APPEAL FROM THE UNITED STATES DISTRICT COURT FOR THE DISTRICT OF MASSACHUSETTS

[Hon. Nathaniel M. Gorton, U.S. District Judge]

Before

Gelpí, Thompson, and Montecalvo, Circuit Judges.

Stephen D. Rosenberg, with whom Wagner Law Group was on brief, for appellant.

Christopher P. Silva, with whom Joseph L. Demeo, Michael R. Stanley, Samuel B. Goodwin, and DEMEO LLP were on brief, for appellees.

November 20, 2025

Page 2GELPÍ , Circuit Judge . This case stems from a 2018 data breach at Barracuda Networks, Inc., ("Barracuda") that exposed the protected health information ("PHI") of patients of Zoll Services LLC, a subsidiary of Zoll Medical Corporation (collectively, "Zoll"). Zoll had obtained its data-security services from Fusion, LLC ("Fusion"), which in turn relied on Barracuda's technology to fulfill its contract with Zoll. Axis Insurance Company ("Axis"), in its derivative capacity as Zoll's assignee and Fusion's subrogee, now brings tort and contract claims against Barracuda. The district court granted Barracuda's motion for summary judgment on all claims. For the reasons stated below, we affirm .

In reviewing the district court's decision granting summary judgment to Barracuda, we recite the facts in the record in the light most favorable to Axis and draw all reasonable inferences from those facts in its favor. See Sutherland v. Peterson's Oil Serv., Inc., 126 F.4th 728, 734 (1st Cir. 2025).

Fusion and Barracuda's corporate predecessors 1 entered into an Original Equipment Manufacturer agreement ("OEM") through Page 3which Fusion was allowed to resell Barracuda's email archiving services to its customers. The OEM was conditioned on Fusion's inclusion of appropriate limitation of liability and indemnification language in its customer contracts. The OEM included a provision reserving Barracuda's right to "audit . . . all applicable books and records relating to the [services provided by Barracuda]" and a clause stating that "[n]o failure or delay of [Barracuda] in exercising any right or remedy under [the OEM] shall operate as a waiver of such right" ("anti-waiver provision").

Shortly after the OEM, Zoll -- a company that sells medical devices and receives and stores customer PHI -- became a Fusion customer, acquiring services for electronic messaging and email communications. The contract between Fusion and Zoll ("Hosting Agreement") did not include appropriate limitation of liability or indemnification provisions, as required by the OEM. Zoll separately entered into a Health Insurance Portability and Accountability Act ("HIPAA") Business Associate Agreement ("BAA") with Fusion in which Fusion agreed to, among other things, use appropriate safeguards to prevent unauthorized use or disclosure of PHI and ensure that any subcontractor or vendor to whom it provides PHI agreed to the same restrictions and conditions Page 4regarding the protection of PHI. There is no evidence that Fusion ever ensured Barracuda's compliance with the BAA.

In 2018, a data breach at Barracuda exposed Zoll's HIPAA-protected customer information to an unauthorized third party. Following the breach, Zoll's affected customers brought a class action lawsuit against Zoll. Zoll settled with its customers and was responsible for the payment of damages to the class members.

In 2020, Zoll commenced arbitration proceedings against Fusion and the instant litigation against Barracuda. Fusion successfully moved to intervene in the litigation as a Rule 20 Party and asserted claims against Barracuda. In a previous order, the district court dismissed most of their claims, but retained Zoll's claim of equitable indemnification and Fusion's claims of breach of contract and breach of the covenant of good faith.

Pursuant to the parties' arbitration and settlements, Zoll and Fusion's claims against Barracuda were assigned to Axis -- Fusion's insurer. Axis was thus substituted as plaintiff in 2022.

After discovery, Barracuda moved for summary judgment against Axis on the surviving claims. The district court granted Barracuda's motion. First, the district court held that Zoll and Barracuda's relationship "c[ould] best be described as one of an Page 5independent contractor," and that this status, without more, did not create the derivative or vicarious relationship required for equitable indemnification under Massachusetts law. Second, the court held that the breach of contract claim could not proceed because Fusion failed to fulfill a condition precedent in the OEM when it failed to include the appropriate limitation of liability or indemnification language in its customer contracts, and Barracuda had not waived that condition. Finally, the court held that Axis could not prove its claim of breach of the covenant of good faith and fair dealing because it failed to demonstrate a contractual right to which Fusion was entitled in the event of a data breach. Thus, the covenant could not be used to create rights that did not exist in the contractual relationship.

Axis timely appealed.

We review the district court's summary judgment rulings de novo. Cruz-Cedeño v. Vega-Moral, 150 F.4th 1, 5 (1st Cir. 2025). Summary judgment is appropriate if, based on the record, there remains no dispute of material fact -- that is, if "there is no factual determination which a 'rational factfinder' could make as to the 'existence or nonexistence' of a fact that 'has the potential to change the outcome of the suit' -- such that 'the moving party is entitled to judgment as a matter of law.'" Ithier Page 6v. Aponte-Cruz, 105 F.4th 1, 6 (1st Cir. 2024) (quoting Borges ex rel. S.M.B.W. v. Serrano-Isern, 605 F.3d 1, 4-5 (1st Cir. 2010)); see Fed. R. Civ. P. 56(a). Summary judgment is also appropriate if the nonmoving party "fails to make a showing sufficient to establish the existence of an element essential to [their] case" with respect to which they "bear the burden of proof." Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986); see also Baez v. Baymark Detoxification Servs., Inc., 123 F.4th 62, 66 (1st Cir. 2024).

This case arises in diversity of citizenship jurisdiction and asserts claims under Massachusetts law. See 28 U.S.C. § 1332. In reviewing the district court's decision, "we look to federal law for the summary judgment framework and to state law for the substantive rules of decision." FinSight I LP v. Seaver, 50 F.4th 226, 230 (1st Cir. 2022).

Axis argues that the district court erred in denying it equitable indemnification from Barracuda in relation to Zoll's settlement with its customers. Axis claims that the district court erred by analyzing the legal status of the parties' relationship, when it should have instead focused on their relationship in reference to the factual circumstances. In Axis's view, vicarious or derivative liability does not depend on "the legal characterization of the [parties'] relationship," but on whether Page 7the facts "demonstrate that [Zoll] can be held derivatively or vicariously liable due to the acts of [Barracuda]." We disagree and conclude that Zoll and Barracuda did not have a relationship that could sustain an equitable indemnification claim.

Under Massachusetts law, "indemnity . . . allows someone who is without fault, [but] compelled by operation of law to defend himself against the wrongful act of another, to recover from the wrongdoer the entire amount of his loss." Elias v. Unisys Corp., 573 N.E.2d 946, 948 (Mass. 1991). "This right to indemnity is limited to those cases in which the would-be indemnitee is held derivatively or vicariously liable for the wrongful act of another." Decker v. Black & Decker Mfg. Co., 449 N.E.2d 641, 645 (Mass. 1983) (citation omitted). Derivative and vicarious liability only arise where the relevant parties are in a relationship that permits courts to hold one responsible for another's conduct. See Elias, 573 N.E.2d at 948 (explaining how, under Massachusetts law, vicarious liability "arises simply by the operation of law and is only derivative of the wrongful act of the agent"); Leonard v. Blake, 10 N.E. 2d 469, 470 (Mass. 1937) ("The liability of the mother . . . was based, not on any personal fault, for there was none, but on the agency relationship which existed between the mother and her negligent daughter. Her liability was derivative, not arising from any wrong committed by her."); Hollywood Barbecue Co. v. Morse, 50 N.E. 2d 55, 56 (Mass. 1943).

Page 8The rule reflects a balance: the law imposes vicarious liability on an otherwise-blameless party to "increase[] the likelihood that an injury will be compensated, by providing two funds from which a plaintiff may recover," Elias, 573 N.E.2d at 948, yet it tempers that result by providing the blameless party a right to seek reimbursement from the true wrongdoer, see id.

In order to survive summary judgment, the would-be indemnitee must present sufficient evidence showing that it is liable only because the law imposes on it responsibility for another's wrongdoing. See FinSight I LP, 50 F.4th at 230 (explaining that federal courts follow the federal law standard for summary judgment); see also Santos v. Chrysler Corp., 715 N.E.2d 47, 62 (Mass. 1999) (describing the rule for equitable indemnification under Massachusetts law). Massachusetts law recognizes such responsibility in certain legally defined relationships, including employer-employee, principal-agent, manufacturer-retailer, and some independent contractor relationships. See, e.g., Elias, 573 N.E.2d at 946 (employer-employee); Chapman v. Bernard's Inc., 198 F.R.D. 575, 579 (D. Mass. 2001) (principal-agent); Santos, 715 N.E.2d at 51 (manufacturer-retailer); Garbincius v. Boston Edison Co., 621 F.2d 1171, 1176 (1st Cir. 1980) (independent contractor). So Axis must have presented sufficient evidence that would tend to show that Zoll and Barracuda had any of these types of relationships.

Page 9Axis presented no such evidence. The only evidence of record are the provisions in the OEM and the Hosting Agreement characterizing Barracuda's relationship with Fusion and Zoll's relationship with Fusion, respectively, as independent contractor relationships. None of these documents have any bearing on Zoll's relationship with Barracuda. And even if their relationship could somehow be characterized as one of independent contractor, 2 "Axis ma[de] no claim that Zoll was anything more than an independent contractor" and never claimed "that derivative liability exist[ed] . . . in spite of the independent contract[or] status." Axis Ins. v. Barracuda Networks, Inc., 749 F. Supp. 3d 222, 227 (D. Mass. 2024). An independent contractor status alone is insufficient to create derivative or vicarious liability. Lyon v. Morphew, 678 N.E.2d 1306, 1310 (Mass. 1997).

Axis does offer up some caselaw to try to support its contention that the facts (and the facts alone) can sustain an equitable indemnification action, even if there is not a traditional derivative liability relationship. But we do not think Axis reads any of those cases correctly. The natural place to Page 10start is Decker v. Black & Decker Manufacturing Company, 449 N.E.2d 641 (Mass. 1983). There, the Supreme Judicial Court said what we think is the crucial point: the "right to indemnity is limited to those cases in which the would-be indemnitee is held derivatively or vicariously liable for the wrongful act of another." Id. at 645.

With that in mind, we cannot make much of Axis's argument that the Decker court (or its progeny) "did not hold that the relationship between the party seeking indemnity and the party from whom indemnity is sought, in and of itself, determined the existence or lack thereof of common law or equitable indemnification." Contrariwise to Axis, we think that is precisely what the court said. See id. If not to put some guardrails on equitable indemnity based on legal relationships, why else would it "limit[]" the action "to those cases in which the would-be indemnitee is held derivatively or vicariously liable"? Id. We just don't see it. And with that settled, our take on Axis's other cited cases, all relying on Decker, shake out the same way. See Fireside Motors, Inc. v. Nissan Motor Corp., 479 N.E.2d 1386, 1388 (Mass. 1985) (citing Decker, among other cases, for the same proposition); Ferreira v. Chrysler Grp. LLC, 13 N.E.3d 561, 567 (Mass. 2014) (citing Decker and Fireside Motors for the same proposition); Fraco Prods., Ltd. v. Bostonian Masonry Corp., 995 N.E.2d 1125, 1129-30 (Mass. App. Ct. 2013).

Page 11Because Axis failed to present any evidence probative that the parties share a relationship that imposes derivative or vicarious liability, Zoll's claim of indemnification must fail. See Celotex Corp., 477 U.S. at 322 (moving party entitled to summary judgment when nonmoving party fails to make sufficient showing on essential element with respect to which it bears the burden of proof); see also Baez, 123 F.4th at 66.

Axis argued before the district court that Barracuda breached its contract with Fusion by failing to provide the services required by the OEM: data hosting that properly protected Zoll's patients' PHI. Barracuda replied that Axis could not maintain its breach of contract claim because the Hosting Agreement failed to meet a condition precedent -- the inclusion of a provision limiting Barracuda's liability -- imposed by the OEM . At the motion to dismiss stage, the district court agreed with Barracuda and held that Fusion did not comply with the condition precedent.³ Still, Axis maintained throughout the summary judgment briefing that the claim could proceed because Barracuda supposedly waived the OEM's condition precedent by declining to exercise its contractual right to audit Fusion's customer contracts. Alternatively, Axis claimed that Barracuda was estopped from Page 12relying on the condition precedent to deny liability. The district court rejected that argument, holding that there was no genuine issue of material fact precluding summary judgment, that Barracuda had not waived the condition precedent, and that it was not estopped from relying on it. On appeal, Axis challenges the district court's conclusions. Reviewing de novo, we see no reason to reverse.

Axis argues that the district court erred in granting summary judgment on the issue of whether Barracuda waived the OEM's condition precedent because waiver is an issue for the factfinder. Axis further maintains that, because its claim is "not devoid of any reasonable factual support," the district court "usurped" the role of the jury by finding no genuine issue of material fact precluding summary judgment.

Axis misunderstands the standard for summary judgment. Although waiver is ordinarily an issue for the factfinder, it may be resolved on summary judgment when the evidence of waiver -- or lack thereof -- is "clear, unequivocal and undisputed." Bachorz v. Miller-Forslund, 703 F.3d 27, 32 (1st Cir. 2012) (quoting Metro. Transit Auth. v. Ry. Exp. Agency, Inc., 84 N.E.2d 26, 28 (Mass. 1949)). A "genuine" issue exists only if there is "sufficient evidence supporting the claimed factual dispute" to require a choice between "the parties' differing versions of the truth at Page 13trial." Garside v. Osco Drug, Inc., 895 F.2d 46, 48 (1st Cir. 1990) (quoting Hahn v. Sargent, 523 F.2d 461, 464 (1st Cir. 1975)).

Here, the material facts are not in dispute. Axis relies on two facts as evidence: 4 (1) the OEM's provision affording Barracuda a contractual right to audit Fusion's books and records -- which it contends extends to its customer contracts -- and (2) Axis's allegation that Barracuda failed to exercise such contractual rights. Barracuda's anti-waiver provision in the OEM counters this evidence. Both parties agree on these facts.⁵ Thus, the only remaining issue is whether Axis's Page 14allegations amount to waiver. That legal question is appropriately resolved on summary judgment. See id.; see Dunkin' Donuts v. Panagakos, 5 F. Supp. 2d 57, 62 (D. Mass. 1998) (summary judgment entered against party claiming waiver).

A condition precedent may be waived by the party it favors, see Am. Title Ins. v. E. W. Fin., 16 F.3d 449, 459 (1st Cir. 1994), if the party either expressly or impliedly manifests intent to relinquish voluntarily a right and "no other reasonable explanation" exists for that surrender, KACT, Inc. v. Rubin, 819 N.E.2d 610, 616 (Mass. App. Ct. 2004) (citation omitted). Under Massachusetts law, waiver must be premised upon "clear, decisive and unequivocal conduct" by the waiving party. Paterson-Leitch Co. v. Mass. Mun. Wholesale Elec. Co., 840 F.2d 985, 992 (1st Cir. 1988) (emphasis omitted) (quoting D. Federico Co. v. Commonwealth, 415 N.E.2d 855, 858 (Mass. App. Ct. 1981)). The burden of proving waiver is on the party asserting it. Dunkin' Donuts, 5 F. Supp. 2d at 61 (citation omitted).

Axis cannot meet its burden to establish waiver because the only conduct it points to is Barracuda's silence. Lower courts have previously found it "doubtful that mere silence could satisfy" the standard for waiver. Id. (applying Massachusetts law).

Page 15Likewise, the leading treatise on contract law explains that "[m]ere silence, acquiescence, or inactivity is insufficient to show a waiver of contract rights when there is no duty to speak or act . . . . Similarly, forbearance to assert or insist on a right does not, by itself, constitute a waiver." 13 Richard A. Lord, Williston on Contracts § 39:35 at 653 (4th ed. 2025).

That guidance is directly on point here. After all, Barracuda had the right, not the obligation, to act. Cf. Dickow v. United States, 740 F. Supp. 2d 231, 238-39 (D. Mass. 2010) (noting that there could be no inference from silence when there is no duty to act). Under these circumstances, Barracuda's inaction toward exercising its right to audit cannot be viewed as a "clear" relinquishment of the condition precedent because its inaction is equally consistent with preserving its right as with surrendering it. Paterson-Leitch Co., 840 F.2d at 992. Moreover, against this silence is Barracuda's anti-waiver provision. While such a clause is "not dispositive," M.J.G. Props., Inc. v. Hurley, 537 N.E.2d 165, 167 (Mass. App. Ct. 1989), it reinforces our conclusion that the condition was not waived by affirmatively demonstrating Barracuda's intent to preserve its rights.

In sum, Axis has not met its burden in providing sufficient evidence tending to show that Barracuda waived the OEM's condition precedent.

Axis argues in the alternative that Barracuda is estopped from relying on the condition precedent to defeat the breach of contract claim and that the district court erred in holding otherwise. To establish estoppel, a party must show "(1) a representation intended to induce reliance on the part of a person to whom the representation is made; (2) an act or omission by that person in reasonable reliance on the representation; and (3) detriment as a consequence of the act or omission." Bongaards v. Millen, 793 N.E.2d 335, 339 (Mass. 2003). Axis cannot make this showing.

To support its estoppel claim, Axis argues that "[f]or years, Barracuda had declined to exercise its own contractual right to examine relevant customer contracts" and assess compliance with the OEM's conditions. And this "representation" (the term Axis uses to describe Barracuda's years of silence on the issue) apparently "led Fusion to consider itself to be in compliance with the contractual condition at issue." We are unpersuaded. While the law recognizes a kind of estoppel by silence, the doctrine applies only where there is a duty to act. See Marsh v. S. M. S. Co., 194 N.E. 97, 99 (Mass. 1935) (citation omitted). Here, no such duty existed. As explained before, the OEM might have allowed, but did not compel, Barracuda to ensure that Zoll's contracts complied with the OEM's terms. It was still Fusion's Page 17responsibility to comply. Thus, we agree with the district court that the failure to inquire is not grounds for equitable estoppel. Barracuda is entitled to summary judgment on Axis's breach of contract claim.

D. Fusion's breach of the covenant of good faith and fair dealing claim

Finally, Axis claims the district court erred by granting summary judgment for Barracuda on its breach of the covenant of good faith and fair dealing claim. In its view, "substantial evidence" supports the fact that Barracuda "deprive[d] Fusion of the benefit of its contractual bargain with Barracuda . " After reviewing de novo, we see no good reason to reverse the district court.

Every contract in Massachusetts is subject to an implied covenant of good faith and fair dealing. See Anthony's Pier Four, Inc. v. HBC Assocs., 583 N.E.2d 806, 820 (Mass. 1991) (citation omitted). It provides "that neither party shall do anything that will have the effect of destroying or injuring the right of the other party to receive the fruits of the contract." Id. (citation modified). The implied covenant exists so that neither party hinders performance of the contract, but it cannot be used to "create rights and duties not otherwise provided for in the existing contractual relationship." Ayash v. Dana-Farber Cancer Inst., 822 N.E.2d 667, 684 (Mass. 2005) (quoting Uno Rests., Inc.

Page 18v. Boston Kenmore Realty Corp., 805 N.E.2d 957, 964 (Mass. 2004). "The scope of the covenant is only as broad as the contract that governs the particular relationship." Id.

Here, Axis has not identified any contractual right to which Fusion was entitled to in the event of a breach. The OEM is limited to the creation of a non-exclusive license to market and resell Barracuda's emailing services to Fusion customers. Although Fusion could have negotiated for a clause granting it assurances or protections in the event of a breach, we see nothing in the contract providing those assurances or protections. Because the covenant cannot "substitute for [Fusion's] failure to negotiate . . . terms," Uno Rests., Inc., 805 N.E.2d at 967, Axis's claim fails. See also Lohnes v. Level 3 Commc'ns, Inc., 272 F.3d 49, 62 (1st Cir. 2001) (finding no violation of the covenant where the defendant was "not contractually bound to provide the appellant with individualized notice . . . .").

We note that even if Fusion had held some right in the event of a data breach, none of Axis's proffered evidence can establish a lack of good faith on Barracuda's part. Axis claims that Barracuda "was slow to provide information about the data breach;" that "when it did so, the information was often provided in a virtually unusable format;" that "Barracuda interfered with efforts by Zoll’s investigators to determine the actual cause of the breach;" and that Barracuda "misrepresented details of the Page 19breach." Yet, all but the second of Axis's claims concern Barracuda's treatment of Zoll -- a party with whom Barracuda had no contractual relationship. Thus, they cannot evince that Barracuda acted in bad faith toward Fusion. And the second allegation relates to the data being provided in JSON format.⁶ Fusion's own witnesses testified that Fusion never requested the data in another format and that it was "not difficult" to decode. Indeed, they suggest that JSON files were standard for this type of data. Taken together, these assertions would not suggest that Barracuda lacked good faith in its dealings with Fusion.

Barracuda's actions did not frustrate the OEM's purpose of enabling Fusion to resell Barracuda's services. Barracuda is therefore entitled to summary judgment on this claim.

For the reasons explained, we affirm the district court's grant of summary judgment for Barracuda on all three claims.