IN RE: MOVEit Customer Data Security Breach Litigation

UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS
IN RE: MOVEIT CUSTOMER DATA
SECURITY BREACH LITIGATION
This Document Relates To:
ALL CASES
MDL No. 1:23-md-03083-ADB-PGL
MDL Order No. 28
(Progress’s Second Motion for Partial Reconsideration of MDL Order No. 22)
BURROUGHS, D.J.
Progress Software Corporation (“Progress”) moves again for partial reconsideration of
MDL Order No. 22, [ECF No. 1516 (“Order No. 22”)]. [ECF Nos. 1553, 1555 (“Mem.”), 1600].
For the reasons stated below, Progress’s motion is GRANTED IN PART and DENIED IN
PART.
I. 	LEGAL STANDARD
“A federal district court has the discretion to reconsider interlocutory orders and revise or
amend them at any time prior to final judgment.” Davis v. Lehane, 89 F. Supp. 2d 142, 147 (D.
Mass. 2000) (first citing Bethlehem Steel Exp. Corp. v. Redondo Constr. Corp., 140 F.3d 319,
321 (1st Cir. 1998); and then citing Pérez-Ruiz v. Crespo-Guillén, 25 F.3d 40, 42 (1st Cir.
1994)); see also Fed. R. Civ. P. 54(b) (“[A]ny order or other decision . . . that adjudicates fewer
than all the claims or the rights and liabilities of fewer than all the parties . . . may be revised at
any time before the entry of a judgment . . . .”); Fernández-Vargas v. Pfizer, 522 F.3d 55, 61 n.2
(1st Cir. 2008) (“[A] district court has the inherent power to reconsider its interlocutory orders,
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 1 of 10

2
and we encourage it to do so where error is apparent.” (citing Warren v. American Bankers Ins.,
507 F.3d 1239, 1243 (10th Cir. 2007))); Pérez-Ruiz, 25 F.3d at 42 (1st Cir. 1994) (“Interlocutory
orders, including denials of motions to dismiss, remain open to trial court reconsideration, and do
not constitute the law of the case.” (citing Union Mut. Life Ins. Co. v. Chrysler Corp., 793 F.2d
1, 15 (1st Cir. 1986))).
At the same time, while “[a] court has the power to revisit prior decisions . . . in any
circumstance, . . . as a rule courts should be loathe to do so in the absence of extraordinary
circumstances such as where the initial decision was ‘clearly erroneous and would work a
manifest injustice.’” Christianson v. Colt Indus. Operating Corp., 486 U.S. 800, 817 (1988)
(quoting Arizona v. California, 460 U.S. 605, 618 n.8 (1983)). “When faced with a motion for
reconsideration,” in essence, “a district court must balance the need for finality against the duty
to render just decisions.” Davis, 89 F. Supp. 2d at 147 (citing McCoy v. Macon Water Auth.,
966 F. Supp. 1209, 1222 (M.D. Ga. 1997)). “In order to accommodate these competing interests,
a court should grant a motion for reconsideration of an interlocutory order only when the movant
demonstrates (1) an intervening change in the law; (2) the discovery of new evidence not
previously available; or (3) a clear error of law in the first order.” Id. (first citing McCoy, 966 F.
Supp. at 1222; and then citing 18 Wright & Miller’s Federal Practice & Procedure § 4478
(1981)).
Additionally, under Federal Rule of Civil Procedure 60(a), a court “may correct a clerical
mistake or a mistake arising from oversight or omission whenever one is found in a judgment,
order, or other part of the record,” and “[t]he court may do so on motion or on its own, with or
without notice.” Fed. R. Civ. P. 60(a). Rule 60(a) is applicable “where . . . ‘the judgment failed
to reflect the court’s intention.’” Bowen Inv., Inc. v. Carneiro Donuts, Inc., 490 F.3d 27, 29 (1st
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 2 of 10

3
Cir. 2007) (quoting Morgan Guar. Tr. Co. of N.Y. v. Third Nat’l Bank of Hampden Cnty., 545
F.2d 758, 759–60 (1st Cir. 1976)).
II. 	DISCUSSION
A. 	Unjust enrichment under Michigan law
Progress asks the Court to dismiss Bellwether Plaintiffs’ unjust enrichment claim under
Michigan law, positing that the Court made a clerical error in denying it. [Mem. at 3–4]. While
Progress’s confusion may be reasonable, the motion is DENIED.
Order No. 22 states:
In Michigan, the fact that the benefit was not “received directly from the
[P]laintiff[s]” defeats an unjust enrichment claim. Lochridge v. Quality Temporary
Servs., Inc., No. 22-cv-12086, 2023 WL 4303577, at *7 (E.D. Mich. June 30, 2023).
As to the remaining jurisdictions (Pennsylvania and Ohio), the Court agrees
with Plaintiffs that the unjust enrichment claims live on.
[Order No. 22 at 32–33 (emphasis added)]. Here, the Court did not refer to Michigan as one of
the “remaining jurisdictions” only because it had just mentioned Michigan. The Court then
proceeded to explain why “the unjust enrichment claims live on” under Pennsylvania, Ohio, and
Michigan law. See [id. at 33 (citing a Michigan case and referring to “similar cases under Ohio
and Michigan law”)]. As Order No. 22 explains, an unjust enrichment claim brought under
Michigan law is defeated if the benefit was not “received directly from the plaintiff.” Lochridge,
2023 WL 4303577, at *7. Plaintiffs here satisfy this directness requirement because they “allege
that Progress was in the business of designing software for the very purpose of protecting
sensitive information, including PII, and thus their business depended on the receipt of such
information. . . . [T]hey allege the design and ongoing maintenance of MOVEit was the
commodification of their PII.” [Order No. 22 at 33]. Cf. Polkowski v. Jack Doheny Companies,
Inc., No. 25-cv-10516, 2025 WL 3079358, at *11 (E.D. Mich. Nov. 4, 2025) (finding that unjust
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 3 of 10

4
enrichment allegations against the employer-defendant, a utility equipment company, failed to
satisfy the directness requirement because “[a]ny benefit [defendant] received from maintaining
or using [p]laintiff’s PII was merely incidental to the parties’ employment relationship”); Kingen
v. Warner Norcross + Judd LLP, No. 22-cv-01126, 2023 WL 11965363, at *5 (W.D. Mich. Oct.
5, 2023) (dismissing plaintiffs’ unjust enrichment claim “because [p]laintiffs did not plead any
specific factual allegations explaining how [d]efendant benefitted from possessing [p]laintiffs’
PII”).
B. 	Illinois Consumer Fraud Act
In Order No. 23, the Court dismissed Maximus Bellwether Plaintiff Rob Plotke’s Illinois
Consumer Fraud Act (“ICFA”) claim against Bellwether Defendant Maximus (“Maximus”) for
failure to allege that Maximus’s deceptive statements proximately caused Plotke’s injuries.
[ECF No. 1517 (“Order No. 23”) at 75 (“[A]n ICFA plaintiff ‘must prove that “each and every
consumer who seeks redress actually saw and was deceived by the statements in question”’ in
order to satisfy proximate cause.” (quoting De Bouse v. Bayer AG, 922 N.E.2d 309, 315 (Ill.
2009)))]. In Order No. 22, by contrast, the Court sustained Plotke’s ICFA claim against
Progress, accepting Plaintiffs’ “indirect deception” theory for the Progress claims in particular
and finding that the Corrected Bellwether Consolidated Class Action Amended Complaint
(“CAC”) plausibly alleged an ICFA claim against Progress based on that theory. [Order No. 22
at 58–59].
Progress now asks the Court to reconsider and dismiss Plotke’s ICFA claim against
Progress, arguing that
[t]he Court’s reasoning as to proximate cause [underlying its dismissal of the claim
against Maximus] applies with even greater force to Plaintiff Plotke’s claim against
Progress, where Progress is even further removed from any relationship or
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 4 of 10

5
connection to Plaintiffs. Plaintiff Plotke fails to identify a single communication,
representation, advertisement, or other statement by Progress that Plaintiff Plotke
received (either directly from Progress or indirectly from Maximus), let alone that
he was deceived by.
[Mem. at 13]. Progress does not discuss or explain why the Court’s reasoning against the
Maximus claim “applies with even greater force” to the Progress claim even under the indirect
deception theory;1 why the Court’s discussion of statements made by Progress, [Order No. 22 at
59], is insufficient; or why, as a general matter, the Court made a “clear error of law” justifying
reconsideration, Davis, 89 F. Supp. 2d at 147. Accordingly, Progress’s motion to reconsider
Plotke’s ICFA claim against Progress is DENIED.
C. 	State data-breach notification statutes
Progress asks the Court to dismiss Bellwether Plaintiffs’ claims under the Illinois Private
Information Protection Act (“PIPA”), Michigan Identity Theft Protection Act (“MITPA”), North
Carolina Identity Theft Protection Act (“NCITPA”), and Washington Data Breach Notification
Law (“WDBNL”). [Mem. at 4–11].
In Order No. 23, the Court dismissed claims brought under these statutes against certain
non-Progress defendants. [Order No. 23 at 75–76, 78–79, 93–96, 106–08]. Progress now
1 It is possible that Progress misconstrues the indirect deception theory, under which a plaintiff
may, as one option, establish proximate cause by alleging that the misrepresentations were made
to and deceived an intermediary—such as Maximus—on whose knowledge or judgment the
plaintiff relied. See, e.g., Shannon v. Boise Cascade Corp., 805 N.E.2d 213, 218 (Ill. 2004)
(giving the example of a manufacturer’s promotional literature deceiving an intermediary
“builder, architect, or contractor, resulting in the installation of defective siding on a home,” and
explaining that a consumer “who may have no independent knowledge of the qualities or
expected performance standards of siding” may be “deceived because of the deception of the
builder, architect or contractor, who reasonably should have had correct knowledge”). Taking
the CAC’s allegations as true and drawing reasonable inferences in Plaintiffs’ favor, Order No.
22 found that Plaintiffs plausibly alleged that Progress made misrepresentations to Maximus and
that Maximus was deceived by them. [Order No. 22 at 59].
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 5 of 10

6
contends that the Court’s reasoning underlying those dismissals applies equally to Progress, and
that the claims against Progress should thereby be dismissed. See [Mem. at 9–11]. Plaintiffs
counter that Progress is “bound” by its “fail[ure] to make the arguments those defendants made”
in their respective motion-to-dismiss filings. [ECF No. 1574 (“Pls. Opp.”) at 11].
While Plaintiffs are correct that “a party is not entitled to present new arguments on a
motion for reconsideration,” Glob. Naps, Inc. v. Verizon New England, Inc., 489 F.3d 13, 25 (1st
Cir. 2007) (emphasis added) (citing Aybar v. Crispin-Reyes, 118 F.3d 10, 16 (1st Cir. 1997)), a
district court may “reconsider its interlocutory orders . . . where error is apparent” regardless of
whether the movant does so, Fernandez-Vargas, 522 F.3d at 61 n.2. Here, where Progress filed
the instant motion about six weeks after the issuance of Order No. 22, and where, in this motion,
Progress explains that repeating other defendants’ arguments seemed like “an exercise in
redundancy that Progress sought to avoid for the Court and for purposes of page-limit economy,”
reconsideration based on these arguments is appropriate. Cf. Davis, 89 F.Supp.2d at 148
(rejecting a motion for reconsideration “because [the movant] waited thirteen years to file it”);
Aini v. Sun Raiyabg Co., 174 F.R.D. 327, 330 (S.D.N.Y. 1997) (denying motion to modify
interlocutory judgment when the movant “offered no explanation for its failure to raise” the
relevant point and when “the delay in raising this point [was] extraordinary”). The Court thus
considers these arguments in turn.2
2 Progress’s other line of argument, namely that the Court erred in finding (1) that “an entity may
‘maintain’ data without owning or licensing it,” and (2) that “Plaintiffs’ allegations that Progress
was responsible for maintaining secure code for MOVEit Transfer are sufficient,” see [Mem. at
4–9 (citing Order No. 22 at 47–48)], is unavailing. The Court agrees with Plaintiffs that “[a]t
bottom, Progress provides no support for reconsideration other than the same arguments it made
in its motion to dismiss,” [Pls. Opp. at 9], and that the Court rejected in Order No. 22.
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 6 of 10

7
1. 	PIPA
Progress asks the Court to dismiss the PIPA claim brought by Bellwether Plaintiffs
Christopher Rehm, Katharine Uhrich, and Plotke on behalf of the Progress Illinois Class, [ECF
No. 1332 (“CAC”) ¶¶ 1629–42]. [Mem. at 10]. “[T]he Court agrees with Defendants that PIPA
does not by itself create an independent private right of action,” [Order No. 23 at 75–76], so all
three PIPA claims against Progress are DISMISSED insofar as Plaintiffs purport to state an
independent cause of action under PIPA.
The Court also takes the “view . . . that a violation of the PIPA is a per se ‘unlawful
practice’ under ICFA, which ‘allows consumers to bring private actions when damaged by an
unlawful practice.’” [Order No. 23 at 76 (citing Fox v. Iowa Health Sys., 399 F. Supp. 3d 780,
800 (W.D. Wisc. 2019))]. As the Court explained in Order No. 23, for an ICFA claim premised
on a PIPA violation, “failure ‘to allege any damages that were caused by the timing of the
notifications’ is fatal.” [Id. (citing Fox, 399 F. Supp. 3d at 801)]. Rehm and Uhrich fail to meet
this pleading requirement because they do not allege actual damages. [Id. at 73–74]. Plotke fails
to meet this pleading requirement because, while he does allege a pecuniary loss, [id. at 74
(explaining that Plotke satisfies the ICFA damages requirement because he “alleges that he
‘incurred out-of-pocket expenses’ in the form of ‘postage’”)], Plotke does not allege damages
caused by the timing of notification. Fox, 399 F. Supp. 3d at 801 (“Because plaintiffs do not
explain how they would have suffered less damages had [the defendant] notified them sooner,
the court will dismiss their claims for violations of the breach notification statutes.”). Rehm’s,
Uhrich’s, and Plotke’s ICFA claims that are premised on a PIPA violation are therefore
DISMISSED. Additionally, because the Court made an error of law by declining to dismiss
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 7 of 10

8
Plotke’s ICFA claim premised on a PIPA violation against Maximus, [Order No. 23 at 76], the
claim against Maximus is likewise DISMISSED.
2. 	MITPA
Progress asks the Court to dismiss the MITPA claim brought by Bellwether Plaintiffs
Tamara Williams and Jeff Weaver on behalf of the Progress Michigan Class, [CAC ¶¶ 1665–76].
[Mem. at 10]. Because Progress is correct that “MITPA does not afford a private right of
action,” [Order No. 23 at 78], the MITPA claims against Progress are DISMISSED insofar as
Williams and Weaver purport to state an independent cause of action under MITPA. Williams
and Weaver may, however, pursue a MITPA theory as part of their Michigan Consumer
Protection Act claim.
3. 	NCITPA
Progress asks the Court to dismiss the NCITPA claim brought by Bellwether Plaintiff
Ben Dieck (“Dieck”) on behalf of the Progress North Carolina Class, [CAC ¶ 1729–39]. [Mem.
at 10–11].
“A plaintiff must bring a claim for a violation of the NCITPA under the [North Carolina
Unfair and Deceptive Trade Practices Act (“NCUDTPA”)].” Rogers v. Keffer, Inc., 243 F.
Supp. 3d 650, 662 (E.D.N.C. 2017) (citing Reid v. Ayers, 531 S.E.2d 231, 235 (N.C. Ct. App.
2000)). In Order No. 23, the Court dismissed Dieck’s NCUDTPA claim (premised on a
violation of the NCITPA) against Maximus for failure to allege proximate cause, finding that
“[t]he allegations of the CAC provide no factual basis for concluding that [the] alleged
incremental increase in [Dieck’s] emotional distress was legally caused by, or was a reasonably
foreseeable consequence of, the timing of notice, as opposed to the Data Breach itself.” [Order
No. 23 at 94–96].
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 8 of 10

9
Progress is correct that this reasoning also applies to Dieck’s claim against Progress.
Dieck’s “conclusory allegation that he suffered emotional distress following a three-month gap
between breach and notice does not support a plausible inference of proximate cause,” [id. at 95–
96], required for the claim against either Maximus or Progress. Accordingly, Dieck’s
NCUDTPA claim premised on a NCITPA violation against Progress is DISMISSED.
4. 	WDBNL
Progress asks the Court to dismiss the WDBNL claim brought by Bellwether Plaintiff
Megan McClendon on behalf of the Progress Washington Class, [CAC ¶ 1784–97]. [Mem. at
10–11].
In Order No. 23, the Court found that “the weight of the authority suggests that [a
WDBNL plaintiff] must allege some distinct injury caused by the delay” in the defendant’s
notice. [Order No. 23 at 107]. Progress is correct that the Court dismissed McClendon’s
WDBNL claim against non-Progress defendants for failure to allege that she “suffered harm
separate and unique from the damages wrought by the Data Breach itself,” [id. at 108], and that
this reasoning should also apply to McClendon’s analogous WDBNL allegations against
Progress, [CAC ¶¶ 1794–95]. Accordingly, McClendon’s WDBNL claim against Progress is
DISMISSED.
III. 	CONCLUSION
For the reasons stated above, Progress’s motion for partial reconsideration of MDL Order
No. 22 is DENIED IN PART and GRANTED IN PART. Specifically, the following claims
against Progress are DISMISSED: the PIPA and MITPA claims, insofar as Plaintiffs purport to
state an independent cause of action under those statutes; Rehm’s, Uhrich’s, and Plotke’s ICFA
claims premised on a PIPA violation; Dieck’s NCUDTPA claim premised on a NCITPA
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 9 of 10

10
violation; and McClendon’s WDBNL claim. Plotke’s ICFA claim premised on a PIPA violation
against Maximus is also DISMISSED.
SO ORDERED.
January 9, 2026 	/s/ Allison D. Burroughs
ALLISON D. BURROUGHS
U.S. DISTRICT JUDGE
Case 1:23-md-03083-ADB Document 1670 Filed 01/09/26 Page 10 of 10