Opinion
H051822
11-19-2024
ACCELLION, INC., Cross-complainant and Appellant, v. FOLEY &LARDNER LLP, Cross-defendant and Respondent.
NOT TO BE PUBLISHED
(Santa Clara County Super. Ct. No. 22CV393712)
LIE, J.
Exploiting a vulnerability in file-sharing software licensed by Accellion, Inc., hackers launched a ransomware attack on law firm Foley &Lardner LLP. After Foley's insurer sued Accellion as subrogee and under an assignment of Foley's claims arising from the data breach, Accellion cross-complained, initially against the insurer and later against Foley, alleging breach of the licensing agreement and the covenant of good faith and fair dealing implied in that agreement. Reasoning that Accellion's claims were untimely and without substantive merit, the trial court sustained Foley's demurrer without leave to amend and entered judgment in Foley's favor on Accellion's cross-complaint. We affirm.
I. BACKGROUND
A. Accellion's Allegations Against Foley
Foley used Accellion's File Transfer Appliance (FTA) under an end user license agreement (EULA). Before December 2020, Accellion encouraged Foley to migrate from FTA to a newer product with more robust security. As of December 21, 2020, Foley was scheduled to migrate to the newer product in January 2021.
In December 2020, a cyberattack at a different licensee's site exposed vulnerabilities in the FTA software. Accellion released a patch to fix the vulnerability.
On December 20, Accellion attempted to notify Foley about the patch. Accellion e-mailed Foley the next day, and Foley confirmed that it would complete the software update" 'asap.'" Although Foley at some point installed the patch, its FTA software was breached on December 21. Foley did not learn of the breach until the following month.
In the interim, Accellion notified Foley about two additional patches, which Foley did not install.
In January 2021, Foley learned of its system breach when its data was stolen. Without consulting Accellion, Foley paid a ransom for the restoration of its data.
Foley's insurer, plaintiff Illinois National Insurance Co. (Illinois National), claims to have incurred over $1 million in fees and costs on behalf of Foley. Assigned Foley's claims, Illinois National sued Accellion.
In its cross-complaint against Foley, Accellion alleged causes of action for breach of the EULA and breach of the covenant of good faith and fair dealing implied in the EULA.
According to Accellion, the EULA required Foley to install all patches within five days of notice, and by failing to do so, Foley enabled its data to be stolen. Foley's breach of the EULA harmed Accellion by causing Accellion to incur charges for consultation, engineering, and security work on Foley's system.
Accellion alleged that Foley also breached the implied covenant of good faith and fair dealing implied in the EULA by paying the ransom and by "incurring fees and costs" without consulting Accellion. Accellion attached the EULA as an exhibit to its operative complaint.
B. Procedural History
Illinois National sued Accellion in January 2022. "[A]s assignee and subrogee," Illinois National sought "to, at a minimum, recover amounts paid on behalf of [Foley]."
Illinois National did not identify Foley by name, instead referring to "Insured A" to protect Foley's "privacy and confidentiality." Foley has since become a party to this litigation, so we refer to it by name.
Accellion demurred to Illinois National's operative complaint. Overruling the demurrer as to most of the causes of action, the trial court found that Illinois National properly pleaded that it was prosecuting the case as an assignee and subrogee, so it had a right to pursue its insured's rights against the third party causing the loss:" 'In the action for subrogation the insurer stands in the shoes of the insured/subrogor.' "
In November 2022, about a week after the trial court ruled on its demurrer, Accellion cross-complained against Illinois National. Accellion alleged that Foley, not yet a party, was liable to Accellion for breach of contract. Accellion alleged that Illinois National was "equally liable" because it stood "in [Foley's] shoes" by means of "an illegal assignment." Aside from Illinois National, Accellion named no other defendants, fictitious or otherwise.
Like Illinois National, Accellion did not refer to Foley by name, instead referring in its original cross-complaint to "the unnamed law firm." Accellion's counsel explained in a declaration that this was at Foley's request.
Illinois National successfully demurred to the cross-complaint. A different judge of the trial court ruled that Illinois National could not be liable to Accellion for breaches of contract imputed to the insured, because Illinois National was assigned only the insured's claims and not the insured's obligations. In this appeal, Accellion does not challenge the dismissal of its cross-claims against Illinois National.
In September 2023, the trial court authorized Accellion to file an amended cross-complaint naming Foley as a defendant, subject to a later demurrer or motion to strike.
Accellion filed its operative cross-complaint against Foley within a week. Foley demurred on the ground that the cross-complaint did not state facts sufficient to constitute a cause of action.
The trial court dismissed the cross-complaint. The trial court reasoned that Accellion's claims were untimely under a one-year lawsuit limitation in the EULA, and that Accellion's amended cross-complaint against Foley did not relate back to its original cross-complaint against Illinois National. In the alternative, the trial court ruled that Accellion's claims were without substantive merit because Accellion could not allege damages.
Accellion timely appealed from the judgment dismissing the cross-complaint.
II. DISCUSSION
Accellion does not dispute the trial court's determinations that (1) Accellion's claims are subject to the EULA's one-year limitations period, (2) timeliness is measured using California law, and (3) Accellion filed its cross-complaint against Foley more than one year after Accellion's claims accrued. Accellion instead contends that its cross-complaint against Foley is timely in that it either relates back to Accellion's November 2022 cross-complaint against Illinois National (and thence to Illinois National's January 2022 complaint) or merely corrects a misnomer by substituting Foley for Illinois National. We reject both contentions and affirm.
We do not reach the substantive sufficiency of Accellion's allegations.
A. Standard of Review
"In reviewing an order sustaining a demurrer, we examine the operative complaint de novo to determine whether it alleges facts sufficient to state a cause of action under any legal theory." (T.H. Novartis Pharmaceuticals Corp. (2017) 4 Cal.5th 145, 162.) In the exercise of our independent judgment, "we accept the truth of material facts properly pleaded in the operative complaint, but not contentions, deductions, or conclusions of fact or law. We may also consider matters subject to judicial notice." (Yvanova v. New Century Mortgage Corp. (2016) 62 Cal.4th 919, 924.)" '[F]or a demurrer based on the statute of limitations to be sustained, the untimeliness of the lawsuit must clearly and affirmatively appear on the face of the complaint and matters judicially noticed.'" (Schmier v. City of Berkeley (2022) 76 Cal.App.5th 549, 554.)
B. The EULA's Time Bar and Accrual of Accellion's Claims
The EULA provides that it "shall be governed by the laws of the United States and the State of California" and that "[a]ny dispute by one party to this Agreement against the other . . . must be brought . . . within one . . . year after the cause of action arises." Accellion does not suggest that it filed its October 2023 cross-complaint against Foley within one year after its causes of action arose. Instead, Accellion argues that its claims against Foley are timely if they relate back to the date Illinois National first sued Accellion.
Accellion's allegations establish that its claims accrued by at least January 24, 2022. Accellion identifies three theories of breach: (1) Foley failed to timely install patches, allowing its data to be stolen; (2) Foley paid the hackers a ransom without consulting Accellion; and (3) Foley allowed Illinois National to sue Accellion. Under any of these theories, the causes of action arose by at least January 24, 2022, when Illinois National sued Accellion. By that time Accellion had suffered harm caused by each of Foley's alleged breaches. (See Aryeh v. Canon Business Solutions, Inc. (2013) 55 Cal.4th 1185, 1191.)
Foley maintains that we should instead use January 2021 as the accrual date. We do not take up that argument, as Accellion's claims are untimely even using a January 2022 accrual date.
C. Relation Back and Amendment to Cure a Misnomer
Using a January 2022 accrual date, the claims accrued more than one year before Accellion first cross-complained against Foley in October 2023. Nevertheless, Accellion contends that the limitations period is no bar because (1) its amended cross-complaint against Foley relates back to its original cross-complaint against Illinois National; or (2) Code of Civil Procedure section 473 permitted Accellion to amend its complaint to substitute Foley for Illinois National after the limitations period expired. We reject both arguments.
Undesignated statutory references are to the Code of Civil Procedure.
Under the relation-back doctrine, the filing date of an earlier complaint may be treated as the filing date of a later amended complaint to satisfy the statute of limitations. (See Barrington v. A. H. Robins Co. (1985) 39 Cal.3d 146, 150.) But generally, as Accellion concedes, "an amended complaint that adds a new defendant does not relate back to the date of filing the original complaint." (Woo v. Superior Court (1999) 75 Cal.App.4th 169, 176 (Woo).) "A recognized exception to the general rule is the substitution under section 474 of a new defendant for a fictious Doe defendant . . . as to whom a cause of action was stated in the original complaint." (Ibid.; see also § 474 ["When the plaintiff is ignorant of the name of a defendant, he must state that fact in the complaint"].) But that exception is inapplicable here: The only defendant against whom Accellion in its original cross-complaint attempted to plead a claim was Illinois National-it did not plead a claim for relief against Foley or any fictitiously named defendant.
Accellion argues that section 474 applies here because it referred to Foley ("the unnamed law firm") throughout its cross-complaint against Illinois National. To be sure, Accellion's claims against Illinois National were predicated at least in part on Illinois National's alleged assumption by assignment of Foley's liability for contractual breaches.
But section 474 requires a fictitious defendant, not a fictitious nonparty. Without any previously named fictitious defendant, section 474 is inapplicable. (Woo, supra, 75 Cal.App.4th at p. 176 [noting that § 474 requires "that the new defendant in an amended complaint be substituted for an existing fictitious Doe defendant named in the original complaint"]; Ingram v. Superior Court (1979) 98 Cal.App.3d 483, 492, italics added ["amendment after the statute of limitations has run will not be permitted when the result is the addition of a party who, up to the time of the proposed amendment, was neither a named nor a fictitiously designated party to the proceeding"].) And section 474 also requires ignorance of the fictitious defendant's identity, not merely forbearance from public disclosure of an identity that is known.
Accellion urges us to expand section 474 to permit "amending a cross-complaint to state a cause of action against a third party when the plaintiff asserted in the complaint (and the trial court found) that the plaintiff, not the third party, was the real party in interest for claims arising from the same incident where the cause of action was not barred when the original complaint was filed." We decline this request to enlarge section 474 as a vehicle for equitable relief from the statute of limitations: "Statutes of limitations are '"' "adamant rather than flexible in nature"' and are' "upheld and enforced regardless of personal hardship." '" '" (Boyer v. Jensen (2005) 129 Cal.App.4th 62, 71 [rejecting equitable challenge to statute of limitations]; see also id. at p. 70 [rejecting novel argument that employer's statute of limitations should be tied to its employee's statute of limitations because the employer could be vicariously liable for the employee's conduct].)
The amended cross-complaint against Foley does not relate back to the original cross-complaint against Illinois National.
Accellion filed its original cross-complaint against Illinois National less than one year after Illinois National filed its complaint. In view of our determination that the amended cross-complaint does not relate back to the original cross-complaint, Accellion's contention that the filing of the original cross-complaint in turn relates back to Illinois National's complaint is immaterial. (See Trimdade v. Superior Court (1973) 29 Cal.App.3d 857, 859-860 [based on principles of waiver, statute of limitations to bring cross-claims against plaintiff is tolled by plaintiff's commencement of action; but this rationale does not extend to codefendants and new parties].) Accellion has not argued that Illinois National's complaint tolled the EULA's limitations period as to Accellion's claims against Foley.
Accellion alternatively contends that section 473 permitted Accellion to "correct[]" the name of the cross-defendant by changing its name from Illinois National to Foley after the limitations period had run. We disagree.
Although section 473, subdivision (a) permits amendment or correction of the complaint, the expiration of the statute of limitations "[a]s a general rule" will prevent "a replacement of parties." (Mayberry v. Coca Cola Bottling Co. (1966) 244 Cal.App.2d 350, 352 (Mayberry).) "[A]n 'exception to the general rule' . . . permits correction where the plaintiff has committed an excusable mistake attributable to dual entities with strikingly similar business names or to the use of fictitious names." (Mayberry, at p. 353.) But there is a "difference between a plaintiff who has committed an excusable mistake and one who seeks a free option among potential liability targets after the statute has run." (Ibid.; see also Camfax v. Hercules Powder Co. (1965) 237 Cal.App.2d 44, 5758 (Canifax); Hawkins v. Pacific Coast Bldg. Products, Inc. (2004) 124 Cal.App.4th 1497, 1504 (Hawkims); Diliberti v. Stage Call Corp. (1992) 4 Cal.App.4th 1468, 14701471.)
Accellion's reliance on Mayberry and Camifax is unavailing. Both decisions permitted amendment precisely because the plaintiffs there were not using "the guise of a mistake of nomenclature" to "substitute a new party for a party sued." (Canifax, supra, 237 Cal.App.2d at p. 58; see also Mayberry, supra, 244 Cal.App.2d at pp. 353-354.) Here, Accellion was deliberate in its original identification of Illinois National as the cross-defendant and "the unnamed law firm" with which Accellion was "in contractual privity." Accellion's mistake, if any, was not of nomenclature but of legal calculation- its apparent determination that Foley's assignment of its claims to Illinois National meant that Illinois National was the only necessary or proper defendant for Accellion's claims.
In its reply brief, Accellion cites various cases applying section 473, subdivision (b). (See Zamora v. Clayborm Comtractimg Group, Imc. (2002) 28 Cal.4th 249, 254; Shapiro v. Clark (2008) 164 Cal.App.4th 1128, 1139-1140; Mimick v. City of Petaluma (2016) 3 Cal.App.5th 15, 24; Austim v. Los Amgeles Umified School Dist. (2016)
Once the statute of limitations has run, a plaintiff may amend the complaint "to change a party's description or characterization" if" 'the misdescription or mischaracterization is merely a misnomer or defect in the description or characterization,'" and not" 'a substitution or entire change of parties.'" (Hawkins, supra, 124 Cal.App.4th at p. 1504.) This case presents the latter scenario. Section 473, subdivision (a) does not permit Accellion to substitute Foley for Illinois National as a cross-defendant after Accellion's time to sue Foley elapsed.
Accellion, we note, acknowledges no independent mistake, misdescription, misnomer, or mischaracterization on its part. To the contrary, Accellion attributes all mistakes to the trial court, arguing that the trial court's orders comprised a "string of mistaken decisions." Accellion asserts that the court in ruling on Accellion's demurrer found that Illinois National stood in Foley's shoes for all purposes, such that the court erred in when it later sustained Illinois National's demurrer because Foley's assignment to Illinois National made the latter the proper defendant on Accellion's cross claims. Accellion's insistence that Illinois National was a proper defendant under the assignment does not further its contention here that Foley was the proper defendant but for 244 Cal.App.4th 918, 928-929.) These cases, none of which were cited in Accellion's opening brief, are inapposite.
Accellion's reasonable mistake. We do not address Accellion's suggestion that the trial court's first two orders were erroneous.
Accellion disclaims any appellate challenge "at this stage" to the order sustaining Illinois National's demurrer.
Accellion implies that the trial court's orders induced it to believe that it should name Illinois National, and not Foley, in its first cross-complaint. But Accellion has not tethered its asserted justification to any legal theory permitting its untimely filing of its cross-complaint against Foley, notwithstanding the shortened limitations period in Accellion's EULA. Although section 473, subdivision (b) might have provided for relief from a judgment or dismissal caused by counsel's mistake or excusable neglect, Accellion sought no such relief in the trial court and may not seek it here in the first instance.
III. DISPOSITION
We affirm the trial court's January 11, 2024 judgment.
WE CONCUR: DANNER, Acting P.J. WILSON, J.