Software company lacked ‘downstream’ liability for data breach

According to Massachusetts Lawyer Weekly, a software company could not face “downstream” liability for a data breach that led an end-user to settle a class action. The end-user Zoll Services had purchased Barracuda Network’s email archiving service through Fusion, a third‑party reseller, and vulnerabilities in Barracuda’s technology apparently caused the breach.

After Zoll’s insurer, Axis Insurance Co., paid a settlement in the ensuing class action, the insurer—standing in Zoll and Fusion’s shoes—sued Barracuda to recoup damages under a theory of equitable indemnification. A U.S. District Court judge, applying Massachusetts law, granted summary judgment to Barracuda, finding no derivative or vicarious relationship between Barracuda and Zoll to support such a theory. The 1st Circuit Court of Appeals affirmed the decision. The report on the decision was written by Eric T. Berkman for DataBreaches[.]Net on 30 December 2025.