.

David J. Shannon

Chair, Privacy and Data Security

Chair, Intellectual Property, Technology and Media Litigation

DJShannon@mdwcg.com

Portrait of David J. Shannon

Defense Digest

On the Pulse…Data Breaches and Ransomware Attacks: Getting to Know Marshall Dennehey’s Privacy and Data Security Practice Group

Defense Digest, Vol. 27, No. 4, September 2021

September 1, 2021

by David J. Shannon

Solar Winds, JBS, Kaseya…the list goes on and on each week, as more and more ransomware cyberattacks occur. The public is inundated with announcements of businesses being crippled by data breaches and ransomware attacks by foreign hackers and state-sponsored cyberterrorists. Here at Marshall Dennehey, our Privacy and Data Security Practice Group is focused on helping clients, large and small, in reducing their cyber risk exposures and guiding them through the inevitable incident response, containment and compliance measures that are needed after a data breach or ransomware attack occurs. Our firm is staffed to respond to time critical situations 24-7, and we work with clients to reduce their exposure to the risk and liability that happens when a cyberattack occurs.

Marshall Dennehey has been focused on data breach litigation since 2010, handling hundreds of data breaches and helping clients respond and recover. As we have seen, the rise of criminal ransomware and other data breach attacks can lead to crippling business interruption for businesses throughout the United States. Our ability to provide a customized approach is the key to our success in resolving all types of cyber incidents. We partner with each client, focusing on not only the future defense to litigation or regulatory action, but also the business’s ability to get back up and running as quickly as possible.

Our attorneys have assisted in corporate ransomware attacks where hundreds of thousands of dollars have been at stake. We have also helped smaller businesses, such as health care providers, with data breach mitigation to allow them to treat their patients in an uninterrupted environment.

In Philadelphia, Karen Grethlein and I handle a large portion of this litigation. Karen is a graduate of Johns Hopkins University and Drexel University Thomas R. Kline School of Law, and she has been with us since 2017. She is active in the Pennsylvania Bar Association and is the current president of the Philadelphia Chapter of the National Association of Women in Construction, where she has lectured on cybersecurity in the construction industry. Karen often advises clients of their statutory reporting obligations following a data breach and encourages them to adopt a proactive approach to data security.

R. David Lane, Jr., shareholder in our New York City office, devotes the entirety of his practice to privacy and data security, representing clients through all stages of data breach response, including investigations, compliance with data breach notification laws and regulatory investigations. Accredited by the International Association of Privacy Professionals as a Certified Information Privacy Professional CIPP/US, David routinely advises clients on legal compliance with state, federal, and international privacy and data security laws. He is a graduate of the University of Florida and the University of Florida Levin College of Law.

As chair of the practice group, I have been handling data breach litigation since the practice’s inception more than 10 years ago. When a breach involves the theft or disclosure of trade secrets, or the violation of a company’s social media policy, my experience as leader of the firm’s Technology, Media, and Intellectual Property Litigation Practice Group is put to good use. In this capacity, I am able to provide critical and immediate counsel, including assisting clients in appropriately and effectively communicating with employees who may be suspected of involvement with a breach incident. I am a graduate of Denison University and Widener University School of Law, and I frequently lecture on cybersecurity and data breach topics to insurance and legal audiences.

            As a full-service insurance defense firm, we have assisted health care, education, finance, banking, retail, energy and utility services throughout the United States in responding to data breaches. Our firm has handled these incidents in all 50 states, and also has handled international events. We work with the clients in notifying either a small number of individuals or hundreds of thousands of affected customers or patients. Working with our health care group, we are able to ensure that HIPAA/Hitech compliance occurs. We are able to ensure that educational FERPA regulations are complied with, as well as all financial and banking SEC and FINRA regulations.

Finally, we continue to assist retail entities in complying with the Payment Card Industry-Data Security Standards (PCI-DSS) compliance. With our extensive experience in defending business entities in consumer-related litigation, we have the attorney resources to manage every aspect of a data breach, from the initial scoping calls with forensic companies to class actions lawsuits that are filed by affected individuals.

If worries about cyberattacks keep you up at night, please don’t hesitate to get in touch. We are here to help and look forward to working with you.

*David, a shareholder, chairs the Privacy & Data Security Practice Group at Marshall Dennehey. He may be reached at djshannon@mdwcg.com or 215.5752615.

Defense Digest, Vol. 27, No. 4, September 2021 is prepared by Marshall Dennehey Warner Coleman & Goggin to provide information on recent legal developments of interest to our readers. This publication is not intended to provide legal advice for a specific situation or to create an attorney-client relationship. ATTORNEY ADVERTISING pursuant to New York RPC 7.1. © 2021 Marshall Dennehey Warner Coleman & Goggin. All Rights Reserved. This article may not be reprinted without the express written permission of our firm. For reprints, contact tamontemuro@mdwcg.com.

Firm Highlights

Result

No-Cause Jury Verdict Secured in Wrongful Death Trial

We successfully obtained a no-cause jury verdict in a 13-day wrongful death trial. The decedent, a 59-year-old man, was admitted to the emergency room on February 15, 2019, with complaints of abdominal pain, decreased appetite, and constipation, despite the use of laxatives. The patient did not complain of any nausea, vomiting, or diarrhea. He had a significant medical history including diabetes, hypertension, prior coronary artery stenting, morbid obesity (with past gastric bypass surgery), longstanding ventral hernia, and back pain. A CT scan revealed multiple hernias and a potential closed-loop bowel obstruction, leading to a surgery consultation. Our client, an emergency general surgeon, interpreted that the patient did not have a closed loop or any significant obstruction and recommended non-surgical management. The patient was approved to have clear liquids, and had a vomiting incident shortly after, but our client was not notified. The patient was returned to NPO status, and after improving overnight, he was returned to “clears” and additional medical and renal consults were ordered. Our client did not receive any communications from the residents/nurses of any changes in the patient’s condition. On February 18, 2019, two rapid responses were called due to increased heart rate and vomiting. It is believed that the vomiting resulted in aspiration, causing sepsis, ultimately leading to the patient’s death. During the trial, the plaintiff’s sole medical expert highlighted imaging on the wrong hernia, which called into question all of his opinions in the case. We made key objections related to the expert testimony, limiting what the allegations were, and preventing new allegations from being made. After approximately two and a half hours of deliberating, the jury returned a no-cause verdict. 

News

Marshall Dennehey Again Earns Recognition in Distinguished Chambers USA

Result

Summary Judgment Secured, Preserving $750,000 in Coverage for Insured in Major Trucking Liability Dispute

Ray Freudiger and Michael A. Roberts (both of Cincinnati) successfully obtained summary judgment on behalf of their client in a coverage dispute arising from a May 19, 2022, motor vehicle accident. A permissive driver operated a box truck for an interstate trucking company and caused severe injuries to two tort victims. Prior to the accident, the insured had procured a commercial auto policy for the trucking company with stated limits of $1,000,000. Following the accident, the insurer initiated a declaratory judgment action asserting that only reduced bodily injury limits of $25,000/$50,000 applied and later counterclaimed, alleging it would not have insured the driver had he been properly submitted for approval under the policy. After extensive discovery, briefing, and oral argument, the court rejected the insurer’s attempt to shift responsibility for the $750,000 in coverage it was legally required to provide for permissive drivers under Ohio law, granting summary judgment in favor of the insured and preserving $750,000 in liability exposure.

graphic with Maria Granaudo photo text announces she has joined the firm as a shareholder in the Health Care Dept.

News

Maria R. Granaudo Joins Marshall Dennehey’s Wilmington Office As a Shareholder in the Health Care Department

News

Christina Gonzales To Speak at the Women of Color Roundtable at DRI’s Diversity and Inclusion Seminar

Thought Leadership

PA Middle District Dismisses Claims Against School District and its Superintendent, Principal, Special Education Director, and Classroom Teacher

A five-year-old special education student was enrolled in the Wyoming Valley West School District and attended the State Street Elementary School during the 2024-2025 school year. The student refused to clean up classroom toys at dismissal. When his teacher allegedly grabbed him by the wrist to walk him back to his seat, the student dropped to the floor and began crying. The teacher then allegedly grabbed the student by the ankle and dragged him across the floor. Following an investigation, criminal charges were not advanced by the county DA, and the school permitted the teacher to return to the classroom. The student’s parents sued, lodging thirteen legal counts under both state and federal law, which sought monetary damages from the teacher, the school district, the superintendent, the principal, and the director of special education. The plaintiff’s 42 USC 1983 claims were dismissed as to the school district for failure to allege a policy or custom violation, and the failure to alleged deliberate indifference in the failure-to-train context. As to the superintendent, building principal, and special education director, the Section 1983 claims were also dismissed for failure to allege personal involvement on the part of the individuals. Regarding an equal protection claim asserted against all defendants, the motion to dismiss was also granted for a failure to advance a plausible equal protection claim, holding that “plaintiffs' single-act allegations do not include a factual basis to even infer that the act was motivated by discriminatory animus rather than some other non-discriminatory impulse.” The court further dismissed the plaintiff’s negligence-based claims including negligence against the teacher and district administrators, NIED, and vicarious liability under the Political Subdivision Tort Claims Act (PSTCA). The federal claims under the IDEA, Section 504, and the ADA were also dismissed in various respects. The IDEA claim was dismissed against all defendants with prejudice for failure to exhaust administrative remedies. The Section 504 claims against the individual defendants were also dismissed with prejudice, as districts, not individuals, are the recipients of federal funds under Section 504. However, the Section 504 and ADA claims were dismissed without prejudice as to defendant Wyoming Valley West, and the plaintiff was permitted leave to amend.

Thought Leadership

Marijuana Legalization and Workplace Risk: What New Jersey Employers Need to Know

While the legalization of recreational marijuana usage poses a risk of increased work-related accidents for younger workers, employers can work to curb this increase by investing in education, effective drug policies, and employee assistance programs.

Event

29th Annual FDLA Florida Liability Claims Conference

Jim and Erica will team up to present, "Supporting the Next Generation: Connecting with Associates." This panel-style presentation will explore communication best practices from the perspective of a senior shareholder and newer associate. The discussion will focus on the communication styles of different generations and effective strategies to avoid communication breakdowns. Topics to be discussed include the hiring process, perceptions of defense work among newer lawyers, work-life balance issues after hiring, and mentoring.

Thought Leadership

U.S. Supreme Court Decides Key Issue Regarding Interstate Freight Broker Liability

Freight brokers are intermediaries.  They connect shippers of goods with trucking companies that transport those goods.  Freight brokers match a load of freight with a trucking company and oversee the logistics of the transportation. For a number of years there has been a division among the Federal Circuits regarding the potential liability of freight brokers when the trucking companies that they retain for interstate loads are involved in accidents.  At the center of this division was the Federal Aviation Administration Authorization Act of 1994 (FAAAA).  Some Federal Circuit Courts have held that state law negligent hiring claims against freight brokers were preempted by the FAAAA .  Other Federal Circuits Courts have held that even if preemption applied, the “safety exception” in the FAAAA saved state law negligent hiring claims from federal preemption.  On May 14, 2026, the U.S. Supreme Court addressed the conflict in Montgomery v. Caribe Transport II, LLC, et al, No24-1238. In that case freight broker C.H. Robinson selected Caribe Transport to haul an interstate load. The commercial truck driver employed by Caribe Transport allegedly caused an accident and the plaintiff, Montgomery, was seriously injured. Montgomery brought an action against the driver, Caribe Transport and C.H. Robinson. The allegation against C.H. Robinson was that it negligently retained Caribe Transport when it knew, or should have known, that it was an unsafe company. The Seventh Circuit Court of Appeals held that Montgomery’s claims against C.H. Robinson were preempted by the FAAAA. The plaintiff appealed to the U.S. Supreme Court.  The U.S. Supreme Court’s decision focused primarily on the safety exception in the FAAAA.  That provision provides that the FAAAA preemption “…shall not restrict the safety regulatory authority of a State with respect to motor vehicles.” C.H. Robinson argued, as freight brokers historically have, that their function was not “with respect to motor vehicles” because they do not own trucks or employ drivers. They are merely intermediaries, connecting entities who need freight moved with entities who can do that job. Therefore, C.H. Robinson argued that preemption applied, not the safety exception. The U.S. Supreme Court did not accept that argument. The Court focused on the meaning of the phrase “with respect to” in the safety exception. The Court held that it means “referring to”, “concerning” or “regarding”. Therefore, writing for a unanimous Court, Justice Barrett concluded that “[r]equiring C.H. Robinson to exercise ordinary care in selecting a carrier therefore “concerns” motor vehicles—most obviously, the trucks that will transport the goods. So, Montgomery’s negligent-hiring claim falls within the FAAAA’s safety exception, which saves it from preemption.” Justice Kavanaugh, in his concurring opinion, noted the effect this ruling may have on freight brokers and their insurers throughout the country: Importantly, the Court's decision today should not be read to mean that brokers will routinely be subject to state tort liability in the wake of truck accidents. As even plaintiff's counsel stressed, brokers should be able to successfully defend against state tort suits if the brokers have acted reasonably and arranged transportation with reputable trucking companies. Tr. of Oral Arg. 27-29. In plaintiff's counsel's words, the brokers "just have to hire carriers that actually have a reasonable policy," and "the broker is not going to have a problem if it's asking the hard questions of the carrier." Id., at 42, 45. In addition, the proximate-cause requirement in typical state tort law should help protect brokers from excessive liability. Id., at 25. That said, the brokers rightly caution against naivete. In the real world, as the brokers forcefully respond, state tort law can be unpredictable, and the costs to brokers of litigation and insurance may be significant even when brokers prevail in lawsuits. Moreover, the costs of litigation and insurance, as well as the costs of brokers' conducting more substantial inquiries into trucking companies, will cascade through the economy and be paid in part by American consumers in the form of higher prices. The concerns expressed by the brokers are legitimate and weighty. The key point here is that freight brokers can no longer claim they are protected from negligent retention claims by the FAAAA (in cases involving interstate transportation). The challenge will be to determine what is considered ”reasonable efforts” used by brokers when retaining transportation companies. 

blue facade of a hospital sign against blue sky

Result

Defense Verdict in Complex Medical Malpractice Trial