ROACH, et al. vs CALIFORNIA STATE TEACHERS’ RETIREMENT SYSTEM (CALSTRS), et al.

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 11/15/2024 Hearing on Motion for Stay of Proceedings in Department 23

Tentative Ruling

NO APPEARANCE REQUIRED

Defendant California State Teachers Retirement System’s (“CalSTRS”) motion to stay proceedings is GRANTED as follows.

Overview

This is a consolidated putative class action brought against CalSTRS by Plaintiffs who are pensioners and beneficiaries of CalSTRs. This case involves a data breach. On or around May 23, 2023, unauthorized third parties were able to access certain files that CalSTRS shared with PBI Research Services/Berwyn Group (“PBI”). (Consolidated Complaint (“Complaint”) ¶ 3.) Plaintiffs and the putative class members’ private information was stored or transferred by CalSTRS using MOVEit software. (Id. at ¶ 6.)

MOVEit software contained a vulnerability in its code which led to numerous exposures of private data following a series of cyber-attacks against companies and government entities who used MOVEit to secure highly sensitive data. (Id. at ¶ 8.) Plaintiffs allege that CalSTRS negligently used MOVEit without industry-standard safeguards to transfer the highly sensitive data of CalSTRS members. (Ibid.) Plaintiffs further allege: “this case is not about MOVEit; this case is about CalSTRS.” (Id. at ¶ 9.)

Plaintiffs plead that CalSTRS had non-delegable duties to safeguard private information entrusted to it by Plaintiffs and the putative class members, including “a duty to transfer any Private Information to vendors according to cybersecurity industry standards and protocols and a duty to supervise and audit its vendors and the means by which those vendors store and transfer the Private Information.” (Ibid.) Plaintiffs allege CalSTRS breached these duties. (Id. at ¶ 19.) Plaintiffs assert the following causes of action in their consolidated complaint: (1) negligence; (2) negligence per se; (3) breach of implied contract; (4) breach of contract; (5) invasion of privacy; (6) violation of California’s Unfair Competition Law; (7) breach of confidence; (8) breach of implied or express covenant of good faith and fair dealing; (9) violation of California Consumer Privacy Act; (10) violation of the Customer Records Act; and (11) declaratory and injunctive relief.

As relevant to this motion, the MOVEit vulnerability led to hacks of hundreds of other organizations across the United States that affected over 55 million people. (Brown Decl. Ex. A (“MDL Transfer Order”) at pg. 2.) Consequently, individuals across the country brought hundreds of actions against PBI, Progress Software (“Progress”), and others. (Brown Decl. Exs. A, B, C, G.) It is undisputed that the Plaintiffs in this Action are included in several of these other actions based on their class definitions. (See e.g. id. at Ex. B, ¶ 36 & Ex. C, ¶ 38.) On October 4, 2023, the United States Judicial Panel on Multidistrict Litigation entered an order consolidating federal actions related to the MOVEit software and transferring them to the

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 11/15/2024 Hearing on Motion for Stay of Proceedings in Department 23

District of Massachusetts. (Id. at Ex. A.) The Panel stated:

All actions can be expected to share factual questions arising from allegations that a vulnerability in Progress Software Company’s MOVEit Transfer and MOVEit Cloud file transfer services was exploited by a Russian cybergang in May 2023, which to date is estimated to have compromised the personally identifying information (PII)4 of over 55 million people. On May 31, 2023, Progress posted a notice on its website stating it had discovered an SQL injection vulnerability in its MOVEit file transfer services and a related breach in its network and systems.

Plaintiffs are individuals whose PII was potentially compromised who bring largely overlapping putative nationwide or statewide class actions on behalf of persons impacted by the exploitation of the MOVEit software vulnerability. All actions can be expected to share common and complex factual questions as to how the MOVEit vulnerability occurred, the circumstances of the unauthorized access and data exfiltration, and Progress’s response to it, as well as the response of various downstream MOVEit users and customer-facing defendants with whom plaintiffs did business.

Centralization offers substantial opportunities to streamline pretrial proceedings; reduce duplicative discovery and conflicting pretrial obligations; prevent inconsistent rulings on common Daubert challenges and summary judgment motions; and conserve the resources of the parties, their counsel, and the judiciary. (MDL Transfer Order pgs. 2-3 [emphasis added].)

The Panel noted that some individual plaintiffs opposed transfer on the ground that there was no single breach, but successive breaches and multiple entities responded differently to the alleged intrusions. The Panel was not persuaded by this argument, stating: “Even if the MOVEit vulnerability led to successive breaches, Progress, direct users of MOVEit software, and customer-facing companies (many of whom did not use MOVEit software but instead contracted or subcontracted with a company that did) are alleged to be responsible for the compromise of plaintiffs’ PII and are named in varying combinations among the overlapping putative class actions.” (MDL Transfer Order pg. 3.)

The Panel also acknowledged the convenience-based arguments made by plaintiffs who only sued the defendant to which they entrusted their data but found that the arguments did not outweigh the benefits of centralization. (MDL Transfer Order pgs. 4-5.)

CalSTRS represents that the MDL Court ordered that a consolidated amended complaint be filed by December 6, 2024, that any Rule 12 motions to dismiss be fully briefed by March 28, 2025, and that oral argument on any such motions will be determined during a March status conference. (Reply 6:9-14.)

In this motion, CalSTRS asks the Court to stay this consolidated action for a period of at least six months to allow time to coordinate with the MDL and ensure consistent rulings between the two courts. Plaintiffs oppose.

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 11/15/2024 Hearing on Motion for Stay of Proceedings in Department 23

Discussion

The Court has the inherent authority to control the litigation before it to avoid conflicting rulings and unnecessary waste of parties’ and judicial resources. (Code Civ. Proc., § 128(a)(2), (8).) This authority includes the power “to stay an action when appropriate.” (Jordache Enters., Inc. v. Brobeck, Phleger & Harrison (1998) 18 Cal.4th 739, 758.) Courts consider the following factors when deciding whether to grant a stay: (1) “the possible damage which may result from the granting of a stay”, (2) “the hardship or inequity which a party may suffer in being required to go forward”, and (3) “the orderly course of justice measured in terms of the simplifying or complicating of issues, proof, and questions of law which could be expected to result from a stay.” (CMAX, Inc. v.

Hall (9th Cir. 1962) 300 F.2d 265, 268.) Courts have stayed actions in favor of a bellwether case because it can “winnow and sharpen not only discovery, but claims, defenses, calendaring decisions, motion practice, arguments, hearings or trial, adjudication, indeed every aspect of the litigation process – to the benefit of the parties, the court, and the public alike.” (See St. Paul Fire and Marine Ins. Co. v. AmerisourceBergen Co. (2022) 80 Cal.App.5th 1, 17.) A stay in favor of a bellwether case provides a benefit because that case can “educate the parties (whether or not the same) and the trial court about the issues and how to streamline the litigation here.” (Ibid.)

CalSTRS argues the MDL is a bellwether proceeding and a stay will promote efficiency in pleading challenges and discovery. As to pleading challenges, CalSTRS maintains that the MDL court’s resolution of Rule 12 motions will involve similar issues – whether plaintiffs have suffered concrete injuries and whether plaintiffs have adequately alleged negligence or statutory violations (including violations of California statutes at issue in this Action). (See Brown Decl. Exs. B & C.) CalSTRS argues the denial of a stay could lead to inconsistent rulings on these overlapping issues because CalSTRS intends to challenge the Complaint on similar grounds.

As to discovery, CalSTRS contends that this Action and the MDL will involve overlapping discovery. CalSTRS argues that third-party discovery will likely be critical “since the MOVEit incident occurred through an application designed by a non-party (Progress) and managed by another non-party (PBI).” (MPA 14:25-28.) Both PBI and Progress are parties to the MDL. Therefore, coordinating discovery with the MDL would lead to efficiency, avoid duplication, and provide cost-savings.

CalSTRS further asserts Plaintiffs would not be prejudiced by the brief stay because this litigation is in its infancy. CalSTRS has not yet responded to the presently operative compliant and no Party has served discovery requests. No substantive motions have been heard and there has not been a case management conference. In the MDL, numerous status conferences have been held and orders have been issued. (Brown Decl. Ex. K.) CalSTRS argues a stay would benefit all Parties because Plaintiffs could avoid the costs of inefficient pretrial discovery of inconsistent rulings. CalSTRS maintains that a stay could speed up resolution of this case if the

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 11/15/2024 Hearing on Motion for Stay of Proceedings in Department 23

MDL simplifies the issues in dispute and streamlines discovery.

Plaintiffs oppose this motion because CalSTRS is not a named defendant in any of the cases that are part of the MDL. Plaintiffs argue this case is distinct from the MDL cases because this case is only against CalSTRS based on duties CalSTRS owed that are independent of the issues in the MDL cases. Plaintiffs contend that a stay will not provide benefits for pleading challenges because the pleading challenges have involved Article III standing – which has no bearing here. Plaintiffs argue that the Rule 12 motions are only “tangentially connected to this case.” (Opp. 5:25-26.)

Plaintiffs maintain that because CalSTRS is not a party to any of the cases in the MDL, decisions on Rule 12 motions will have no impact on Plaintiffs claims against CalSTRS. As to discovery, Plaintiffs contend that they only plan to seek discovery from CalSTRS. Plaintiffs maintain they will be prejudiced by a stay based on the delay Plaintiffs would experience in litigating their claims.

On Reply, CalSTRS responds that while Plaintiffs may view this case as only involving CalSTRS, that does not mean CalSTRS views it the same way. CalSTRS intends to challenge the operative complaint on some of the same grounds as those currently before the MDL court. CalSTRS further notes that are is an overlap of parties because Plaintiffs are parties to some of the MDL cases. CalSTRS maintains that the MDL court’s ruling on Rule 12 motions will impact this proceeding because the Rule 12 motions involve theories of how injury was caused by the MOVEit incident.

CalSTRS can raise the same arguments in a demurrer where damages is an element of Plaintiffs’ claims. CalSTRS posits that decisions by the MDL court would be informative to the Parties and this Court. CalSTRS reiterates that the Panel considered similar arguments but found: “All actions can be expected to share common and complex factual questions as to how the MOVEit vulnerability occurred, the circumstances of the unauthorized access and data exfiltration, and Progress’s response to it, as well as the response of various downstream MOVEit users and customer-facing defendants with whom plaintiffs did business.” (MDL Transfer Order pgs. 2-3.)

As to discovery, CalSTRS argues PBI and Progress would be subject to discovery requests based on the factual basis for this Action. CalSTRS will subpoena Progress and PBI because they possess critical facts on how the MOVEit application was developed, how the data breach occurred, and what information was impacted.

The Court is persuaded that the stay requested is appropriate. While this Action is brought against CalSTRS only, it contains significant factual overlap with the MDL cases because all cases stem from the MOVEit software vulnerability. CalSTRS is correct that some of the MDL cases involve the same privacy statutes at issue in this case. The Court is persuaded that the resolution of Rule 12 motions could guide the parties in this Action. Further, the Court agrees that overlapping discovery issues exist given CalSTRS will seek information from PBI and Progress – parties to the MDL cases. The Court finds that the MDL court proceedings constitute bellwether proceedings. Accordingly, a stay would help to streamline this Action. The Court is not persuaded that the Plaintiffs would suffer prejudice from the brief stay proposed. Therefore,

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 11/15/2024 Hearing on Motion for Stay of Proceedings in Department 23

the motion is granted. This case is stayed until June 1, 2025, to allow resolution of the Rule 12 motions and for some discovery to take place in the MDL proceeding. A case management conference will take place in this Court after the stay is lifted.

Disposition

For the reasons stated above, CalSTRS’ motion to stay is GRANTED. This Action is STAYED until June 1, 2025. The Court sets a case management conference for June 27, 2025, in this department at 10:30 a.m. The Parties shall submit a joint case management conference statement no later than 15 days prior to the CMC.

To request oral argument on this matter, you must call Department 23 at 916-874-5754 by 4:00 p.m., the court day before this hearing and notification of oral argument must be made to the opposing party/counsel. If no call is made, the tentative ruling becomes the order of the court. (Local Rule 1.06.)

Please check your tentative ruling prior to the next Court date at www.saccourt.ca.gov prior to the above referenced hearing date.

If oral argument is requested, the parties may and are encouraged to appear by Zoom with the links below:

To join by Zoom Link - https://saccourt-ca-gov.zoomgov.com/my/sscdept23 To join by phone dial (833) 568-8864 ID 16108301121

Parties requesting services of a court reporter will need to arrange for private court reporter services at their own expense, pursuant to Government code section 68086 and California Rules of Court, Rule 2.956. Requirements for requesting a court reporter are listed in the Policy for Official Reporter Pro Tempore available on the Sacramento Superior Court website at https://www.saccourt.ca.gov/court-reporters/docs/crtrp-6a.pdf. Parties may contact Court- Approved Official Reporters Pro Tempore by utilizing the list of Court Approved Official Reporters Pro Tempore available at https://www.saccourt.ca.gov/court-reporters/docs/crtrp- 13.Pdf

A Stipulation and Appointment of Official Reporter Pro Tempore (CV/E-206) is required to be signed by each party, the private court reporter, and the Judge prior to the hearing, if not using a reporter from the Court’s Approved Official Reporter Pro Tempore list. Once the form is signed it must be filed with the clerk.

If a litigant has been granted a fee waiver and requests a court reporter, the party must submit a Request for Court Reporter by a Party with a Fee Waiver (CV/E-211) and it must be filed with

SUPERIOR COURT OF CALIFORNIA COUNTY OF SACRAMENTO

23CV004850: ROACH, et al. vs CALIFORNIA STATE TEACHERS' RETIREMENT SYSTEM (CALSTRS), et al. 11/15/2024 Hearing on Motion for Stay of Proceedings in Department 23

the clerk at least 10 days prior to the hearing or at the time the proceeding is scheduled if less than 10 days away. Once approved, the clerk will be forward the form to the Court Reporter’s Office and an official reporter will be provided.

Pursuant to California Rules of Court, rule 3.1312(a), no further written order is necessary. Counsel for CalSTRS is directed to notice all parties of this order.

The Court hereby stays the case in its entirety.

Case Management Conference is scheduled for 06/27/2025 at 10:30 AM in Department 23 at Gordon D. Schaber Superior Court.