IN RE: MOVEit Customer Data Security Breach Litigation

UNITED STATES DISTRICT COURT
DISTRICT OF MASSACHUSETTS
IN RE: MOVEIT CUSTOMER DATA
SECURITY BREACH LITIGATION
This Document Relates To:
ALL CASES
MDL No. 1:23-md-03083-ADB-PGL
MDL Order No. 29
(PBI Bellwether Defendants’ Motion for Partial Reconsideration of the Court’s MDL
Order No. 23)
BURROUGHS, D.J.
Pension Benefit Information, LLC d/b/a PBI Research Services; Genworth Life and
Annuity Insurance Company; Genworth Life Insurance Company; Genworth Financial, Inc.
(together with Genworth Life and Annuity Insurance Company and Genworth Life Insurance
Company, “Genworth”); Milliman Inc. d/b/a Milliman Intelliscript, Inc.; Milliman Solutions,
LLC (together with Milliman Inc., “Milliman”); MEMBERS Life Insurance Company
(“MLIC”); and Teachers Insurance and Annuity Association of America (“TIAA”) (collectively,
“PBI Bellwether Defendants” or “PBI”) move for partial reconsideration of MDL Order No. 23,
[ECF No. 1517 (“Order No. 23”)]. [ECF Nos. 1548, 1549 (“Mem.”), 1598].
For the reasons stated below, PBI’s motion is GRANTED IN PART and DENIED IN
PART.
I. 	LEGAL STANDARD
“A federal district court has the discretion to reconsider interlocutory orders and revise or
amend them at any time prior to final judgment.” Davis v. Lehane, 89 F. Supp. 2d 142, 147 (D.
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 1 of 11

2
Mass. 2000) (first citing Bethlehem Steel Exp. Corp. v. Redondo Constr. Corp., 140 F.3d 319,
321 (1st Cir. 1998); and then citing Pérez-Ruiz v. Crespo-Guillén, 25 F.3d 40, 42 (1st Cir.
1994)); see also Fed. R. Civ. P. 54(b) (“[A]ny order or other decision . . . that adjudicates fewer
than all the claims or the rights and liabilities of fewer than all the parties . . . may be revised at
any time before the entry of a judgment . . . .”); Fernández-Vargas v. Pfizer, 522 F.3d 55, 61 n.2
(1st Cir. 2008) (“[A] district court has the inherent power to reconsider its interlocutory orders,
and we encourage it to do so where error is apparent.” (citing Warren v. American Bankers Ins.,
507 F.3d 1239, 1243 (10th Cir. 2007))); Pérez-Ruiz, 25 F.3d at 42 (1st Cir. 1994) (“Interlocutory
orders, including denials of motions to dismiss, remain open to trial court reconsideration, and do
not constitute the law of the case.” (citing Union Mut. Life Ins. Co. v. Chrysler Corp., 793 F.2d
1, 15 (1st Cir. 1986))).
At the same time, while “[a] court has the power to revisit prior decisions . . . in any
circumstance, . . . as a rule courts should be loathe to do so in the absence of extraordinary
circumstances such as where the initial decision was ‘clearly erroneous and would work a
manifest injustice.’” Christianson v. Colt Indus. Operating Corp., 486 U.S. 800, 817 (1988)
(quoting Arizona v. California, 460 U.S. 605, 618 n.8 (1983)). “When faced with a motion for
reconsideration,” in essence, “a district court must balance the need for finality against the duty
to render just decisions.” Davis, 89 F. Supp. 2d at 147 (citing McCoy v. Macon Water Auth.,
966 F. Supp. 1209, 1222 (M.D. Ga. 1997)). “In order to accommodate these competing interests,
a court should grant a motion for reconsideration of an interlocutory order only when the movant
demonstrates (1) an intervening change in the law; (2) the discovery of new evidence not
previously available; or (3) a clear error of law in the first order.” Id. (first citing McCoy, 966 F.
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 2 of 11

3
Supp. at 1222–23; and then citing 18 Wright & Miller’s Federal Practice & Procedure § 4478
(1981)).
Additionally, under Federal Rule of Civil Procedure 60(a), a court “may correct a clerical
mistake or a mistake arising from oversight or omission whenever one is found in a judgment,
order, or other part of the record,” and “[t]he court may do so on motion or on its own, with or
without notice.” Fed. R. Civ. P. 60(a). Rule 60(a) is applicable “where . . . ‘the judgment failed
to reflect the court’s intention.’” Bowen Inv., Inc. v. Carneiro Donuts, Inc., 490 F.3d 27, 29 (1st
Cir. 2007) (quoting Morgan Guar. Tr. Co. of N.Y. v. Third Nat’l Bank of Hampden Cnty., 545
F.2d 758, 759–60 (1st Cir. 1976)).
II. 	DISCUSSION
A. 	Implied contract claims
1. 	Implied contract claims against TIAA, MLIC, and Genworth
Under the Court’s choice-of-law determinations, Bellwether Plaintiffs’ implied contract
claims against TIAA, MLIC, and Genworth are governed by California, Florida, New York,
Texas, and Wisconsin law. See [Order No. 23 at 14 (holding that New York law applies to
common law claims against TIAA; Wisconsin law applies to common law claims against MLIC;
and Texas, New York, Florida, and California law apply to common law claims against
Genworth1)]. PBI argues on reconsideration that in every one of these states, the existence of an
express contract between parties forecloses implied contract claims involving those parties, and
therefore the Court should have granted PBI’s motion to dismiss all of Plaintiffs’ implied
1 The Court also incorrectly stated in Order No. 23 that Virginia law applies to certain claims
against Genworth, and that error is corrected here. See discussion infra Section II.G.
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 3 of 11

4
contract claims against TIAA, MLIC, and Genworth. [Mem. at 8–10]. While PBI may
ultimately prevail on this principle in some or all of the relevant jurisdictions, the Court will not
find that it made “a clear error of law” warranting reconsideration, Davis, 89 F. Supp. 2d at 147,
simply because it relied on a case decided under D.C. substantive law in denying PBI’s motion to
dismiss as set forth in Order No. 23,2 see [Mem. at 9–10].
Although approaches vary by jurisdiction, generally speaking, recovery on a theory of
implied contract is ultimately foreclosed when there are express terms governing the same
subject matter. See, e.g., Wal-Noon Corp. v. Hill, 119 Cal. Rptr. 646, 650 (Ct. App. 1975)
(“There cannot be a valid, express contract and an implied contract, each embracing the same
subject matter, existing at the same time.”). At this stage, particularly where the Court is still
“without the benefit of seeing the contracts” underlying Plaintiffs’ breach of contract/third-party
beneficiary claims, [Order No. 23 at 39], the Court assumes there may be “additional, implied
terms ‘inferred from the conduct of the parties in the milieu in which they dealt.’” Attias, 2023
WL 5952052, at *5 (emphasis added) (quoting Emerine v. Yancey, 680 A.2d 1380, 1383 (D.C.
1996). Accordingly, PBI’s motion to reconsider Order No. 23 as to the implied contract claims
against TIAA, MLIC, and Genworth is DENIED.
2. 	Implied contract claim against Milliman
PBI also asks the Court to dismiss Plaintiff Jose Soto’s implied contract claim against
Milliman. [Mem. at 10]. PBI is correct that in Order No. 23, the Court “agreed with the
2 The Court reasoned that “the existence of a written contract is not dispositive as to the
existence of implied contractual terms.” [Order No. 23 at 32 (citing Attias v. CareFirst, Inc., No.
15-cv-00882, 2023 WL 5952052, at *5 (D.D.C. Sept. 13, 2023))].
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 4 of 11

5
Milliman Defendants that Plaintiff Soto could not plead a viable implied contract claim against
them,” [id.], reasoning:
The Milliman Defendants argue that there could be no meeting of the minds with
Plaintiff Soto because he was a customer of MLIC, which separately contracted
with Milliman, and therefore neither party knew of the other’s existence. 	Soto’s
rejoinder is that this raises a premature factual dispute. The Court disagrees: the
basis of Plaintiffs’ argument is that handing over data to a company creates an
implicit agreement to protect that data, and there is no allegation that Soto
knowingly gave Milliman his information.
[Order No. 23 at 32 (citations omitted)]. The Court unintentionally omitted its conclusion: that
Soto’s implied contract claim against Milliman is, accordingly, DISMISSED.
B. 	Minnesota Uniform Deceptive Trade Practices Act
PBI asks the Court to dismiss Bellwether Plaintiffs’ Minnesota Uniform Deceptive Trade
Practices Act (“MUDTPA”) claim for lack of statutory standing. [Mem. at 10–13]. PBI argues
that, in denying PBI’s motion to dismiss the MUDTPA claim, “the Court rejected PBI
Bellwether Defendants’ ‘[s]tatutory standing argument[,]’ because it believed the argument is
‘squarely foreclosed by’ the class certification decision in In re Asacol Antitrust Litig., 907 F.3d
42, 49 (1st Cir. 2018),” and that this was manifest error because “Asacol involves only Article III
standing, not statutory standing.” [Id. at 11 (quoting Order No. 23 at 45)].
The First Circuit established in In re Asacol that named plaintiffs may have Article III
standing to sue on behalf of a putative class bringing “materially identical claims” under multiple
states’ laws, even when the named plaintiffs have not established statutory standing as to every
one of those claims. 907 F.3d at 47–51 (reasoning that “the fact that judgments for some class
members will nevertheless enter under the laws of states other than the states under which any of
the class representatives’ judgments will enter, where those laws are materially the same, has no
relevant bearing on the personal stake of the named plaintiffs in litigating the case to secure such
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 5 of 11

6
judgments,” and rejecting defendants’ objection that each state “appl[ies] their relevant law only
to claims that arise out of purchases made within the state or by state residents”).
In this jurisdiction and others, statutory standing issues need not be resolved at the
motion-to-dismiss stage, because they are distinct from the constitutional standing requirement
and more properly addressed during class certification. See, e.g., id. at 49 (“Requiring that the
claims of the class representative be in all respects identical to those of each class member in
order to establish standing would ‘confuse[] the requirements of Article III and Rule 23.’”
(quoting Fallick v. Nationwide Mut. Ins. Co., 162 F.3d 410, 421 (6th Cir. 1998))); Langan v.
Johnson & Johnson Consumer Companies, Inc., 897 F.3d 88, 95 (2d Cir. 2018) (“Th[e] approach
of considering variations in state laws as questions of predominance under Rule 23(b)(3), rather
than standing under Article III, makes sense. For one, it acknowledges the obvious truth that
class actions necessarily involve plaintiffs litigating injuries that they themselves would not have
standing to litigate.”); Morrison v. YTB Int’l, Inc., 649 F.3d 533, 536 (7th Cir. 2011) (“If the
Illinois Consumer Fraud Act law does not apply because events were centered outside Illinois,
then plaintiffs must rely on some other state’s law; this application of choice-of-law principles
has nothing to do with standing, though it may affect whether a class should be certified—for a
class action arising under the consumer-fraud laws of all 50 states may not be manageable, even
though an action under one state’s law could be.”).
As the Court explained in Order No. 23, Plaintiffs were required only to plausibly allege
Article III standing at the motion-to-dismiss stage, and the Court found in MDL Order No. 19
that they did. [Order No. 23 at 46]; see generally [ECF No. 1304].
Accordingly, PBI’s motion to reconsider Order No. 23 as to the MUDTPA claim is
DENIED.
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 6 of 11

7
C. 	Massachusetts General Laws Chapter 93A
PBI asks the Court to dismiss Bellwether Plaintiffs’ claims under Massachusetts General
Laws Chapter 93A (“Chapter 93A”), asserting that “[i]n addition to the PBI Bellwether
Defendants having briefly contested statutory standing, the Court overlooked that they separately
argued that choice-of-law holdings by the First Circuit and other judges in this District require
dismissal.” [Mem. at 13]. Specifically, PBI argues that in its motion-to-dismiss filings, [ECF
Nos. 1360 at 60–61 & n.27, 1467 at 26–27 & n.38], it “cited caselaw holding directly” under
Massachusetts choice-of-law principles “that nationwide classes cannot maintain claims under
Section 9 of Chapter 93A.” [Mem. at 13–15].
Plaintiffs accurately respond that even though PBI did provide citations to such cases, it
did so in support of its arguments related to the statutory standing issue, and did not develop any
arguments concerning the distinct choice-of-law issue.3 [ECF No. 1570 (“Pls. Opp.”) at 13–14];
see [ECF No. 1360 at 59–60 (discussing “Lack of Statutory Standing”)].
Generally, “motions for reconsideration are ‘not the venue to . . . permit a party to
advance arguments it should have developed prior to judgment,’” Skinner, Inc. v. Li, No. 20-cv-
11402, 2023 WL 4409827, at *5 n.9 (D. Mass. July 7, 2023) (quoting In re Buscone, 61 F.4th 10,
35 (1st Cir. 2023)), and a party’s citation of case law in support of some other proposition is not
enough to raise an issue. Further, PBI will be able to raise the choice-of-law issue at class
3 Highlighting the distinction between the issues, Plaintiffs additionally argue that “[i]n fact,
Defendants even encouraged the Court to skip a choice of law analysis with respect to the Ch.
93A claim (and other statutory claims) because ‘courts often forego reciting a fulsome choice-of-
law analysis and skip directly to the familiar result [under the statutory standing analysis] – that
each plaintiff’s consumer-protection claim must be brought under their own state’s statute.’”
[Pls. Opp. at 14 (quoting ECF No. 1360 at 59 n.26)].
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 7 of 11

8
certification. Compare In re LastPass Data Sec. Incident Litig., 742 F. Supp. 3d 109, 117 n.1,
131 (D. Mass. 2024) (denying motion to dismiss Chapter 93A claims brought “on behalf of a
nationwide class and a Massachusetts subclass”), with Ortiz v. Saba Univ. Sch. of Med., 348
F.R.D. 4, 15–16 (D. Mass. 2024) (declining to certify and “apply[] Chapter 93A broadly to a
nationwide class” only after “conducting a comprehensive, functional choice-of-law analysis”).
Accordingly, PBI’s motion to reconsider Order No. 23 as to the Chapter 93A claims is DENIED.
D. 	Claims seeking declaratory judgment and injunctive relief
PBI asks the Court to dismiss Bellwether Plaintiffs’ claims under the MUDTPA,
California Unfair Competition Law, Illinois Uniform Deceptive Trade Practices Act
(“IUDTPA”), and Declaratory Judgment Act on the basis that “[t]he Court overlooked PBI
Bellwether Defendants’ . . . argument that Plaintiffs pled no facts regarding PBI Bellwether
Defendants’ current information security or any other imminent threat to Plaintiffs, sufficient to
demonstrate the required present risk of harm ‘of sufficient immediacy and reality to warrant the
issuance of a declaratory judgment.’” See [Mem. at 15–16 (quoting In re Fin. Oversight &
Mgmt. Bd. for P.R., 919 F.3d 638, 645 (1st Cir. 2019))].
PBI’s request for reconsideration on this basis is DENIED,4 because reconsideration is
not “‘a mechanism to regurgitate old arguments previously considered and rejected,’” Li, 2023
WL 4409827, at *5 n.9 (quoting In re Buscone, 61 F.4th at 35). As Plaintiffs note, “the Court
explicitly recognized [in Order No. 23] that the inadequacy of Defendants’ current data security
practices is supported by Plaintiffs’ well-pleaded factual allegations.” [Pls. Opp. at 17 (citing
4 This Order dismisses the IUDTPA claim against PBI on different grounds. See infra Section
II.E.
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 8 of 11

9
Order No. 23 at 59 (“Plaintiffs specifically allege that PBI has not improved its
cybersecurity . . . .”), 116 (“An allegation of ‘continued inadequacy of [a] Defendant[’s] security
measures’ suffices to support a claim for declaratory judgment in a data breach case.” (quoting In
re Unite Here Data Sec. Incident Litig., 740 F. Supp. 3d 364, 388 (S.D.N.Y. 2024))))].
E. 	Illinois Uniform Deceptive Trade Practices Act
PBI asks the Court to dismiss the IUDTPA claim against it, accurately stating that “PBI
Bellwether Defendants argued in their motion to dismiss that Plaintiffs’ allegations under the
[IUDTPA] fail to satisfy the heightened pleading requirements of Rule 9(b)” and that “[t]he
Court never addressed this argument” in Order No. 23. See [Mem. at 16–17]; [ECF No. 1360 at
62–63 & n.33].
In Order No. 25 concerning Maximus Bellwether Defendants’ (“Maximus’s”) analogous
request, the Court stated that it unintentionally omitted a ruling on Maximus’s IUDTPA claim
from Order No. 23, and had intended to dismiss the claim “under the same reasoning applied to
[OSF Healthcare System (“OSF”)].” [ECF No. 1618 at 5]. Likewise, the Court unintentionally
omitted a ruling on PBI’s IUDTPA claim and had intended to dismiss that claim under the same
reasoning. See [Order No. 23 at 77–78 (applying Rule 9(b)’s heightened pleading standard to
the IUDTPA claim against OSF and dismissing the claim for failure to meet that standard)].
Accordingly, the IUDTPA claim against the PBI Bellwether Defendants is DISMISSED.
F. 	Negligence and negligence per se claims
PBI asks the Court to dismiss Plaintiff Soto’s negligence and negligence per se claims
against MLIC. [Mem. at 17–19]. Maintaining that MLIC is not a Vendor Contracting Entity
(“VCE”) that engaged PBI but instead a Vendor Contracting Entity Customer (“VCEC”) that
engaged Milliman, [id. at 17–18], PBI argues that the Court “mistakenly found” that MLIC is
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 9 of 11

10
one of PBI’s clients and that this error warrants reconsideration because it “formed the entire
basis for its ruling as to these negligence-based claims.” [Id. at 17–19]. PBI does not identify
any “clear error of law” that would warrant reconsideration of either Soto’s negligence or
negligence per se claims against MLIC, Davis, 89 F. Supp. 2d at 147, and instead “regurgitate[s]
old arguments previously considered and rejected,” Li, 2023 WL 4409827, at *5 n.9 (quoting In
re Buscone, 61 F.4th at 25). PBI’s motion as to Soto’s negligence and negligence per se claims
against MLIC is accordingly DENIED, and the Court’s rulings in Order No. 23 remain
unchanged as to both claims, although two clarifications are in order.
First, Order No. 23 lists MLIC as a client of PBI5 because, at this stage of the
proceedings, it accepts as true Plaintiffs’ allegations6 that “all PBI-Contracting Defendants used
PBI as their vendor, either directly or indirectly, and in the ordinary course of their business
shared, transmitted, or otherwise maintained their customers’ highly sensitive information with
PBI or otherwise made it accessible to PBI through MOVEit . . . .” [ECF No. 1332 (“CAC”) ¶
1824]. Second, the Court’s reasoning under the heading “VCE Duties” in Section III.b.ii.1.b of
Order No. 23 does apply to and include VCEC MLIC. [Order No. 23 at 18–19]. Plaintiffs are
correct that, in this section, “the Court did not need to distinguish MLIC (a VCEC) from VCEs
because MLIC engaged in the same dispositive conduct as the other VCEs.” [Pls. Opp. at 20].
G. 	The Burgan Plaintiffs’ claims
The Court held in Order No. 23 that Virginia law governs the common law claims
brought by PBI Bellwether Plaintiffs Camille and Eugene Burgan (together, “the Burgans”).
5 The Court states, “Several of PBI’s clients—Genworth, GLAIC, GLIC, TIAA, Milliman, and
MLIC—are part of the current bellwether litigation.” [Order No. 23 at 4–5].
6 United States ex rel. Hutcheson v. Blackstone Med., Inc., 647 F.3d 377, 383 (1st Cir. 2011).
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 10 of 11

11
[Order No. 23 at 14]. The parties now agree that, instead, “California law applies to the Burgan
Plaintiffs’ claims and . . . the Court should reach the same result on the Burgans’ claims as it did
for other plaintiffs.” [Pls. Opp. at 21].
The parties are correct that the Court made “a clear error of law,” Davis, 89 F. Supp. 2d
at 147, in applying Virginia law to the Burgans’ negligence per se claims, because the claims are
governed by Virginia choice-of-law rules, [Order No. 23 at 13 (transferring the Burgans’ claims
to the Eastern District of Virginia)], and are therefore “governed by the laws of the place of
injury and the relevant Plaintiffs’ respective home states,” [ECF No. 1516 at 16 (explaining
Virginia’s lex loci delicti test)]. The Burgans are California residents, [CAC ¶¶ 678, 696], and
so, consistent with the Court’s ruling as to the negligence per se claims governed by California
law, [Order No. 23 at 22–23], the Burgans’ negligence per se claims are DISMISSED.
Additionally, the Court confirms that Order No. 23 dismissed the Burgans’ California Consumer
Privacy Act, California Customer Records Act, and California Legal Remedies Act claims
against Genworth.
III. 	CONCLUSION
For the reasons stated above, PBI’s motion for partial reconsideration of MDL Order No.
23 is DENIED IN PART and GRANTED IN PART. Specifically, Soto’s implied contract
claim against Milliman, the IUDTPA claim against the PBI Bellwether Defendants, and the
Burgans’ negligence per se claims against the PBI Bellwether Defendants are DISMISSED.
SO ORDERED.
January 9, 2026 	/s/ Allison D. Burroughs
ALLISON D. BURROUGHS
U.S. DISTRICT JUDGE
Case 1:23-md-03083-ADB Document 1671 Filed 01/09/26 Page 11 of 11