Melanie Conroy Quoted in Massachusetts Lawyers Weekly: Software Company Lacked ‘Downstream’ Liability for Data Breach

Excerpted from the December 29, 2025 online edition of Massachusetts Lawyers Weekly.

A recent First Circuit decision found that a software company could not face “downstream liability for a data breach that resulted in an end-user having to settle a class action suit.”

After Zoll Services purchased defendant Barracuda Network’s email archiving service through a third-party reseller, Zoll suffered a data breach due to “vulnerabilities in Barracuda’s technology.”

Zoll’s insurer, Axis Insurance Co., paid to settle the ensuing class action, and then sued Barracuda seeking to recoup the damages under the theory of “equitable indemnification.” The First Circuit affirmed the District Court’s decision granting summary judgment to Barracuda finding, “no derivative or vicarious relationship between Barracuda and Zoll to support that theory.

Pierce Atwood litigation, class action, and data security partner Melanie Conroy noted that, “the decision makes clear that equitable indemnification is a specific, relationship-bound remedy and not a tool for reallocating risk after the fact. Companies should not expect courts to use equity to impose upstream protections from independent contractors several layers removed.

“When a vendor ecosystem is built by contract, risk mitigation must also be contractual. Businesses should mitigate data breach litigation risk through clear liability allocation, flow-down indemnities, audit and assurance rights, and enforceable post-incident obligations.”

The complete article by Eric Berkman can be found on the Massachusetts Lawyers Weekly website.

Melanie Conroy is a strategic, risk-ready, and results-driven litigation partner focused on class and mass action defense and complex commercial disputes in a wide range of industries, including financial services, insurance, technology, construction, life sciences, retail and consumer goods, real estate, energy, manufacturing, and media. Melanie regularly leads matters involving multistate consumer claims, business and Chapter 93A disputes, complex breach of contract allegations, and privacy and data breach litigation.