January 18, 2022

Volume XII, Number 18


Colonial Pipeline Data Breach Litigations: Where Are We Now?

Earlier this year, CPW covered the Colonial Pipeline cyberattack and the two putative class actions filed in reaction to that cyberattack, (Dickerson v. CDCP Colonial Partners, L.P., Case No. 1:21-cv-02098 (N.D. Ga.and EZ Mart 1, LLC v. Colonial Pipeline Company, Case No. 1:21-cv-02522 (N.D. Ga.)).  Recall these putative class actions ensued after a ransomware attack carried out by cybercriminals crippled the Colonial Pipeline’s functionality.  The Pipeline was taken offline as a remedial measure, causing significant gasoline shortages across the Eastern United States.

Dickerson purports to represent a class of consumers who contend the paid higher prices at the pump as a result of the shutdown.  EZ Mart, in turn, purports to represent a class of gas stations that claim to have suffered fuel shortages or have paid excessively high prices for gas.  These consumers and gas stations are located on the east because the Colonial Pipeline supplies nearly half of the East Coast’s fuel supply.  In both Dickerson and EZ Mart, plaintiffs seek to hold Colonial Pipeline liable because it allegedly “failed to implement and maintain reasonable security measures, procedures, and practices appropriate” to its business.

Colonial Pipeline has moved to dismiss both putative class actions on similar grounds.  Colonial Pipeline has also moved to strike the class action allegations in both cases as representing purported “fail-safe” classes, arguing that ascertaining the classes would require ascertaining liability.

Colonial Pipeline moves to dismiss both suits in their entirety as preempted by the federal regulatory scheme for gas pipelines.  More interesting for this blog, however, is Colonial Pipeline’s effort to dismiss the negligence claims because Colonial Pipeline owes no duty to consumers or gas stations.  Colonial Pipeline explains that it does not bear duties customers so far removed from its work decrying the imposition of such a duty to prevent “economic ripple effects” as an being an “absurdity.”  Colonial Pipeline also seeks to bar plaintiffs’ claims based on the economic loss rule.

Plaintiffs, in turn, argue that their dependence on the pipeline gives rise to an ordinary duty of care. Plaintiffs add that this duty of care is non-contractual and, therefore, not barred by the economic loss rule.

The outcome of these cases – specifically the extent to which downstream duties can be implicated by data breaches – could have a major impact on the future of data privacy/cybersecurity litigation, and it will be important to keep an eye on any major developments.  

© Copyright 2022 Squire Patton Boggs (US) LLPNational Law Review, Volume XI, Number 323

About this Author

 Rafael Langer-Osuna Commercial Litigation Attorney Squire Patton Boggs San Francisco, CA & Miami, FL
Senior Associate

Rafael Langer-Osuna is a commercial litigator who tries cases. Rafael has significant experience litigating matters that turn on international relations and involve the foreign relations law of the US. How the law handles information – whether data privacy, the attorney-client privilege, online defamation or intellectual property – fascinates Rafael. Rafael often uses Spanish and a broad understanding of various legal cultures in representing foreign governments and multinational corporations in international disputes in US courts. These disputes often call upon Rafael to help coordinate...