Epiq Seeks Removal of Data Breach Class Action to Federal Court

On Wednesday, Epiq filed a notice to remove a class action lawsuit to the U.S. District Court for the Central District of California, as first reported by Legal Radar. The filing stemmed from a May suit in California state court alleging damages after Epiq's February ransomware attacks.

On May 26, Irvine, California-based Benjamin Karter filed a California Consumer Privacy Act (CCPA) violation class action lawsuit in the Superior Court of California, Orange County.

Karter alleged information stolen from Epiq's networks included nonencrypted and unredacted personal information and that Epiq failed to satisfy its duty to implement reasonable security procedures and practices as required by CCPA. Karter also claimed his Social Security number was on Epiq's network during the late February breach, which caused Epiq to shut down its systems for weeks.

While Karter was the only named plaintiff listed on his original filing and Epiq's notice of removal, Karter defined his class as all California residents whose unredacted and unencrypted personal information was compromised in the data breach affecting Epiq's networks in 2020.

Karter seeks statutory damages between $100-$750 per class member for each CCPA violation  or actual damages, whichever is greater. Karter also requested injunctive or declaratory relief and other relief the court deems "proper."

As a result of Epiq's February data breach, Karter alleged he and his class "face a lifetime risk of identity theft."

In its notice of removal, Epiq wrote it maintains data from over 50,000 California residents. As a result, applying the minimum statutory damages sought by Karter would exceed $5 million, Epiq said.

While Epiq denies all of Karter's allegations, the e-discovery and managed services provider argued removal to federal court was appropriate under the Class Action Fairness Act of 2005 (CAFA).

Under CAFA, proposed classes must have at least 100 members, and while Karter wrote the exact number of class members was "unknown," Epiq argued the class would exceed 50,000. Secondly, CAFA requires that any one member of the proposed class be a citizen of a state different from any defendant. Epiq noted Karter is a California resident and Epiq is a Missouri-corporation based in New York. Thus, the diversity of citizenship required for removal to federal court is met, the company wrote. 

Finally, Epiq said the aggregate amount in controversy must exceed $5 million for removal to federal court under CAFA. According to Epiq's filing, Karter's alleged liability and damage sought would exceed $5 million.

In a statement provided to Legaltech News, Epiq denied all of Karter's claims.

"We can state with confidence, based upon our own investigation as well as a complete forensic investigation and verification by our third-party consultant, Mandiant, that all allegations, including the allegation of any data exfiltration and including that of Mr. Karter's, during the event in February 2020 are baseless and without merit."

Karter's Aftergood Law Firm and Woodrow & Peluso counsel have not responded to request for comment.

Sign up for Law.com's Legal Radar to keep up with the latest news and lawsuits in a free, personalized news feed. Track technology litigation and who's getting the work by industry, practice area, law firm, company and region.