September 29, 2022

Volume XII, Number 272


September 28, 2022

Subscribe to Latest Legal News and Analysis

September 27, 2022

Subscribe to Latest Legal News and Analysis

September 26, 2022

Subscribe to Latest Legal News and Analysis

After TransUnion Standing Decision, District Court Allows Blackbaud MDL to Go Forward

CPW has previously covered In re Blackbaud, a data privacy multi-district litigation (“MDL”) created in December 2020 that is currently pending in the District of South Carolina.  The MDL was created to manage the claims of individuals and putative class representatives against Blackbaud, a cloud software company that was targeted in several ransomware attacks between February and May 2020.  In its most recent opinion, the court denied Blackbaud’s motion to dismiss for lack of subject matter jurisdiction and allowed plaintiffs’ claims to proceed, finding that plaintiffs had sufficiently alleged Article III standing.  Read on to learn how it all played out.

To maintain a lawsuit in federal court, a plaintiff must establish standing under Article III of the Constitution by alleging: (1) an injury in fact; (2) that is fairly traceable to defendant’s conduct; and (3) that could likely be redressed by a favorable judicial decision.  Blackbaud had argued that plaintiffs had not sufficiently established the second element, i.e. that plaintiffs’ injuries were not fairly traceable to Blackbaud’s conduct.  Blackbaud raised both factual and facial challenges to the traceability requirement, but the court declined to consider Blackbaud’s factual challenge, finding that the facts needed to prove that element were too intertwined with the facts needed to prove the merits of plaintiffs’ claims.

With respect to Blackbaud’s facial challenge to plaintiffs’ standing, however, the court found that plaintiffs had met their obligation to sufficiently allege that the defendant was a plausible source of disclosure of their personal information.  Op. at 3 (“To survive a facial challenge to Article III standing, “a complaint must contain sufficient factual matter, accepted as true, ‘to state a claim to relief that is plausible on its face.’”).  The opinion noted that there was a plausible connection between the types of data alleged to have been compromised in the ransomware attacks and the plaintiffs’ subsequent injuries, which included an increase in spam and phishing.  It also observed that, because Blackbaud had not been transparent about the extent of the ransomware attacks, it was likely that additional types of personal information may have been compromised.  The same was true for the data incidents involved in the MDL, as each plaintiff alleged harm less than a year after the incidents in question.

This ruling helps to illustrate the bounds of the Supreme Court’s groundbreaking decision in TransUnion v. Ramirez, which held that Article III standing requires allegations of a concrete injury in addition to a statutory violation.  Plaintiffs’ claims were allowed to survive here in part because of the specific allegations they raised concerning the injuries and harm they had suffered, which included identity theft and fraud, diminished value of data, and invasion of privacy, among others.

Of course, whether a plaintiff pleads injury for purposes of Article III standing is a wholly separate issue from whether a complaint raises a viable cause of action (and alleges sufficient injury for purposes of pleading cognizable damages).

© Copyright 2022 Squire Patton Boggs (US) LLPNational Law Review, Volume XI, Number 188

About this Author

Christina Lamoureux Litigation Attorney Squire Patton Boggs Washington DC

Christina Lamoureux is an associate in the Litigation Practice in the Washington DC office. She represents a wide variety of clients in complex commercial matters.


  • District of Columbia, 2020

Related Services

  • Litigation
Kristin L. Bryan Litigation Attorney Squire Patton Boggs Cleveland, OH & New York, NY
Senior Associate

Kristin Bryan is a litigator experienced in the efficient resolution of contract, commercial and complex business disputes, including multidistrict litigation and putative class actions, in courts nationwide.

She has successfully represented Fortune 15 clients in high-stakes cases involving a wide range of subject matters.

As a natural extension of her experience litigating data privacy disputes, Kristin is also experienced in providing business-oriented privacy advice to a wide range of clients, with a particular focus on companies handling customers’ personal data. In this...