Court Opinion

ID: 9954916
Source: CourtListenerOpinion
Date Created: 2024-03-27 14:02:09.422928+00
Date Added: 2024-06-11T08:15:06.025779
License: Public Domain

IN THE SUPERIOR COURT OF THE STATE OF DELAWARE

TRAVELERS CASUALTY AND              )
SURETY COMPANY OF AMERICA,          )
                                    )
          Plaintiff,                ) C.A. No. N22C-12-130 KMM
                                    )
     v.                             )
                                    )
BLACKBAUD, INC.                     )
                                    )
          Defendant.                )
___________________________________ )
                                    )
PHILADELPHIA INDEMNITY              )
INSURANCE COMPANY, GREAT            )
AMERICAN INSURANCE COMPANY, )
GREAT AMERICAN SPIRIT               )
INSURANCE COMPANY, GREAT            ) C.A. No. N22C-12-141 KMM
AMERICAN ALLIANCE INSURANCE         )
COMPANY, ACADIA INSURANCE           )
COMPANY, UNION INSURANCE            )
COMPANY,                            )
                                    )
          Plaintiffs,               )
                                    )
     v.                             )
                                    )
BLACKBAUD, INC.,                    )
                                    )
          Defendant.                )

                   Date Submitted: January 9, 2024
                    Date Decided: March 27, 2024
 Blackbaud, Inc.’s Motion to Dismiss and Motion for Judgment on the Pleadings
                                 GRANTED.

                 MEMORANDUM OPINION AND ORDER

Wade A. Adams, Esquire, Law Offices of Wade A. Adams, III, 111 Continental
Drive Suite 309, Newark, Delaware 19713; Kenneth T. Levine, Esquire (argued),
de Luca Levine LLC, 301 E. Germantown Pike, 3 rd Floor, East Norriton,
Pennsylvania 19401, Attorneys for Plaintiff Travelers Casualty and Surety Company
of America.

Lisa C. McLaughlin, Esquire, Todd L. Goodman, Esquire, Phillips, McLaughlin &
Hall, P.A., 1200 North Broom Street, Wilmington, Delaware 19806; Kenneth T.
Levine, Esquire (argued), de Luca Levine LLC, 301 East Germantown Pike, 3rd
Floor, East Norriton, Pennsylvania 19401, Attorneys for Plaintiffs Philadelphia
Indemnity Insurance Company, Great American Insurance Company, Great
American Spirit Insurance Company, Great American Alliance Insurance Company,
Acadia Insurance Company, and Union Insurance Company.

John P. DiTomo, Esquire, Emily C. Friedman, Esquire, Morris, Nichols, Arsht &
Tunnell LLP, 1201 North Market Street, Wilmington, Delaware 19801; Sarah Fulton
Hutchins, Esquire (argued), Parker Poe Adams & Bernstein LLP, 620 South Tyron
Street, Suite 800, Charlotte, North Carolina 28202; Corri A. Hopkins, Esquire,
Parker Poe Adams & Bernstein LLP, 301 Fayetteville Street, Suite 1400, Raleigh,
North Carolina 27601, Attorneys for Defendant Blackbaud, Inc.

Miller, J.
                                        Introduction

       Blackbaud, Inc. (“Blackbaud”) is an application service provider that offers

data hosting services to its customers, including nonprofit entities. In early 2020,

Blackbaud was the target of a ransomware attack and later notified customers of the

incident. In response to the notice, it is alleged, several nonprofit-customers were

required to undertake investigative and remediation steps to comply with “numerous

state and federal statutes and regulations.” Relevant here, certain nonprofits were

covered by insurance policies issued by Travelers Casualty and Surety Company of

America (“Travelers”), or Philadelphia Indemnity Insurance Company, Great

American Spirit Insurance Company, Great American Alliance Insurance Company,

or Union Insurance Company (collectively, “Philadelphia Indemnity”1 and with

Travelers, the “Insurers”).

       The Insurers paid the claims of their nonprofit-insureds for these investigative

and remediation steps. As subrogees, Travelers and Philadelphia Indemnity each

filed an action against Blackbaud for breach of contract and negligence, seeking to

recover the amounts paid to their insureds, plus an award of attorneys’ fees. The

actions are essentially identical, except for the identities of the Insurers and the

1
  Great American Insurance Company (“GAIC”) is also a named plaintiff. However, plaintiffs’
counsel agreed that GAIC did not insure any of the non-profits at issue here. Therefore, judgment
is entered against GAIC.

                                               1
insureds, and the amount sought. Therefore, the cases are being addressed together

here.

        Blackbaud filed an amended answer to each complaint and moved to dismiss,

arguing that the Insurers lacked standing because they failed to allege a concrete

harm; that is, the Insurers do not assert that any of the insureds’ information was

accessed or misused. To be sure, courts around the country have come to different

conclusions on standing where a plaintiff received notice that its data may have been

the subject of an attack, but it had not suffered actual misuse of its data.2 The Court

does not need to make a determination of standing under these cases because under

Delaware law, where, as here, the challenge to standing is closely related to the

defendant’s challenge to the merits of the claim, standing will be addressed under

Rule 12(b)(6).

        While Delaware’s pleading standard is minimal, conclusory allegations are

not sufficient. The Insurers’ breach of contract claims are based on circular and

conclusory allegations. Essentially, their contract claims rests on the theory that

2
  See In re Marriott Int’l, Inc. Customer Data Security Breach Litig., 440 F. Supp. 3d 447, 458 (D.
Md. 2020) (noting that the Sixth, Seventh and Ninth Circuits found that increased risk of future
harm was sufficient to establish an injury-in-fact while the Fourth Circuit came to the opposite
conclusion); Clemens v. ExecuPharm Inc., 48 F.4th 146 (3d Cir. 2022) (finding that a plaintiff
asserting a substantial risk of future harm or fraud from a data breach can satisfy concreteness if it
is alleged that the substantial risk also caused a current harm); Abernathy v. Brandywine Urology
Consultants, P.A., 2021 WL 211144, at *4 (Del. Super. Jan. 21, 2021) (finding that mitigation
costs were not a concrete injury to confer standing on plaintiff whose data may have been accessed
but no actual harm was alleged).

                                                  2
Blackbaud agreed to safeguard data stored on its servers in compliance with industry

standards, a data breach occurred, and therefore, Blackbaud breached its contractual

duties. As recognized by the court in Strom v. Paytime, Inc. in 2015, “[t]here are

only two types of companies left in the United States, according data security

experts: ‘those that have been hacked and those that don’t know they’ve been

hacked.’”3 According to Harvard Business Review, in 2022, 83% of organizations

experienced more than one data breach.4 Thus, the fact that a data breach occurred

and the insureds incurred expenses, alone, is not sufficient to state a claim.

         The Insurers’ negligence claims fair no better. While they allege that the

expenses were incurred because the insureds were required to comply with various

laws and regulations, the Insurers never identify the source of the alleged duty owed

to the insureds. Their failure to do so is fatal to the negligence claims.

         As discussed below, the complaints fail to state a claim and therefore, under

Rule 12(b)(6) and (c), judgment is entered in Blackbaud’s favor.

                                        Background

    I.   The Parties

         Travelers issued insurance policies to 79 educational institutions and

nonprofit entities5 (the “Travelers Insureds”).

3
  90 F. Supp. 3d 359, 360 (M.D. Pa. 2015).
4
  https://hbr.org/2023/05/the-devastating-business-impacts-of-a-cyber-breach
5
  Travelers Complaint (D.I. 1) (“Travelers Com.”), ¶ 6.

                                               3
       Philadelphia Indemnity plaintiffs issued insurance policies to 25 educational

institutions and nonprofit entities (the “Philadelphia Indemnity Insureds” and with

the Travelers Insureds, the “Insureds”).6

       The policies provided coverage for certain cyber, criminal, and related

incidents.7 The Insureds are scattered in approximately 35 different states or the

District of Columbia. The Insurers’ principal places of business are in Pennsylvania,

Ohio, Maine, or Mississippi.

       Blackbaud is a Delaware corporation, with its principal place of business in

South Carolina.

II.    Factual Background

       The complaints allege that prior to May 2020, each of the Insureds contracted

with Blackbaud and “stored and maintained databases of important and private

information and documents” on Blackbaud’s servers. Between February 7, 2020

and May 20, 2020, Blackbaud experienced a ransomware attack in which attackers

“gained access to numerous” Insureds’ “information and/or materials.”8 Blackbaud

notified the Insureds of the breach on July 16, 2020.9

6
  Philadelphia Indemnity Complaint (D.I. 1) (“Phila. Com.”), ¶¶ 4, 7, 10, 13.
7
  Phila. Com., ¶ 14; Travelers Com., ¶ 4.
8
  Travelers Com., ¶ 16; Phila. Com., ¶ 25.
9
  Travelers Com., ¶ 17; Phila. Com., ¶ 26.

                                                4
          As a result of “these circumstances, as well as legal requirements governing

such circumstances” the Insureds had to undertake their own investigations in order

to comply with “applicable laws” and “numerous state and federal statutes and

regulations.”10 Compliance with these “various laws” required the Insureds to:

                     a. retain legal experts to assess and comply with their legal
                        obligations;
                     b. retain computer experts to investigate the data breach as
                        required under law and expected by regulators;
                     c. retain firms to draft, translate, print, and mail letters
                        required under data breach notification laws and expected
                        by regulators;
                     d. take other steps to respond to third-party inquiries, as
                        expected by regulators; and/or
                     e. incur other costs for those parties whose data or materials
                        they were maintaining, as required under various state
                        laws and expected by regulators.11

          The Insureds made claims under their policies with the Insurers for these

expenses, which are described as crisis management, remediation expenses, and

related additional expenses (the “Expenses”), which total more than $2.1 million.

          The Insurers paid their Insureds’ respective claims for the Expenses. Under

the corresponding polices, each Insurer was subrogated to the rights of its Insureds

to pursue claims the Insureds may have against Blackbaud. Thus, the Insurers, as

subrogees, are plaintiffs in the actions.

10
     Travelers Com., ¶¶ 19, 21; Phila. Com., ¶¶ 28-30.
11
     Travelers Com., ¶ 22; Phila. Com., ¶ 31.

                                                  5
III.      Claims Asserted

          A.      Breach of Contract

          According to the complaints, each Insured entered into an agreement with

Blackbaud prior to the data breach in which Blackbaud agreed that it would maintain

commercially reasonable security procedures and standards, and commercially

reasonable security breach protocols and procedures, including notifying the Insured

within 72 hours of discovery of a breach. Blackbaud allegedly also agreed:

               a. not to disclose [the Insureds’] confidential information or
                  materials to unauthorized third-parties;
               b. to implement and maintain safeguards against threats or hazards
                  to [the Insureds’] confidential information and materials; and/or
               c. to protect against unauthorized access to (or use of) [the
                  Insureds’] confidential information.12

          Finally, Blackbaud agreed to perform these obligations “in a professional

manner in accordance with industry standards.”13

          Blackbaud is alleged to have breached these agreements by failing to: (i)

“adequately protect” the Insureds’ “confidential information and materials”; (ii)

“properly and adequately determine whether Blackbaud [] was susceptible to a data

breach;” (iii) “maintain and monitor its own data security programs for intrusions;”

(iv) “employ commercially reasonable security measures;” (v) “heed vendor

announcements regarding the sunset of certain databases;” (vi) “remove old unused

12
     Travelers Com., ¶ 27; Phila. Com., ¶ 36.
13
     Travelers Com., ¶ 31; Phila. Com., ¶ 40.

                                                6
and obsolete data containing [the Insureds’] information” or encrypt such

information; and (vi) failing to employ commercially reasonable security measures

in accordance with industry standards.14

       Finally, Blackbaud is alleged to have breached the agreements by “allowing

access to and then disseminating” the Insureds’ “confidential information and

materials to third parties and permitting them to copy, reproduce and transfer such”

confidential information.15

       As a result of these alleged breaches, the Insurers seek to recover the Expenses

from Blackbaud.

       B.     Tort Claims

       Philadelphia Indemnity plaintiffs assert a negligence claim and both

complaints assert a gross negligence claim.16 The claims are essentially identical,

except that the gross negligence claims assert that Blackbaud’s conduct was

intentional and in reckless disregard of the consequences. Seeking to recover the

same damages as the contract claims (i.e., the Expenses), the Insurers assert the same

allegations against Blackbaud as they asserted in the breach of contract claims.

14
   Travelers Com., ¶ 32; Phil. Com., ¶ 42.
15
   Travelers Com., ¶ 33; Phil. Com., ¶ 43.
16
   The Travelers complaint also asserts a count for misrepresentation. However, Travelers advised
the Court that it is withdrawing that claim.

                                               7
IV.    Procedural Background

       In each case, Blackbaud filed a Motion to Dismiss under Rule 12(b)(1) and a

Motion for Judgment on the Pleadings under Rule 12(c). Blackbaud argues that the

complaints should be dismissed under Rule 12(b)(1) because the Insurers lack

standing to bring these claims. Even if the Insurers have standing, Blackbaud asserts

that judgment should be entered in its favor under Rule 12(c) because the complaints

fail to state a claim.

                                      Analysis

 I.    Standing

       A.     The Parties’ Contentions

       Blackbaud argues that the Insurers lack standing because the complaints do

not adequately allege an injury-in-fact.     Blackbaud attacks the complaints as

conclusory and vague, asserting that the alleged damages are self-inflicted costs the

Insureds allegedly incurred to avoid some unidentified consequences for the

Insureds’ failing to comply with some unidentified legal obligations. Relying on

Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013), Reilly v. Cerdian Corp., 664

F.3d 38 (3d Cir. 2011), and Abernathy v. Brandywine Urology Consultants, P.A.,

2021 WL 211144 (Del. Super. Jan. 21, 2021), Blackbaud argues that the Insurers

have not alleged a certainly impending injury because the Insureds’ damages are too

                                         8
speculative. Stated differently, the Insurers do not allege damages that necessarily

flow from the alleged breaches.

       The Insurers counter that the Insureds incurred concrete damages. While not

in the complaints, the Insurers argue that the Insureds stored personal information of

their donors on Blackbaud’s servers. Once the Insureds received notice of a data

breach from Blackbaud, the Insurers argue, the Insureds were required to investigate

to comply with data breach notification laws and “regulators expectations.” The

Insurers do not identify any particular law with which the Insureds were required to

comply or whose expectations they were attempting to satisfy (or why). The Insurers

assert in their briefs that each state has data breach laws, and the Insureds were

required to comply with such laws not only where the Insureds are located, but also

in the many resident-states of the various donors. These laws vary greatly. For

example, the Insurers cite to some states’ laws which require notification when

personal information such as social security number, driver’s license number, health

insurance information, or financial information have been accessed. Some states’

laws require notification when there has been an unauthorized access to the

information, while others require notification only where data has been exfiltrated.17

17
  Answering brief in Travelers (D.I. 24) (“T-AB”), pp. 13-15; Answering brief in Philadelphia
Indemnity (D.I. 16) (“P-AB”), pp. 13-15.

                                             9
Finally, some states require notification only if there is a risk of harm to the

individuals.

       Because compliance with these laws is mandatory, the Insurers argue, the

Insureds were required to conduct investigations and comply with their obligations

under the state-specific laws.18 To conduct the investigations and comply with these

laws, the Insureds had to hire forensic experts and lawyers. As a result of the

investigations, some Insureds hired firms to send notices and respond to inquiries

from impacted individuals and state regulators. The costs associated with these

activities form the basis of the Insurers’ damages, i.e., the Expenses.19

       B.      Standing Standard of Review

       “Standing” refers to the right of a person to invoke jurisdiction of the Court to

redress its grievance. “The issue of standing is concerned ‘only with the question of

who is entitled to mount a legal challenge and not with the merits of the subject

matter of the controversy.’”20

18
   The Insurers argued that if claims such as the claim asserted here are not permitted, it would set
bad public policy because companies would be less likely to comply with the law if they are not
certain that they will be reimbursed for expenses incurred in responding to a data breach notice.
P-AB, p. 17; T-AB, p. 17. The Court disagrees. Companies should be incentivized to comply
with the law simply because they are required to do so.
19
   The Insurers argued that even if the Expenses are not “damages”, the Insurers would be entitled
to at least nominal damages for the breach of contract claim and thus, based on this alone, they
have standing. The Insurers, however, are not seeking nominal damages for a breach. Thus, this
argument is not persuasive and therefore, is rejected.
20
   Albence v. Higgin, 295 A.3d 1065, 1086 (Del. 2022) (emphasis in original) (citation omitted).

                                                10
       Delaware generally follows the federal courts’ requirements for establishing

Article III standing, but is not bound by the federal rules of justiciability.21 Unlike

the federal courts where “standing may be subject to stated constitutional limits,”

Delaware applies the “concept of standing as a matter of self-restraint to avoid the

rendering of advisory opinions at the behest of parties who are ‘mere

intermeddlers.’”22       “Consequently, Delaware’s courts may hear cases and

controversies that the federal courts cannot.”23

       The party invoking the jurisdiction of the Court has the burden of establishing

its standing, which requires a plaintiff to show that: “(i) the plaintiff has suffered an

‘injury-in-fact,’ i.e., a concrete and actual invasion of a legally protected interest; (ii)

there is a causal connection between the injury and the conduct complained of; and

(iii) it is likely the injury will be redressed by a favorable court decision.”24

       When a defendant argues that the Court would not have authority to grant the

requested relief to any plaintiff, standing is analyzed under Rule 12(b)(1).25

However, where “the issue of standing is so closely related to the merits, a motion

21
   Id.
22
   Id. (cleaned up).
23
   Id.; Continental Auto. Sys., Inc. v. Nokia Corp., 2023 WL 1370523, at *6 (Del. Ch. Jan. 31,
2023) (“a showing that satisfies the Article III requirements will establish standing under Delaware
law. Failing to satisfy the requirements for Article III standing means that a court must determine
whether standing nevertheless exists under Delaware law.”).
24
   Albence, 295 A.3d at 1086 (citations omitted).
25
   In re Covid-Related Restrictions on Religious Services, 302 A.3d 464, 478 (Del. Super. 2023).

                                                11
to dismiss based on lack of standing is properly considered under Rule 12(b)(6)

rather than Rule 12(b)(1).”26

        C.      Discussion

        The parties spend much time discussing cases that address standing in

“typical” data breach cases, in which individuals’ or entities’ own data has been

compromised.27 In Reilly (3d Cir. 2011) and Abernathy (Del. Super.), the courts

ruled that where hackers potentially gained access to personal or financial

information but there were no allegations that plaintiffs’ information was accessed

and improperly used, the speculative threat of future improper use, without more,

was insufficient to confer standing on the plaintiffs.

        In Clemens v. ExecuPharm Inc.28 (relied on by the Insurers), the Third Circuit

clarified that a hacking victim does not necessarily need to wait until the data is

actually misused to gain standing. If a plaintiff can show a substantial risk of future

harm which has caused additional current harm, a plaintiff has alleged a concrete

injury and thus, established standing.29

26
   Appriva S’holder Litig. Co., LLC v. EV 3, Inc., 937 A.2d 1275, 1285-86 (Del. 2007); In re Covid-
Related Restrictions, 302 A.3d at 478 (when the defendant is arguing that the court cannot grant
relief to a plaintiff in a particular case because this particular plaintiff has not pleaded an essential
element of the claim, the motion is properly decided under Rule 12(b)(6).).
27
   This is understandable because the complaints allege that the Insureds’ information had been
impacted by the breach. The Insurers did not reveal that it was the Insureds’ donors’ information
at issue until they filed their answering briefs.
28
   48 F.4th 146 (3d Cir. 2022).
29
   Id. at 155-56.

                                                  12
         While not a data breach case, in Clapper v. Amnesty Int’l USA,30 the claimants,

attorneys and organizations whose work (they alleged) required them to engage in

communications with foreign nationals which may be subject to surveillance under

Foreign Intelligence Surveillance Act of 1978 (“FISA”), challenged the

constitutionality of section 1881a of the act. The Supreme Court ruled that the

claimants lacked standing because they could not show that there was an injury-in-

fact as there was no imminent threat to interception of their communications with

foreign nationals. The claimants’ fear of communication interception was found to

be highly speculative because before any communications could be intercepted,

several safeguard and procedural hurdles would have to be cleared, including an

Article III judge concluding that the proposed inception was consistent with Fourth

Amendment protections.31

         These cases, focusing on the potential for future harm, are not helpful in

analyzing whether the Insurers have standing. The Insurers are not asserting some

future harm from the exfiltration of any particular data. Rather, upon receiving a

data breach notice, the Insureds (or at least some of them) supposedly had an

obligation to investigate and notify third parties of the Blackbaud data breach. The

expenses associated with this process is what the Insurers are seeking to recover.

30
     Clapper, 568 U.S. 398 (2013).
31
     Id. at 428-31.

                                           13
       Because Blackbaud’s challenge to the complaints focuses on the lack of

factual allegations supporting the elements of the claims asserted, the challenges will

be analyzed in the context of Rule 12 (b)(6).

       Under Rule 12(b)(6), the Court: accepts as true all well-pled factual

allegations; credits vague allegations as “well pleaded” if they give the opposing

party notice of the claim; draws all reasonable inferences in favor of the non-moving

party; and denies dismissal if there is a reasonably conceivable32 set of circumstances

of recovery on the claim.33 Delaware’s pleading standard is “minimal,” but the

liberal construction afforded to a claimant does not “extend to ‘conclusory

allegations that lack specific supporting factual allegations.’”34 Accordingly, the

Court should dismiss a complaint if the plaintiff fails to make “specific allegations

supporting each element of a claim or if no reasonable interpretation of the alleged

facts reveals a remediable injury.”35

32
   Blackbaud argues that the Insurers must provide “plausible” allegations to avoid dismissal.
Blackbaud’s Opening Brief in Travelers (“B-T OB”) (D.I. 19), pp. 15, 22; Blackbaud’s Opening
Brief in Philadelphia Indemnity (“B-PI OB”) (D.I. 14), pp. 15, 22. The Delaware pleading
standard, however, is a more liberal “reasonably conceivable” standard, which the Court applies
to the complaints. Cent. Mortg. Co. v. Morgan Stanley Mortg. Cap. Holdings LLC, 27 A.3d 531,
535, 536-37, n.13 (Del. 2011) (the “‘conceivability’ standard is more akin to ‘possibility,’ while
the federal ‘plausibility’ standard falls somewhere beyond mere ‘possibility’ but short of
‘probability.’”).
33
   Cent. Mortg. Co., 27 A.3d at 535.
34
   Id. at 536-37, n.13; Surf’s Up Legacy Partners, LLC v. Virgin Fest, LLC, 2021 WL 117036, at
*6 (Del. Super. Jan. 13, 2021) (quoting Ramunno v. Cawley, 705 A.2d 1029, 1034 (Del. 1998)).
35
   Axogen Corp. v. Integra LifeSciences Corp., 2021 WL 5903306, at *2 (Del. Super. Dec. 13,
2021) (citing Surf’s Up Legacy Partners, LLC, 2021 WL 117036, at *6).

                                               14
II.      Motion for Judgment on the Pleadings

         A.     Choice-of-Law

               i.     The Parties’ Contentions

         Blackbaud tests the validity of the Insurers’ claims under Delaware law, as

there was no indication in the complaints that any other law might apply.

         The Insurers object to the application of Delaware law, arguing that the Court

must first determine which state’s law applies before determining whether the

complaints sufficiently plead the claims. To determine whether the complaints state

a claim without first conducting a choice-of-law analysis, the Insurers assert, “would

be premature” and would ignore the states that have “more relevant jurisdictional

contacts.” The Insurers do not suggest any particular state’s law that should apply

but survey multiple states’ laws, without any analysis as to why they might apply

here.

         On their contract claims, the Insurers assert in their briefs that “all contracts

identified to date” between Blackbaud and the Insureds provide that they are

governed by New York law.36 The Insurers do not allege that New York law should

apply to their contract claims, but assert that they should be entitled to proceed to

discovery.

36
     P-AB p. 7; T-AB p. 8.

                                            15
       Blackbaud responds that the complaints are so vague and conclusory that the

Court should apply Delaware law. Additionally, New York law is not in conflict

with Delaware law on the claims, and therefore, Delaware law applies in any event.

             ii.       Choice-of-Law Standards

       The first step in a choice-of-law analysis under Delaware law is determine

whether there is an actual conflict. To do so, Delaware courts “answer a single and

simple inquiry: does the application of the competing laws yield the same result?”37

If yes, there is a “false” conflict and Delaware law will apply.38 If the answer is no,

for tort claims, Delaware will then determine which jurisdiction has the most

significant relationship, utilizing the factors set forth in Section 145 of the

Restatement (Second) of Conflicts, and apply that state’s law.39

       Where the parties agreed to the application of a state’s law in their contract,

Delaware courts are “strongly inclined” to respect the parties’ freedom of contract

and enforce the contract provision unless there is a strong overriding public policy

37
   In re CVS Opioid Ins. Litig., 2022 WL 3330427, at *8 (Del. Super. Aug. 12, 2022) (citations
omitted).
38
   Dueley v. Dyncorp Int’l, Inc., 8 A.3d 1156, 1161 (Del. 2010).
39
   Travelers Indemn. Co. v. Lake, 594 A.2d 38 (Del. 1991); Stillwater Mining Co. v. Nat’l Union
Fire Ins. Co. of Pittsburg, Pa., 2021 WL 6068046, at *7 (Del. Super. Dec. 22, 2021). The court
considers the following relevant contacts, as provided in Section 145: (a) the place where the injury
occurred; (b) the place where the conduct causing the injury occurred; (c) the domicil, residence,
nationality, place of incorporation and place of business of the parties; and (d) the place where the
relationship, if any, between the parties is centered. Travelers Indemn. Co., 594 A.2d at 47. These
contacts are to be evaluated according to their relative importance with respect to the particular
issue. Id.

                                                16
interest at play.40 “[W]ith very limited exceptions, [Delaware] courts will enforce

the contractual scheme that the parties have arrived at through their own self-

ordering, both in recognition of a right to self-order and to promote certainty of

obligations and benefits.”41

            iii.       Analysis

       In their briefs, the Insurers admit that the contracts they have been able to

locate thus far contain a New York choice-of-law provision. Curiously, the Insurers

then argue that this choice-of-law provision has no bearing on the motions.

       Blackbaud argues that if New York law does not apply, Delaware law should

be applied here because the Insurers chose this forum, and they provided no choice-

of-law analysis.

       The Insurers have provided no reason why the Court should not apply New

York law to the breach of contract claims. Whether New York or Delaware law

applies, the result would be the same because these states’ laws are not in conflict.

       Whether New York law would apply to the tort claims may depend on the

scope of the choice-of-law provision.42 Some choice-of-law provisions are broad

40
   Wind Point P’ners VII-A, L.P. v. Insight Equity A.P. X Co., LLC, 2020 WL 5054791, at *18
(Del. Super. Aug. 17, 2020).
41
   Id. (citation omitted). If the contract does not contain a choice-of-law provision, Delaware courts
will apply the Restatement (Second) of Conflicts § 188. SIGA Tech., Inc. v. PharmAthene, Inc.,
67 A.3d 330, 342 (Del. 2013).
42
   Relying on Abry Partners V L.P. v. F&W Acquisition LLC, 891 A.2d 1032 (Del. Ch. Feb. 14,
2006), Blackbaud argues that a contractual choice-of-law provision will apply to tort claims as
well. The court’s ruling in Abry Partners, however, was limited to tort claim arising out of a

                                                 17
enough to cover tort claims that arise out of the parties’ relationship.43 The Insurers

did not give the Court the benefit of reviewing the contractual language because they

have not submitted a copy of the contracts (or even an exemplar) to the Court.

       Under a tort choice-of-law analysis, the Court would have to weigh the four

Restatement factors. There are cases where the determination of choice-of-law is

premature without the benefit of some discovery,44 but where, as here, the

complaints contain such vague and conclusory allegations that the most basic

elements of the claims are not supported by basic factual allegations, the Court is

going to apply Delaware law.             Otherwise, a plaintiff could allege conclusory

allegations, which do not satisfy Rule 8’s pleading standards and be permitted to

proceed to discovery. Before a plaintiff is permitted to proceed to discovery, it must

first satisfy the minimal obligations of Rule 8.

challenge to the enforcement of the contract. The tort claims here would need to be analyzed
separately from the contract claims.
43
   See Gloucester Holdings Corp. v. US Tape and Sticky Products, LLC, 832 A.2d 116, 124 (Del.
Ch. 2003) (a choice-of-law provision that provides the chosen state’s law applies to claims that
arise out of or relate to the agreement are broad enough to apply to tort claims, whereas a clause
that applies to the “rights of the parties” will not extend to tort claims); ETC Northeast Pipeline,
LLC v. Associated Electric & Gas Ins. Svs. Ltd., 2023 WL 6441815, at *2 (Del. Super. Sept. 5,
2023) (recognizing that New York law provides that a contractual choice-of-law provision that
applies to disputes “relating to” the contract is broad enough to apply to tort claims).
44
   See Soares v. Continental Motors, Inc., 2021 WL 6015701, at *1, 11 (Del. Super. Dec. 17, 2021)
(finding that further discovery was required before a choice-of-law determination was
appropriate).

                                                18
       B.     Rule 12(c) Standard of Review

       Under Superior Court Rule 12(c),45 the Court is required to accept as true the

well-pled facts alleged in the complaint and draw all reasonable inferences in favor

of the non-moving party.46 The Court will not, however, “rely upon conclusory

allegations … [and] neither inferences nor conclusions of fact unsupported by

allegations of specific facts … are accepted as true.”47

       C.     Breach of Contract

             i.       The Parties’ Contentions

       Blackbaud asserts that the contract claims fail for at least three reasons: (i) the

Insurers failed to identify the contracts at issue or the specific contract provisions

that were allegedly breached; (ii) the complaints allege no facts supporting the

conclusory allegations that the contracts were breached; and (iii) the complaints fail

to identify a cognizable harm.

45
   Rule 12(c) provides:
         After the pleadings are closed but within such time as not to delay the trial, any
         party may move for judgment on the pleadings. If, on a motion for judgment on the
         pleadings, matters outside the pleadings are presented to and not excluded by the
         Court, the motion shall be treated as one for summary judgment and disposed of as
         provided in Rule 56, and all parties shall be given reasonable opportunity to present
         all material made pertinent to such a motion by Rule 56.
46
   Festival Fun Parks, LLC v. MS Leisure Co., 2023 WL 8714994, at *4 (Del. Super. Dec. 18,
2023).
47
   Id. (citation omitted); Bay Point Capital P’ners L.P. v. Fitness Recovery Holdings, LLC, 2021
WL 5578705, at *4 (Del. Super. Nov. 30, 2021) (“The Court accords the party opposing a Rule
12(c) motion the same benefits as a party defending a motion to dismiss under Rule 12(b)(6)”).

                                              19
         The Insurers counter that the complaints identify the contractual provisions at

issue. Quoting the complaints, the Insurers assert that the following contract

provisions were breached:

                - “to not disclose Plaintiffs’ insured’s confidential information or
         materials to unauthorized third-parties;”
                - “to implement and maintain safeguards against threats or
         hazards to Plaintiffs’ insureds’ confidential information and materials;”
                - “to protect against unauthorized access to (or use of) Plaintiffs’
         insureds’ confidential information.”
                - “[to] maintain commercially reasonable information security
         procedures and standards.”
                - “it had implemented commercially reasonable policies and
         procedures addressing potential security breaches, including the
         reporting to each insured (within 72 hours of discovery) of any security
         breach.”
                - “to indemnify and defend the insureds against any third-party
         claims arising from its gross negligence or willful misconduct.”
                - “performance … in a professional manner in accordance with
         industry standards.”48

         Blackbaud is alleged to have breached these provisions by failing to:

         “properly and adequately determine whether Blackbaud was
         susceptible to a data breach;” “properly maintain and monitor its own
         data security programs for intrusions;” “remove old unused and
         obsolete data containing the insured’s information and materials, or to
         encrypt such information;” “heed vendor announcements regarding the
         sunset of certain databases, leaving client information on older
         databases that were more vulnerable to cyberattack;” and “employ
         commercially reasonable security measures that met industry
         standards.”49

48
     Travelers Com. ¶¶ 27-31; Phila. Com. ¶¶ 36-40.
49
     Travelers Com. ¶ 32; Phila. Com. ¶ 42.

                                                20
       The Insurers argue that they have alleged cognizable damages because the

Expenses were incurred in complying with “mandatory legal requirements.”50

            ii.       Analysis

       To adequately plead a claim for breach of contract, a plaintiff must allege “(1)

the existence of a contract; (2) that the contract was breached; and (3) damages

suffered as a result of the breach.”51 Each element must be supported by specific

factual allegations; conclusory statements are insufficient.52 Additionally, generally

referring to a contract will not sustain a claim. “A party must identify the particular

contractual terms that were breached.”53

       The Insurers assert breach of contract claims as subrogees for 104 Insureds.

The Insureds are alleged to have entered into “agreements” and “contracts” with

Blackbaud. The Insurers did not attach the contracts (or even an exemplar) to the

complaints or their briefs. The provisions to which the Insurers cite are not in all the

contracts. As the Insurers admit in their answering briefs, they do not even have all

50
   P-AB, p. 22; T-AB, p. 22.
51
   Khushaim v. Tullow Inc., 2016 WL 3594752, at *3 (Del. Super. June 27, 20216); Patriarch
P’ners LLC v. Zohar CDO 2003-1 LLC, 2017 WL 2643972, at *1, n.3, 165 A.3d 288 (TABLE)
(Del. 2017) (same) (applying New York law).
52
   Festival Fun Park, 2023 WL 8714994, at *4.
53
   Marydale Preservation Associates, LLC v. Leon N. Weiner & Associates, Inc., 2022 WL
4446275, at *17 (Del. Super. Sept. 23, 2022); Clifden Futures, LLC v. Man Financial, Inc., 858
N.Y.S.2d 580, 583-84 (N.Y. Sup. Ct. 2008) (“The pleadings must be sufficiently particular to give
the court and [the] parties notice of the transaction, occurrences, or series of transactions or
occurrences, intended to be prove as well as the material elements of each cause of action or
defense.” (quoting Atkins v. Mobil Oil Corp., 614 N.Y.S.2d 36 (2d Dep’t 1994) (citation omitted)).

                                               21
the contracts under which they are suing. The Insurers state that “all the contracts

identified to date” between the Insureds and Blackbaud contained a New York

choice-of-law provision.54 Thus, the Insurers’ conclusory allegations that each

Insured entered into a contract containing the promises alleged is insufficient to

satisfy the pleading requirements.

       “At the pleading stage of a written contract dispute, Rule 8 requires the

plaintiff to take the basic and customary step of producing the agreement and citing

the provisions alleged to have been breached. Failure to do so ‘is not a technical

foot fault; it reflects, instead, a fundamental failure to give the [defendant] fair notice

of the claim asserted against [him] as required by [] Rule 8.’”55

       The complaints also fail to allege specific facts supporting the allegations that

the contracts were breached. The complaints assert certain promises that some

contracts may contain, such as to implement and maintain safeguards against threats

or hazards, to use procedures and standards to protect against security breaches in

accordance with industry standards, and to protect against unauthorized access to

confidential information. But the complaints do not allege facts of how these alleged

promises were breached.56          The complaints allege in conclusory fashion that

54
   P-AB, p. 7; T-AB, p. 8.
55
   Enzolytics, Inc. v. Empire Stock Transfer Inc., 2023 WL 2543952, at *3 (Del. Ch. Mar. 16, 2023)
(quoting Ryan v. Buckeye P’ners, L.P., 2022 WL 389827, at *6 (Del. Ch. Feb. 9, 2022), aff’d, 285
A.3d 459 (Del. 2022) (TABLE)).
56
   The complaints also allege that Blackbaud agreed in the contracts to indemnify the Insureds
from liability from third-parties. Phila. Com., ¶ 39; Travelers Com., ¶ 30. But the complaints

                                               22
Blackbaud failed to maintain and monitor its systems and failed to use commercially

reasonable security measures, but the Insurers never describe what those standards

are or why Blackbaud’s conduct failed to meet those standards.57 For example, the

complaints allege “Blackbaud breached its agreements and its duties by failing to

comply with its obligations under its contracts, as well as under certain statutes and

regulations, before, during and after the incident.”58 This circular allegation is

insufficient. The complaints never identify the statutes and regulations under which

Blackbaud had obligations and never identify what “regulators’ expectations” they

supposedly had to comply with or why such compliance was even necessary.

       Although the complaints allege that Blackbaud failed to remove unused and

obsolete data containing the Insureds’ unidentified information, they do not allege

how this was a breach of the contracts or if it was, which of the 104 contracts were

breached. Similarly, Blackbaud is alleged to have failed to heed “vendor

announcements” regarding certain databases. But again, the complaints are devoid

of any factual allegations that Blackbaud was required to heed these unidentified

contain no factual allegations that any Insured was subjected to (or even threatened with) a third-
party claim. Similarly, the complaints allege that Blackbaud “may have failed” to name one or
more of the Insureds as an “additional insured” on Blackbaud’s insurance policies as “possibly
required” under “one or more of its contracts.” Phila. Com., ¶ 32; Travelers Com., ¶ 23. Neither
of these assertions is supported by factual allegations. Accordingly, the complaints fail to state a
claim based on these alleged breaches.
57
   Phila. Com., ¶ 24; Travelers Com., ¶ 15 (“a third party was able to readily bypass Blackbaud’s
substandard security” and deploy ransomware); Phila. Com., ¶ 18; Travelers Com., ¶ 27
(“Blackbaud failed to maintain adequate security”).
58
   Phila. Com., ¶ 29; Travelers Com., ¶ 20.

                                                23
vendor announcements and even if so, how this alleged failure resulted in a breach

of contractual duties.

       Essentially, the complaints allege there were contracts which required

Blackbaud to protect unidentified information belonging to unidentified persons, a

data breach occurred resulting in the attackers “gaining access to numerous

[Insureds’] data, information and/or materials” and therefore the Insurers conclude,

Blackbaud breached the contracts. This is insufficient. Indeed, as the Insurers admit,

not even all of the Insureds (or their donors’) had their information accessed.

       Further, the complaints fail to sufficiently allege that the breaches were the

proximate cause of the alleged damages (the Expenses). The complaints allege that

the Insureds stored “important and private information and documents” on

Blackbaud’s servers, that the hackers gained access to “numerous [I]nsureds’ data,

information and/or material” and as a result of “these circumstances, as well as legal

requirements governing such circumstances,” the Insureds had to undertake their

own investigations.59 Because the Insureds had to comply with “these various laws,”

they incurred the Expenses. However, the Insurers never identify these “various

laws.” As the Insurers acknowledge in the answering briefs, data breach laws “differ

greatly.”60 The statutes’ requirements depend on the type of information was

59
   Phila. Com., ¶¶ 28, 30; Travelers Com., ¶¶ 19, 21 (“The [I]nsureds were required to comply with
numerous state and federal statute and regulations…”).
60
   P-AB, p. 13; T-AB, p. 13.

                                               24
breached; some may require notifications, some may not.61 Additionally, some

states require notification where there has been an unauthorized access and others

require notification only when there is a risk of harm to the individual.62 The Insurers

cite examples of Kansas (requiring notification if the breach involved social security

numbers, driver’s license number, or financial information)63 and California

(requiring reporting if health insurance or biometric data is accessed)64 but the

Insurers do not show how these state’s laws have any application here.

       Moreover, the Insurers failed to allege facts to show that the Expenses

incurred by any of the 104 Insureds in reviewing legal requirements (and/or sending

notices) were proximately caused by Blackbaud’s breach of contract.                          The

complaints do not identify the type of information that allegedly triggered the legal

obligation to conduct an investigation65 or that information stored by the Insureds

belonged to third-parties. The Insureds allegedly hired legal experts to review

applicable laws to determine whether the Insureds had to take further action and

61
   Some states require notice if there has been accessed to defined personal information, while
others require notification only if the personal information has been exfiltrated. P-AB, p. 14; T-
AB, p. 14.
62
   P-AB, p. 14; T-AB, p. 15, citing Conn. Gen. Stat. § 36a-701(b)a(1) and Ala Code § 8-38-6(a).
63
   P-AB, p. 13; T-AB, p. 14, citing Kan. Stat. § 50-7a01(g).
64
   Id., citing Cal. Civ. Code § 1798.82(h).
65
   The answering briefs assert that the Insureds hired forensic experts to “determine what type of
data was breached, whose data it was, where the individual owners of such data resided, and what
was done with the data.” P-AB, p. 16; T-AB, p. 16.

                                               25
some of the 104 Insureds were required to provide notices.66 However, other than

the timing of this legal review, the complaints do not allege facts to show that but

for the breach, the legal expenses would not have been incurred. The Insureds may

have undertaken this work after receiving a breach notice, but the timing alone is

insufficient.

       Without supporting facts, the conclusory allegations in the complaints fail to

state a claim for breach of contract.

       D.       Negligence

             i.        The Parties’ Contentions

       Blackbaud argues that the Insurers’ tort claims fail for three reasons: (i) the

complaints fail to plead the existence of a legal duty; (ii) the Insurers failed to plead

negligence with particularity; and (iii) the negligence claims are barred under the

economic loss doctrine or due to impermissible bootstrapping.

       Citing no authority, the Insurers counter that there is no requirement to plead

the existence of a legal duty. Even if such a requirement exists, the Insurers argue,

their allegation that Blackbaud undertook the obligation to protect information

known to be confidential and “protected under the law” and had the “common law

duty to properly safeguard” the information, is sufficient. The Insurers again raise

66
  P-AB, p. 16; T-AB, p. 17 (the Insureds “paid legal experts to interpret the [I]nsureds’ obligations
… pursuant to the various state data breach notification laws …. Some [of the Insureds] then
incurred expenses complying with their legal obligations ….”).

                                                26
the argument that the Court cannot decide whether the complaints state a claim

without first making a choice-of-law determination as the claims they assert are valid

under some states’ laws and not barred by the economic loss doctrine.

       The Insurers also argue that they have satisfied the particularity requirement

by pleading that “Blackbaud knowingly undertook an obligation to protect

information and materials of third-parties and the [I]nsureds known to be

confidential and protected under the law, and in turn took on a common law duty to

properly safeguard and protect such information and materials.”67

            ii.       Analysis

       To state a claim for negligence, a plaintiff must allege (i) a duty that is owed

to plaintiff; (ii) defendant breached that duty; and (iii) as a proximate cause of the

breach, plaintiff suffered damages.68 Gross negligence is a higher standard of

negligence, representing an extreme departure from the standard of care. 69 “When

evaluating whether a defendant’s conduct constitutes gross negligence, this Court

conducts an assessment of the ‘reasonableness of a defendant’s actions given the

conditions at that time and not whether hindsight would shed more light upon

whether any conditions could have served as red flags.’”70

67
   Phila. Com., ¶ 46; Travelers Com., ¶ 38.
68
   Russell v. K-Mart Corp., 761 A.2d 1, 5 (Del. 2000). The standard is the same under New York
law. See Solomon v. City of New York, 499 N.Y.2d 392 (N.Y. Sup. Ct. 1985).
69
   Browne v. Robb, 583 A.2d 949, 953 (Del. 1990).
70
   Ward v. Del. State Police, 2022 WL 351205, at *7 (Del. Super. Feb. 4, 2022) (citation omitted);
J.L. v. Barnes, 33 A.3d 902, n.77 (Del. Super. 2011) (“In order for a plaintiff to plead gross

                                               27
       Under Rule 9(b), allegations of negligence must be plead with particularity.

“The purpose of the Rule’s particularity requirement is to: ‘(1) provide defendants

with enough notice to prepare a defense; (2) prevent plaintiffs from using complaints

as fishing expeditions to unearth wrongs to which they had no prior knowledge; and

(3) preserve a defendant’s reputation and goodwill against baseless claims.’”71

Generally, a claim of negligence or gross negligence satisfies Rule 9(b) when it

advises the defendant “‘(1) what duty, if any, was breached; (2) who breached it; (3)

what act or failure to act breached the duty; and (4) the party upon whom the act was

performed.’”72 While Delaware courts apply a more relaxed standard of particularity

when the factual information is in the opposing party’s possession,73 a complaint

cannot rely on conclusory allegations.

       To state a claim, the Insurers must identify the duty allegedly owed by

Blackbaud.      Blackbaud informed the Court that it found no Delaware case

negligence with the requisite particularity, the plaintiff must articulate ‘facts that suggest
a wide disparity between the process [ ] used ... and that which would have been rational.’”)
(citation omitted).
71
   Cantatore v. Univ. of Del., 2021 WL 2745107, at *2 (Del. Super. June 30, 2021) (citation
omitted).
72
   Greenfield for Ford v. Budget of Del. Inc., 2017 WL 729769, at *2 (Del. Super. Feb 22, 2017)
(quoting Murphy v. Bayhealth Med. Ctr., 2006 WL 509544, at *3 (Del. Super. Jan. 9, 2006)
(citation omitted)); See also Rinaldi v. Iomega Corp., 1999 WL 1442014, at *7 (Del. Super. Sept.
3, 1999) (“When pleading negligence, plaintiffs have to meet the heightened standard of Rule 9(b),
and must specify a duty, a breach of the duty, who breached the duty, what act or failure to act
caused the breach, and the party who acted.”) (emphasis added).
73
   Morra v. 700 Marvel Road Operations, LLC, 2023 WL 5406163, at *4 (Del. Super. Aug. 21,
2023).

                                               28
recognizing a common law duty to protect confidential information.74 The Insurers

responded that just because Blackbaud was unable to find any such case, does not

mean that no such duty exists.75 That may be true, but the Insurers do not identify a

Delaware (or New York) common law duty.

       The Insurers assert that a common law duty to protect confidential information

is recognized under Massachusetts law and South Carolina law, where a class action

is pending against Blackbaud arising out of the data breach. The South Carolina

court, however, applied South Carolina law at the motion to dismiss stage because,

as here, the parties did not have or present facts sufficient for the court to conduct a

choice-of-law analysis.76 Thus, at this stage of the cases, the South Carolina case

supports the application of Delaware law, not South Carolina law. The South

Carolina court, applying a lex loci delicti choice-of-law analysis, later determined

that Massachusetts law applied to the data breach case.77 Of course, Delaware

applies the Restatement (Second) of Conflicts choice-of-law analysis. Therefore,

the Court is not persuaded that Massachusetts law should apply.

74
   T-OB, p. 26; P-OB, p. 26.
75
   P-AB, p. 24; T-AB, p. 24.
76
   In re Blackbaud, Inc. Customer Data Breach Litig., 567 F. Supp. 3d 667, 676-77 (D.S.C. 2021)
(“Because it is presently unclear where the [data] breach occurred, the court will apply South
Carolina law with respect to Plaintiffs’ common law claims for negligence, gross negligence, and
negligence per se.”).
77
   In re Blackbaud, Inc. Customer Data Breach Litig., 2022 WL 2314714 (D.S.C. June 28, 2022).

                                              29
         Even if a common law duty exists, the complaints fail to plead the negligence

claims with particularity. Just as they did in the breach of contract claims, the

complaints plead the negligence claims in conclusory fashion. The complaints

allege that Blackbaud failed to: (i) remove obsolete data; (ii) adequately determine

that it was susceptible to an attack; (iii) maintain and monitor its security programs;

(iv) heed vendors’ announcements; and (v) employ commercially reasonable

security measures that met industry standards. The complaints do not allege facts of

what duty was breached or what act breached the duty. Again, the complaints

essentially allege that an attack occurred and therefore Blackbaud must have been

negligent.

         Further, the complaints fail to allege facts supporting the allegation that

Blackbaud was grossly negligent. The Insurers argue that merely by the amount of

confidential data stored by Blackbaud, the fact that it suffered a data breach when it

was at a heightened risk of attack, constitutes gross negligence.78 This conclusory

allegation, however, is insufficient.

         Finally, just as with the contract claims, the complaints fail to allege facts to

support the conclusion that the damages (the Expenses) were the proximate result of

the alleged breaches.

78
     P-AB, p. 27; T-AB, p. 27.

                                            30
      Accordingly, the complaints fail to state a claim for negligence, let alone gross

negligence.

                                    Conclusion

      The complaints fail to state a claim for breach of contract, negligence, or gross

negligence. Therefore, the Court need not address whether the negligence claims

are barred by the economic loss doctrine or bootstrapping. Similarly, the Court need

not address whether the Insurers properly asserted a claim for attorneys’ fees.

      Because the complaints failure to state a claim under Rule 12(b)(6), judgment

on the pleadings is entered in favor of Blackbaud.

IT IS SO ORDERED.

                                              /s/Kathleen M. Miller
                                              Kathleen M. Miller, Judge

                                         31