E. Michelle Drake
Data Breach · Credit Reporting · Privacy · Consumer Class Actions
“By leading this important MDL to a successful conclusion, I hope to ensure that large corporations begin taking data security seriously, and stop putting peoples’ sensitive personal information in web-facing locations that are not properly secured.
The Envelope Was the Breach
In the summer of 2017, the sister of a 52-year-old man in Bucks County, Pennsylvania, learned from the window of an unopened envelope Aetna had mailed him that he was taking HIV medication. He was taking it to prevent infection. On August 28, 2017, he sued Aetna in federal court in Philadelphia under the name Andrew Beckett, the lead character in the 1993 film Philadelphia, and E. Michelle Drake of Berger Montague became one of the co-lead lawyers for the Aetna members who had received such letters.
A Notice Required by an Earlier Settlement
Aetna had mailed the letters on July 28, 2017, to tell members about a change in how they could fill prescriptions for HIV drugs, a notice required by its settlement of earlier suits over its mail-order rules. It had sent the names of 13,487 members prescribed HIV medications to its lawyers and a mailing vendor, and 11,875 of them received the notice in an envelope with a large transparent window. According to New Jersey’s attorney general, the windows showed members’ names and addresses and the words “HIV Medications,” in whole or in part.
Drake and John Albanese of Berger Montague served as co-lead class counsel with the AIDS Law Project of Pennsylvania and the Legal Action Center. On January 16, 2018, Aetna agreed to pay $17,161,200 into a settlement fund, none of it to revert to Aetna. Each person sent the notice was to receive at least $500 without filing a claim, and people who documented financial or other harm could recover up to $20,000 more; Aetna also agreed to adopt a policy for handling members’ health information in litigation and to train its in-house lawyers on it. The court granted final approval on October 16, 2018, and the first checks went out on December 28, with a base payment of $642.43 for each person who had been sent the notice.
Capital Cases in Atlanta
Drake graduated cum laude from Harvard College with a degree in government, earned a master’s degree in sociology at Oxford University and graduated cum laude from Harvard Law School. She began practicing in 2001 as a public defender in Atlanta, handling serious criminal cases and representing people facing the death penalty, including at trial. She chairs the board of the Southern Center for Human Rights.
After moving to Minnesota, she joined Berger Montague on January 1, 2016, and opened its Minneapolis office, which she manages. She is an executive shareholder of the firm, chairs its Credit Reporting and Background Checks Department and co-chairs its Consumer Protection and its Technology, Privacy and Data Breach departments.
Cancelled and Replaced
After Target disclosed on December 19, 2013, that its customers’ payment-card and personal information had been compromised, the consumer suits were consolidated before Judge Paul A. Magnuson in Minnesota as In re Target Corp. Customer Data Security Breach Litigation, and Drake was appointed liaison counsel for the consumer track. Target agreed to pay $10 million, with full compensation of documented losses up to $10,000 per claimant and a pro rata share for class members without documentation, and to adopt data-security measures. An objector argued that class members with no documented losses needed separate lawyers. In June 2018 the Eighth Circuit affirmed the settlement, the certification of the class and the fee award. Every class member could register for credit monitoring, Judge Bobby E. Shepherd wrote, and the issuing banks had cancelled and replaced the compromised cards; the two groups’ interests were “more congruent than disparate.” The court also noted that 11 of the 80 million class members had objected.
On January 19, 2024, Judge Allison D. Burroughs in Boston named Drake one of five lead counsel in In re MOVEit Customer Data Security Breach Litigation, brought after a ransomware group exploited a previously unknown flaw in Progress Software’s MOVEit file-transfer program in 2023, a breach that led to more than 100 class actions. On October 2, 2024, Judge Donovan W. Frank in Minnesota named her one of three co-lead counsel for the provider track in In re Change Healthcare, Inc. Customer Data Security Breach Litigation, brought for doctors and other providers whose payments were disrupted after a cyberattack on Change Healthcare in late February 2024. Earlier she chaired the consumer class-action committee in the JUUL litigation in San Francisco, where the consumer class settlement came to $255 million, and obtained a settlement valued at $110 million in force-placed-insurance litigation against Citibank.
When the Database Names the Wrong Person
In October 2019, Marco A. Fernandez applied for a mortgage, and the lender, Pulte Mortgage, ordered a credit report from CoreLogic Credco. The report, he alleged, placed him on the Treasury Department’s list of Specially Designated Nationals as “a match to a suspected narcotics trafficker,” a man who lived in Mexico and whose name, birth date and address differed from his. He sued in federal court in San Diego, challenging CoreLogic’s practice of matching consumers to the list by name alone, and Drake was among the Berger Montague lawyers appointed class counsel. On June 20, 2024, Judge Jeffrey T. Miller gave final approval to a $58.5 million settlement covering an inaccurate-reporting class of about 705,000 people, and CoreLogic agreed to keep procedures under which its reports would call no one a “possible match” when only the name matched.
In Rodriguez v. National Credit Center, in Nevada, Drake led a class action for car buyers whom the company had reported as matches to the same list when they applied for financing; it settled in 2024 for $30 million.
Reported as Deceased
In May 2022, Drake and her colleagues sued TransUnion in federal court in Philadelphia for Ricky Christian and other consumers. Their complaint describes a TransUnion product, sold as IDVision and later as TruValidate, that notes whether a Social Security number has been used in a claim for Social Security death benefits; once the flag is added, the complaint says, TransUnion “marks the consumer as deceased and refuses to provide a credit score.” In 2021, it alleges, TransUnion reported to an RV dealer and four insurers, among others, that Christian’s number had been used in such a claim, in a record naming a man born in 1903. He disputed the entry by telephone on April 23, 2021.
Jennifer Aparicio, another plaintiff, was born in 1990 and lives in Texas. The complaint alleges that TransUnion has reported her as deceased for essentially all of her adult life, on the strength of a death-benefits claim for a woman born in 1913 who died in California in 1981. She has been turned down for credit cards, among them a secured card on June 30, 2023, and her landlord required a deposit of $1,500, three times the usual $500, because she was reported as deceased and had no credit score.
