In re Accellion, Inc. Data Breach Litigation

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
IN RE ACEELLION, INC. DATA BREACH
LITIGATION
Case No. 21-cv-01155-EJD (SVK)
ORDER RE DISCOVERY DISPUTE AT
DKT. 400
Re: Dkt. No. 400
Before the Court is the Joint Submission of Plaintiffs and third-party Washington State
Auditor’s Office (“WA SAO”) regarding the scope of two subpoenas served on WA SAO seeking
documents and a deposition. Dkt. 400. The Parties have met and conferred and largely resolved
the issues regarding production of documents, provided certain privacy concerns are addressed.
See Dkt. 400 at 1-3, 10. The Parties dispute the need for a deposition, which directly relates back
to the document production. The Court has reviewed the Parties submissions and the relevant law,
including Federal Rule of Civil Procedure 45 and determines that this matter may be resolved
without oral argument. Civ. L.R. 7-1(b).
Plaintiffs seek two categories of documents:
(i) files WA SAO collected during its investigation that it determined were on the
FTA at the time of the Data Breach; and
(ii) documents that WA SAO already produced in the related action Stone, et al. v. The
Office of the Washington State Auditor, et al., No. 21-2-01439 (Sup. Ct. WA.) (the
“Stone Action”).
It is the first category from which the dispute regarding the need for a deposition arises.
The Honorable Edward J. Davila certified a WA SAO subclass, provided that “there is a way to
Case 5:21-cv-01155-EJD Document 402 Filed 01/14/26 Page 1 of 3

2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
generate a spreadsheet identifying the specific categories of data disclosed by class member.” In
re Accellion, Inc. Data Breach Litig., 2025 WL 2799102, at *15 (N.D. Cal. Sept. 30, 2025).
Plaintiffs state that they need the deposition, in part, to confirm “that a spreadsheet can be reliably
created using the underlying records on the FTA and the time of the Data Breach.” Dkt. 400 at 5.
WA SAO explains the background as to its efforts to reconstruct the identification of files on the
FTA at the time of the breach, along with the limitations on those reconstruction efforts. Id. at 7-
8. WA SAO also points to a declaration that it already provided in this action, that lays out its
reconstruction efforts, and the limitations thereon, and therefore a deposition is unnecessary and
burdensome, particularly in light of its status as a public agency and a third party to this action.
Id. WA SAO seeks cost-shifting, if a deposition is ordered.
Noting that this case is still in the discovery phase, considering the general parameters of
relevance and proportionality of Rule 26, which also apply to subpoenas served pursuant to Rule
45, (see Fed. R. Civ. P. 45, 1970 Advisory Committee Notes (“[T]he scope of discovery through a
subpoena is the same as that applicable to Rule 34 and the other discovery rules.”)), and keeping
in mind the subpoenaed-party’s status as a third-party, the Court ORDERS as follows:
1. 	No later than January 28, 2026, WA SAO will produce both categories of documents:
(i) files WA SAO collected during its investigation that it determined were on the
FTA at the time of the Data Breach; and
(ii) documents that WA SAO already produced in the related action Stone, et al. v. The
Office of the Washington State Auditor, et al., No. 21-2-01439 (Sup. Ct. WA.) (the
“Stone Action”).
2. 	The production will be subject to the Protective Order in this action (Dkt. 189):
(i) Plaintiffs will store this information on an air-gapped (i.e., not connected to the
internet), encrypted hard drive maintained by Plaintiffs’ expert.
(ii) Plaintiffs’ Counsel will not create a copy of the information or handle the
information independently of their expert.
3. 	Before February 27, 2026, WA SAO shall make a corporate witness available to be
deposed on only topics 11 and 12 (b)-(c) identified in Plaintiffs’ January 17, 2025
Case 5:21-cv-01155-EJD Document 402 Filed 01/14/26 Page 2 of 3

3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
Subpoena to Testify at Deposition, only to the extent such questions arise from or relate to
the document production. The Deposition shall be conducted remotely, be limited to
topics 11 and 12 (b)-(c) and be no more than 2.5 (two and one half) hours on the record.
The Parties are cautioned that WA SAO can only testify as to what information is in its
custody and control and the witness may or may not be able to confirm that “a spreadsheet
can be reliability created” from the produced data.
4. 	In light of WA SAO’s status as a third party and the declaration it previously provided,
cost shifting is appropriate in this case. Plaintiffs shall reimburse WA SAO for costs and
fees, including attorneys’ fees, associated with the deposition not to exceed $5,000.
SO ORDERED.
Dated: January 14, 2026
SUSAN VAN KEULEN
United States Magistrate Judge
Case 5:21-cv-01155-EJD Document 402 Filed 01/14/26 Page 3 of 3