Tort – Equitable indemnification – Data breach

Where a defendant in a suit over a data breach has moved for summary judgment on an equitable indemnification claim, that motion must be allowed because nothing in the record suggests that the parties shared any relationship recognized under Massachusetts law as giving rise to derivative or vicarious liability.

“This case arises out of a 2018 data breach that compromised the protected health information of more than 277,000 patients of Zoll Services LLC, a subsidiary of Zoll Medical (together, ‘Zoll’). Pending before the Court is the motion of defendant Barracuda Network, Inc. (‘Barracuda’) for summary judgment on three claims, which survived a motion to dismiss, brought by plaintiff Axis Insurance Co. (‘Axis’), as assignee of Zoll and subrogee of Fusion LLC (‘Fusion’). For the reasons that follow, the motion will be allowed. …

“… An equitable indemnification claim does not require proof of a contractual relationship between the parties. … Instead, it arises under equitable principals and is available where there is a ‘derivative or vicarious relationship’ between the indemnitor and indemnitee. … Derivative or vicarious liability can emerge only ‘because of the relationship between the two parties.’ …

“Here, nothing in the record suggests that Zoll and Barracuda shared any relationship recognized under Massachusetts law as giving rise to derivative or vicarious liability. The relationship at issue between Zoll and Barracuda can best be described as one of an independent contractor. As Barracuda contends, the [Original Equipment Manufacturer (OEM)] agreement between the parties established that Zoll operated as an independent contractor, not as an agent. While not dispositive, the inclusion of a provision that a party is an independent contractor is significant evidence that the parties’ relationship is as such. … Axis makes no claim that Zoll was anything more than an independent contractor to Barracuda.

“Barracuda’s status as an independent contractor with respect to Zoll fails to create derivative or vicarious liability to those with whom Barracuda contracts. …

“Axis likewise does not contend that Barracuda shared with Zoll any other form of recognized relationship that would create the derivative or vicarious liability necessary for a viable equitable indemnification claim. …

“Because the absence of a relationship that would legally give rise to vicarious or derivative liability negates Axis’s equitable indemnification claim, the Court need not address Barracuda’s argument that Axis cannot recover because Zoll lacked ‘clean hands.’ While the Court previously determined that Zoll had sufficiently pled that its fault was ‘vicarious in nature’ at the motion to dismiss stage, … the absence of evidence of such a relationship that would give rise to vicarious or derivative liability at the summary judgment stage is dispositive. …”

Axis Insurance Company v. Barracuda Networks, Inc., et al. (Lawyers Weekly No. 02-428-24) (16 pages) (Gorton, J.) (Civil Action No. 20-11997-NMG) (Sept. 9, 2024).

Click here to read the full text of the opinion.