Geico is working to have two out of five class actions stemming from the insurer’s data breach moved to New York federal court where the other three cases are located, with the judge overseeing those three cases approving their consolidation Friday.
Geico is facing five proposed class actions stemming from a data breach in which attackers used illegally obtained personal data to gain unauthorized access to the insurer’s online sales system between January and March.
The plaintiffs who brought the three suits in the Eastern District of New York have until Oct. 25 to file to consolidate the suits, U.S. District Judge Kiyo Matsumoto said, adding that the suits would be stayed until Nov. 5 to allow other cases to potentially be transferred to the court.
Geico told the court Wednesday it was in discussions with representatives of the other two suits — one in Maryland and the other in California — to have those cases transferred.
The five proposed class actions all stem from a data breach in which attackers used illegally obtained personal data to gain unauthorized access to the insurer’s online sales system between January and March. Geico announced the data breach in April; according to the insurer, about 150,000 individuals were affected.
The insurer told the court that it was “optimistic” that representatives of the Maryland case would agree to transfer their case to New York, saying it would try to reach an agreement with the Maryland plaintiffs and request a transfer by Oct. 30.
Discussions with the representatives of the California case, who were the lone opponents of Geico’s unsuccessful bid to have the cases centralized in a multidistrict litigation process, are “ongoing,” Geico told the court. The insurer said it would seek some kind of relief, be it transfer, dismissal or other relief, from the California court currently handling the case by Nov. 5, depending on the actions of the California plaintiffs.
The first of the five suits filed in reaction to the breach was brought by Alexander Mirvis, Betty Butler and Lainie Froehlich on April 21, claiming that Geico and its parent company, Berkshire Hathaway Inc., could have prevented the data breach through basic security measures, authentications and training. The other two New York suits were filed by Raquel Brody and Michael Viscardi.
The suit in the District of Maryland was filed by Ryant Connelly and Belen Perez. California couple Mark Edward Vennerholm and Reanna Ann Vennerholm filed the California action.
Geico moved in July to centralize the five suits through a multidistrict litigation proceeding, saying it would reduce costs and prevent inconsistent pretrial rulings. The insurer suggested New York as the preferred location, saying that was where the majority of the lawsuits are pending. Additionally, about 85% of the affected individuals were in New York, Geico said.
Geico also suggested Maryland as an alternative location. As the district is Geico’s principal place of business, databases, witnesses and other important information are likely to be located there, easing the process of litigation, the insurer said.
While the New York and Maryland plaintiffs had supported centralization in their respective districts, the California plaintiffs opposed it, saying they were pursuing a unique state-law-based claim that made centralization unsuitable. According to the Vennerholms, their case alleges a claim against Geico under the California Consumer Privacy Act, which does not have comparable statutes in other states.
Under the state law, the California plaintiffs can assert damages against Geico if they can show they provided the insurer written notice of its violation of the law and that the insurer failed to rectify the violation within 30 days of the notice.
The Judicial Panel on Multidistrict Litigation denied Geico’s bid for centralization on Oct. 5. There were only five cases and three districts involved in the litigation, meaning that informal coordination among the parties and courts “appears eminently feasible,” the panel said.
Marc Held, counsel for the Mirvis plaintiffs, told Law360 he was pleased with the court’s approval of consolidation.
“In the end, it remains our goal to uncover the extent of the massive data breach of our clients’ personal information, make sure this does not happen again and to bring justice to all of the victims,” Held told Law360.
Representatives of Geico and the rest of the proposed class action plaintiffs did not respond to requests for comment.
Geico is represented by John Marino and Kristen Wenger of Smith Gambrell & Russell LLP, and Shari Lewis, Barry Levy and Amanda Gurman of Rivkin Radler LLP.
The Vennerholm plaintiffs are represented by Michael Murphy, Franklin Azar, Andrew Stolper and Brian Hanlin of Franklin D. Azar & Associates PC.
The Connelly and Perez plaintiffs are represented by Michelle Drake of Berger Montague PC.
The Viscardi plaintiffs are represented by Tina Wolfson of Ahdoot & Wolfson PC.
The Butler, Mirvis and Froehlich plaintiffs are represented by Marc. J. Held and Philip Hines of Held & Hines LLP.
The Brody plaintiffs are represented by Melissa Emert and Gary Graifman of Kantrowitz Goldhamer & Graifman.
The New York cases are Mirvis et al. v. Berkshire Hathaway Inc. et al., case number 1:21-cv-2210; Brody et al. v. Berkshire Hathaway Inc. et al., case number 1:21-cv-2481; and Viscardi et al. v. Government Employees Insurance Co. et al., case number 1:21-cv-2580, in the U.S. District Court for the Eastern District of New York.
The Maryland case is Connelly et al. v. Berkshire Hathaway Inc. et al., case number 21-cv-1152, in the U.S. District Court for the District of Maryland. The California case is Vennerholm v. GEICO Casualty Co. et al., case number 21-cv-806, in the U.S. District Court for the Southern District of California.
–Additional reporting by Daphne Zhang and Lauren Berg. Editing by Nick Petruncio.
