IN RE: MOVEit Customer Data Security Breach Litigation

UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS
IN RE: MOVEIT CUSTOMER DATA
SECURITY BREACH LITIGATION
This Document Relates To:
ALL CASES
MDL No. 1:23-md-03083-ADB-PGL
MDL Order No. 32
(Regarding Additional Dismissal of Cases Filed Before
August 15, 2023, for Lack of Article III Standing)
BURROUGHS, D.J.
In MDL Order No. 19 on Defendants’ 12(b)(1) motion to dismiss, [ECF No. 1304
(“Order No. 19”)], the Court dismissed four individual cases filed before August 15, 2023—the
date on which Plaintiffs allege Cl0p began disclosing stolen data, [ECF No. 1543 ¶ 1199]—for
lack of Article III standing due to a lack of traceability. [Order No. 19 at 28–29, 31].
Defendant Franklin Mint Federal Credit Union (“FMFCU”) and Defendant Athene
Annuity and Life Company (“Athene”) have moved separately for the dismissal of certain
additional cases filed before August 15, 2023, for the same lack of Article III standing. [ECF
Nos. 1483, 1606]. Specifically, FMFCU seeks to dismiss Bronson v. Franklin Mint Federal
Credit Union, No. 23-cv-12893, [ECF No. 1483], and Athene seeks to dismiss Weissman v.
Athene Annuity and Life Company, No. 23-cv-12453, [ECF No. 1606]. For the reasons stated
below, both cases are DISMISSED. Further, pursuant to the Court’s reasoning in Order No. 19,
all other cases consolidated into this MDL that were filed before August 15, 2023, are likewise
DISMISSED.
Case 1:23-md-03083-ADB Document 1690 Filed 02/06/26 Page 1 of 4

2
I. 	BACKGROUND
A. 	FMFCU
As relevant here, FMFCU requested that the Court dismiss Plaintiff Tanya Bronson’s
case, Bronson v. Franklin Mint Federal Credit Union, No. 23-cv-12893, in a joint letter
submitted with Plaintiffs’ Co-Lead Counsel on May 12, 2025. [ECF No. 1483 at 2 (arguing that
the reasoning pursuant to which Order No. 19 “dismissed four actions against plaintiffs ‘whose
individual complaints were filed prior to August 15, 2023’” for lack of Article III standing
applies equally to Bronson, who “filed her complaint on August 7, 2023, i.e., before the August
15, 2023 date on which Plaintiffs allege Cl0p began disclosing data”)]. Plaintiffs opposed
FMFCU’s request in this same letter. [Id. at 3–4].
In a second joint letter submitted on May 23, 2025, FMFCU reiterated its request for the
Court to dismiss Bronson’s case, which was again opposed by Plaintiffs. See generally [ECF
No. 1496].1
B. 	Athene
On October 17, 2025, Athene moved the Court to clarify Order No. 19 and to dismiss
Plaintiff Richard Weissman’s case, Weissman v. Athene Annuity and Life Co., No. 23-cv-12453,
“for lack of Article III standing based on the reasoning in MDL Order No. 19 that dismissed four
other pre-August 15, 2023 cases.” [ECF No. 1606 at 1]; see also [ECF No. 1607]. Plaintiffs
opposed on October 24, 2025. [ECF No. 1613]. Athene replied on October 31, 2025. [ECF No.
1621].
1 FMFCU’s Motion in Further Support of Motion to Compel Arbitration and to Stay Litigation
filed on January 12, 2026, [ECF No. 1676], is denied as moot in light of this Order dismissing
Bronson’s case.
Case 1:23-md-03083-ADB Document 1690 Filed 02/06/26 Page 2 of 4

3
II. 	LEGAL STANDARD
Federal Rule of Civil Procedure 60(a) provides that a court “may correct . . . a mistake
arising from oversight or omission whenever one is found in a judgment, order, or other part of
the record,” and that “[t]he court may do so on motion or on its own, with or without notice.”
Fed. R. Civ. P. 60(a). Rule 60(a) is applicable “where . . . ‘the judgment failed to reflect the
court’s intention.’” Bowen Inv., Inc. v. Carneiro Donuts, Inc., 490 F.3d 27, 29 (1st Cir. 2007)
(quoting Morgan Guar. Tr. Co. of N.Y. v. Third Nat’l Bank of Hampden Cnty., 545 F.2d 758,
759–60 (1st Cir. 1976)).
III. 	DISCUSSION
In the memorandum supporting their 12(b)(1) motion to dismiss, [ECF No. 1114-1],
Defendants argued that complaints filed before August 15, 2023, cannot allege actual misuse
“fairly . . . traceable to the incidents.” [Id. at 48]. In Order No. 19, the Court agreed. [Order No.
19 at 28 (concluding that “individual complaints . . . filed prior to August 15, 2023, cannot
plausibly assert actual misuse”)]. Further, the Court explained that plaintiffs whose complaints
were filed before August 15, 2023, cannot adequately assert either of the two requirements for
risk-based standing to seek damages.2 [Id. at 28–29]. Specifically, as relevant here, the Court
held that any plaintiff whose complaint was filed before the date on which Cl0p allegedly began
disclosing stolen data, August 15, 2023, cannot plausibly allege a risk of future harm traceable to
the breach, because a plaintiff cannot allege that they “were at an increased risk of future harm
2 As Order No. 19 explains, “risk-based standing to seek damages ‘involve[s] two injuries: (1) a
possible future injury that may or may not happen (i.e., the harm threatened); and (2) a present
injury that is the cost or inconvenience created by the increased risk of the first, future injury
(e.g., the cost of mitigation).’” [Order No. 19 at 7–8 (quoting Kerin v. Titeflex Corp., 770 F.3d
978, 981–82 (1st Cir. 2024))].
Case 1:23-md-03083-ADB Document 1690 Filed 02/06/26 Page 3 of 4

4
before any traceable actual misuse plausibly could have occurred.” [Id.]. The Court specifically
dismissed four “pre-August 15, 2023” cases pursuant to this reasoning.3 [Id. at 28–29, 31].
Because this reasoning applies not only to those four cases but to all other “pre-August 15, 2023”
cases, the Court was mistaken in omitting their dismissal from Order No. 19,4 and now dismisses
all cases consolidated into this MDL that were filed before August 15, 2023.
IV. 	CONCLUSION
For the reasons stated above, all cases consolidated into this MDL that were filed before
August 15, 2023, including Bronson v. Franklin Mint Federal Credit Union, No. 23-cv-12893,
and Weissman v. Athene Annuity and Life Co., No. 23-cv-12453, are DISMISSED.
The parties are instructed to agree to and jointly submit the list of all cases dismissed by
this Order by February 20, 2026.
SO ORDERED.
February 6, 2026 	/s/ Allison D. Burroughs
ALLISON D. BURROUGHS
U.S. DISTRICT JUDGE
3 These cases are Harris v. Progress Software Corp., No. 23-cv-11816; Oakwood v. Corebridge
Financial, Inc., No. 23-cv-12643; Newman v. Corebridge Financial Inc., No. 23-cv-12649; and
O’Neal v. Lumico Life Insurance Co., No. 24-cv-10078. [Order No. 19 at 31].
4 Plaintiffs argue that, in Order No. 19, the Court instead “took a . . . moderate position” holding
that plaintiffs whose complaints were filed before August 15, 2023, can establish Article III
standing “based on a traceable, substantial risk of future harm” even though they cannot allege
actual misuse. [ECF No. 1613 at 2 (quoting Order No. 19 at 28)]. This is incorrect. It is true
that, as a general matter, a plaintiff’s failure to allege actual misuse does not necessarily preclude
their ability to allege a risk of future harm; for example, a plaintiff who filed a complaint in
December 2023 might fail to allege actual misuse for one reason or another yet sufficiently
allege a risk of future harm. See [Order No. 19 at 28 (explaining that “even in a case of total
data mismatch — which would undercut a particular plaintiff’s claim of actual injury — the
plaintiff would still be able to assert standing based on a substantial risk of future harm”)]. But if
a plaintiff’s complaint was filed before August 15, 2023, that plaintiff cannot plausibly allege
either actual misuse or “a traceable, substantial risk of future harm.” [Id. at 28–29].
Case 1:23-md-03083-ADB Document 1690 Filed 02/06/26 Page 4 of 4