffs opposed Welltok’s motion. [ECF No.
1572]. The opposition brief includes as an exhibit Welltok’s annual report filed with the
Commonwealth of Massachusetts on March 8, 2023, which lists Welltok’s principal office
address as 3001 Brighton Blvd., Suite 743, Denver, CO 80216. [ECF No. 1572-4 at 2]. The
opposition brief also includes as an exhibit Welltok’s subsequent annual report filed on March
15, 2024, which lists Welltok’s principal office address as 75 Fountain Street, Suite 310,
Providence, RI, 02902. [ECF No. 1572-5 at 2].
Case 1:23-md-03083-ADB Document 1617 Filed 10/29/25 Page 3 of 6

4
II. 	LEGAL STANDARD
“A federal district court has the discretion to reconsider interlocutory orders and revise or
amend them at any time prior to final judgment.” Davis v. Lehane, 89 F. Supp. 2d 142, 147 (D.
Mass. 2000); see also Fed. R. Civ. P. 54(b); Fernandez-Vargas v. Pfizer, 522 F.3d 55, 61 n.2 (1st
Cir. 2008) (“[A] district court has the inherent power to reconsider its interlocutory orders, and
we encourage it to do so where error is apparent.”); Perez-Ruiz v. Crespo-Guillen, 25 F.3d 40, 42
(1st Cir. 1994) (“Interlocutory orders, including denials of motions to dismiss, remain open to
trial court reconsideration, and do not constitute the law of the case.” (citing Union Mut. Life Ins.
Co. v. Chrysler Corp., 793 F.2d 1, 15 (1st Cir. 1986))).
At the same time, the Supreme Court has cautioned that, while “[a] court has the power to
revisit prior decisions . . . in any circumstance, . . . as a rule courts should be loathe to do so in
the absence of extraordinary circumstances such as where the initial decision was ‘clearly
erroneous and would work a manifest injustice.’” Christianson v. Colt Indus. Operating Corp.,
486 U.S. 800, 817 (1988) (quoting Arizona v. California, 460 U.S. 605, 618 n.8 (1983)). “When
faced with a motion for reconsideration,” in essence, “a district court must balance the need for
finality against the duty to render just decisions.” Davis, 89 F. Supp. 2d at 147. Accordingly,
“[i]n order to accommodate these competing interests, a court should grant a motion for
reconsideration of an interlocutory order only when the movant demonstrates (1) an intervening
change in the law; (2) the discovery of new evidence not previously available; or (3) a clear error
of law in the first order.” Id.
III. 	DISCUSSION
Welltok argues that Bellwether Plaintiffs mistakenly assume that “Welltok’s ‘domicile’
moved from Colorado to Rhode Island (where Virgin Pulse is headquartered)” after Welltok was
Case 1:23-md-03083-ADB Document 1617 Filed 10/29/25 Page 4 of 6

5
acquired by Virgin Pulse in 2021 and that Welltok was therefore domiciled in Rhode Island by
the time the data breach occurred in May 2023. [ECF No. 1552 at 4–5]. In reality, Welltok says,
its headquarters and principal place of business were still located in Colorado at the time of the
breach. [Id. at 5]. Welltok thus asks the Court to “reconsider . . . its conflict-of-laws application
and not apply the law of Rhode Island” in Order No. 23, because “if the law of corporate
domicile is to be applied, then Colorado law should be adopted.” [Id.].
Bellwether Plaintiffs, relying on the March 2023 and 2024 Welltok annual reports,
respond that “[b]ecause Welltok’s own corporate filings indicate that Welltok indeed moved its
headquarters to Rhode Island at some point near the time of the MOVEit data breach, this issue
does not appear to be one that can be simply resolved without some amount of discovery.” [ECF
No. 1572 at 10 n.3 (citation omitted)].2 As a result, Bellwether Plaintiffs maintain that Welltok
fails to meet the standard for reconsideration. [Id. at 4, 8–9 (“Welltok does not (and cannot)
identify a change in the law, a clear error of law, or any newly discovered evidence that did not
exist at the time that it filed its original Rule 12(b)(6) motion.”)]. The Court agrees.
First, Welltok does not identify any intervening change in the law that would now require
the Court to reconsider Order No. 23. Second, Welltok does not identify new evidence that was
unavailable when it filed its motion to dismiss, see generally [ECF No. 1377], in February 2025.
Third, Welltok does not identify a clear error of law in the first order. Bellwether Plaintiffs are
correct, and Welltok does not dispute, that “it was proper for the Court to construe the [CAC]’s
2 For clarity’s sake, the Court notes that the March 2023 annual report disclosing the Colorado
address was filed a few months before the breach allegedly occurred in May 2023, and that the
March 2024 annual report disclosing the Rhode Island address was filed after the breach
allegedly occurred.
Case 1:23-md-03083-ADB Document 1617 Filed 10/29/25 Page 5 of 6

6
allegations as true for purposes of resolving the Rule 12(b)(6) motion; indeed, doing so is
required by black-letter procedural law.” [ECF No. 1572 at 8]; see also Blackstone Med., 647
F.3d at 383. Because the allegations in the CAC clearly support the application of Rhode Island
law, reconsideration is not warranted at this stage.3
IV. 	CONCLUSION
For the reasons stated above, Welltok does not meet the standard for reconsideration and
its motion for partial reconsideration of MDL Order No. 23 is DENIED.
SO ORDERED.
October 29, 2025 	/s/ Allison D. Burroughs
ALLISON D. BURROUGHS
U.S. DISTRICT JUDGE
3 Welltok may renew its argument at the summary judgment stage. See, e.g., Reisch v.
McGuigan, 745 F. Supp. 56, 57–58 (D. Mass. 1990) (stating that the choice-of-law issue could
be decided on the defendants’ summary judgment motion because there were no relevant
material facts in dispute); Alifax Holding SpA v. Alcor Sci. Inc., 357 F. Supp. 3d 147, 154–55
(D.R.I. 2019) (explaining that a party may properly request a choice-of-law ruling under Rule 56
even if that ruling “will not determine any disputed claim”).
Case 1:23-md-03083-ADB Document 1617 Filed 10/29/25 Page 6 of 6