Archambault v. Riverside Resort & Casino, Inc.

Opinion

JEREMIAH ARCHAMBAULT, et al., Plaintiffs, Case No.: 2:24-cv-01691-GMN-DJA vs. ORDER GRANTING IN PART RIVERSIDE RESORT & CASINO, Inc., et MOTION TO DISMISS al.,

Defendants.

Pending before the Court is a Motion to Dismiss, (ECF No. 23), filed by Defendants Riverside Resort & Casino, Inc. and Riverside Resort & Casino, LLC, (collectively, “Riverside”). Plaintiffs Brian Scott Giuiland, Kathleen Maddox, Jean Markgraf, Amber McConnell, Darlene Martin, Robert Dapello, Ronald Hansen, Carol Laudonio, Michael J. Montoya, Gary Lester, and Floyd M. Patten filed a Response, (ECF No. 28), to which Riverside filed a Reply, (ECF No. 30). For the reasons discussed below, the Court grants, in part, and denies, in part, the Motion to Dismiss. Plaintiffs bring this class action against Riverside Resort and Casino after their sensitive personal identifying information (“PII”) was stolen during a cyberattack on Riverside’s computer network. (See generally First Am. Compl. (“FAC”), ECF No. 20). Lynx Ransomware claimed responsibility for the attack, and Plaintiffs allege that their stolen PII has already been published, or will soon be published, on the dark web. (Id. ¶¶ 62–66). On July 25, 2024, Riverside performed an internal investigation on the data breach. (Id. ¶¶ 6–7, 46). It reported that the data breach exposed the PII of 55,155 current and former employees and customers. (Id. ¶ 7). The PII included, but was not limited to, names and social security numbers. (Id. ¶ 43). About six weeks after the data breach was discovered, Riverside began notifying Plaintiffs and Class Members that their names and social security numbers were involved in the breach. (Id. ¶¶ 9, 47). Plaintiffs allege that Riverside willfully or negligently failed to take reasonable steps to safeguard their PII, follow appropriate policies and procedures regarding the encryption of their data, and adequately notify them of the breach. (Id. ¶¶ 13–15). They also allege that the data breach was foreseeable because PII security warnings were readily available and accessible, and ransomware groups were targeting casinos. (Id. ¶¶ 67–81). In fact, some of the named Plaintiffs have already had their information misused in the form of unauthorized transactions, suspicious spam calls, and information from credit reporting agencies that their PII has been found on the dark web. (Id. ¶¶ 130, 142, 152, 163, 176, 188, 217, 229). Plaintiffs also allege that their injuries include an invasion of privacy, out of pocket costs, loss of time, loss of productivity to mitigate the risk of identity theft or actual identity theft, loss of the benefit of the bargain, and diminution or loss of value of their PII. (Id. ¶ 83). Plaintiffs bring causes of action for negligence, breach of implied contract, unjust

enrichment, and violations of the California Consumer Privacy Act, California Unfair Competition law, Nevada Deceptive Trade Practices Act, and for declaratory judgment. (See generally id.). Dismissal is appropriate under Rule 12(b)(6) where a pleader fails to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6). A pleading must give fair notice of a legally cognizable claim and the grounds on which it rests, and although a court must take all factual allegations as true, legal conclusions couched as factual allegations are insufficient. Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). Accordingly, Rule 12(b)(6) requires “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Id. “To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. This standard “asks for more than a sheer possibility that a defendant has acted unlawfully.” Id. If the court grants a motion to dismiss for failure to state a claim, the court should grant leave to amend “unless it determines that the pleading could not possibly be cured by the allegation of other facts.” Lopez v. Smith, 203 F.3d 1122, 1130 (9th Cir. 2000) (quoting Doe v. United States, 58 F.3d 494, 497 (9th Cir. 1995)). Pursuant to Rule 15(a), the court should “freely” give leave to amend “when justice so requires,” and in the absence of a reason such as “undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party by virtue of allowance of the amendment, futility of the amendment, etc.” Foman v. Davis, 371 U.S. 178, 182 (1962).

Riverside moves to dismiss Plaintiffs’ FAC for two reasons. (Mot. Dismiss 1:24–27, ECF No. 23). First, Riverside argues that Plaintiffs lack Article III standing to bring their claims because they do not allege any actual injuries caused by the cyberattack. (Id. 1:12–24). Second, Riverside contends that even if Plaintiffs have standing, they otherwise fail to state a claim pursuant to Rule 12(b)(6) of the Federal Rules of Civil Procedure. (Id. 1:24–27). The Court begins with Riverside’s standing argument. A. Article III Standing “Standing under Article III of the Constitution requires that an injury be concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” Monsanto Co v. Geerton Seed Farms, 561 U.S. 139, 149 (2010). “At the pleading stage, ‘general factual allegations of injury resulting from defendant’s conduct may suffice.” Mecinas v. Hobbs, 30 F.4th 890, 897 (9th Cir. 2022) (quoting Lujan v. Defenders of Wildlife, 504 U.S. 555, 561 (1992)). In a class action, standing exists where at least one named plaintiff meets these requirements. Ollier v. Sweetwater Union High Sch. Dist., 768 F.3d 843, 865 (9th Cir. 2014). To demonstrate standing, the “named plaintiffs who represent a class must allege and show they personally have been injured, not that injury has been suffered by other, unidentified members of the class to which they belong and which they purport to represent.” Lewis v. Casey, 518 U.S. 343, 347 (1996) (internal quotation marks omitted). At least one named plaintiff must have standing with respect to each claim that the class representatives seek to bring. In re Ditropan XL Antitrust Litig., 529 F. Supp. 2d 1098, 1107 (N.D. Cal. 2007). 1. Injury-in-Fact Riverside argues that Plaintiffs have failed to allege an injury-in-fact based on fear of future harm, mitigation cost or time spent, diminished value of PII, loss of privacy, emotional

distress, or an increase in spam or scam communications. (Mot. Dismiss 3:14–7:1). In response, Plaintiffs contend that the Ninth Circuit has found such injuries to confer standing in the context of a data breach. (Resp. 2:26–3:10). The Court finds that Plaintiffs have sufficiently alleged an injury-in-fact to confer standing. Plaintiffs allege that their PII, including their full names and social security numbers, was stolen in the cyberattack. (See FAC ¶ 47). Some Plaintiffs have reported unauthorized transactions and have been notified that their information was found on the dark web, while others have not yet noticed a misuse of their PII but fear future identity theft. (Id. ¶¶ 123–250). The Ninth Circuit has found that the threat of identity theft, including the theft of social security numbers, can constitute an injury-in-fact, even if there is no indication that the PII had been misused. See Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir. 2010) (“Plaintiffs– Appellants have alleged a credible threat of real and immediate harm stemming from the theft of a laptop containing their unencrypted personal data.”); see also In re Zappos.com, Inc., 888 F.3d 1020, 1027–29 (9th Cir. 2018). For example, the Ninth Circuit found that the plaintiffs sufficiently alleged a concrete injury when a thief in Krottner stole unencrypted names, addresses, and social security numbers that were stored on laptops, 628 F.3d at 1143, and when Zappos hackers obtained names, account numbers, passwords, e-mail addresses, billing and shipping addresses, telephone numbers, full credit card numbers, and unspecified credit and debit card information, 888 F.3d at 1023. Every named Plaintiff in this case has allegedly had PII stolen. Additionally, Plaintiffs allege that an actual theft of their PII occurred, not simply that they were worried about a risk of future theft. As the Zappos court explained, it was “the sensitivity of the personal information, combined with its theft, [that] led us to conclude [in Krottner] that the plaintiffs had adequately alleged an injury in fact supporting standing.” 888 F.3d at 1027 (emphasis added). Riverside cites two cases for the proposition that Plaintiffs’ fear of speculative harm

cannot confer Article III standing. (Mot. Dismiss 4:4–7). Neither is persuasive here. The first, TransUnion LLC v. Ramirez, did not involve the theft of PII. See 594 U.S. 413, 433 (2021). Rather, the Supreme Court held the TransUnion plaintiffs did not have a concrete injury simply because their TransUnion credit report, which had not been disclosed to a third party, contained misleading information. Id. at 434. And in the Southern District of California case relied on by Defendants, the plaintiffs did not allege that their social security numbers were stolen. Stasi v. Inmediata Health Grp. Corp., No. 19CV2353 JM (LL), 2020 WL 2126317, at *5 (S.D. Cal. May 5, 2020) (“Krottner and Zappos are distinguishable because Plaintiffs do not allege their social security numbers were included in the information that was potentially exposed on the internet.”). Because those cases are distinguishable, and the Zappos and Krottner courts have found a concrete injury under facts similar to the facts of this case, the Court finds that the Plaintiffs have alleged an injury-in-fact. 2. Traceable Injury Riverside also argues that Plaintiffs’ alleged injuries, including the fraud attempts and unauthorized charges, are not fairly traceable to the data breach incident. (Mot. Dismiss 7:3– 24). However, six weeks after Riverside discovered the data breach, it sent a breach notice letter to Plaintiffs. (FAC ¶ 9). Courts in this district have found a data breach notice to be sufficient to establish this standing element. See, e.g., Stallone v. Farmers Grp., Inc., No. 2:21- cv-01659-GMN-VCF, 2022 WL 10091489, at *9 (D. Nev. Oct. 15, 2022). “[T]he alleged harms are fairly traceable to Defendants because Defendants notified Plaintiff in a letter that he was subject to the Data Breach.”); see also Huynh v. Quora, Inc., No. 18-cv-07597, 2019 WL 11502875, at *4 (N.D. Cal. Dec. 19, 2019) (“These alleged harms are fairly traceable to Quora because Quora notified each of the Plaintiffs that they may have been subject of the 2018 Data Breach.”). “A reasonable inference can therefore be drawn which traces the plausibly alleged harms to the purported mishandling of [Plaintiffs’] personal information through the Data

Breach.” Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1033 (N.D. Cal. 2019). The Court thus finds that the FAC sufficiently alleges facts indicating that the Defendants’ failure to adequately protect the Plaintiffs’ PII is sufficiently traceable to Plaintiffs’ alleged injuries. 3. Standing for Injunctive Relief Riverside also argues that Plaintiffs lack standing for injunctive relief because they have not alleged facts supporting an immediate threat of repeated injury. (Mot. Dismiss 7:28–8:6). In response, Plaintiffs note that Riverside has retained their PII and that its post-breach security measures are inadequate from protect them from future injury. (Resp. 8:19–27). In the context of requests for injunctive relief, the standing inquiry requires plaintiffs to “demonstrate that [they have] suffered or [are] threatened with a ‘concrete and particularized harm,’ coupled with a ‘sufficient likelihood that [they] will again be wronged in a similar way.’” Bates v. United States Parcel Serv., Inc., 511 F.3d 974, 985 (9th Cir. 2007) (quoting Lujan, 504 U.S. at 560). The latter inquiry turns on whether the plaintiff has a “real and immediate threat of repeated injury.” Id. The threat of future injury cannot be “conjectural or hypothetical” but must be “certainly impending to” constitute an injury in fact for injunctive relief purposes. Zappos, 888 F.3d at 1026. Here, Plaintiffs allege that their PII is at continued risk and subject to further breaches as long as Riverside fails to undertake appropriate and adequate measures to protect the PII. (FAC ¶ 83). They claim that they have an interest in protecting their PII by ensuring that the storage or data or documents containing the PII is not accessible online and is password protected. (Id. ¶ 122). As Riverside points out, however, Plaintiffs fail to allege facts suggesting “an ongoing security deficiency creating a real, immediate threat of a further data breach.” (Reply 7:13–19). In Riverside’s Notice of Data Breach letter, attached to the FAC, it states that Riverside initiated an investigation, disabled relevant accounts, and provided Plaintiffs with access to credit monitoring services and proactive fraud assistance at no charge. (Notice of Breach, Ex. A

to FAC, ECF No. 20-1). Although Plaintiffs are correct that they have an interest in ensuring their data is protected from future breaches, they must include allegations allowing the Court to conclude that the threat of future injury is “certainly impending.” Thus, Plaintiffs’ claim for injunctive relief is dismissed with leave to amend. B. Claims for Relief Because the Court finds that Plaintiffs have standing, it will next evaluate Riverside’s arguments that Plaintiffs have failed to state a claim for each cause of action. 1. Cognizable Injury Riverside first argues that all of Plaintiffs’ claims must fail due to a lack of cognizable injury. (Mot. Dismiss 8:13–9:21). In rebuttal, Plaintiffs contend that they alleged cognizable injuries in the form of “(1) the loss of benefit of the bargain; (2) diminution or loss of value of their PII; (3) the future risk to their PII will be used to commit fraud or identity theft; (4) violation of privacy;” and (5) time and expenses lost mitigating the “materialized risk and imminent threat of identity theft risk.” (Resp. 9:5–8). Although Plaintiffs have sufficiently alleged an injury-in-fact for standing purposes, they must still plead sufficient allegations to satisfy the damages requirement for their causes of action. See Krottner v. Starbucks Corp., 406 F. App’x 129, 131 (9th Cir. 2010) (“our holding that Plaintiffs-Appellants pled an injury-in-fact for purposes of Article III standing does not establish that they adequately pled damages for purposes of their state-law claims”). Beginning with Plaintiffs’ benefit of the bargain damages, the FAC alleges that Plaintiff Laudonio and the California Subclass Members paid more for goods and services than they otherwise would have, based on the belief that Defendant would implement reasonable data

security practices. (FAC ¶ 360). This Court, and other courts in the District of Nevada, have found similar allegations to be sufficient for a plaintiff to allege that reasonable data security was part of the bargain, which they did not receive. See, e.g., Smallman v. MGM Resorts Int’l, 638 F. Supp. 3d 1175, 1190 (D. Nev. 2022); In re Eureka Casino Breach Litig., No. 2:23-CV- 00276-CDS-BNW, 2024 WL 4253198, at *6 (D. Nev. Sept. 19, 2024). Notably, however, Plaintiffs’ allegation involves only Plaintiff Laudonio and the California Subclass Members and pertains specifically to count five, violation of the California Unfair Competition Law. Plaintiffs’ previous allegations about general damages based on loss of benefit of the bargain are vague and conclusory. (See FAC ¶ 83). The Court therefore finds that to the extent Plaintiffs’ allege this injury as to the other Named Plaintiffs, Nevada Subclass Members, or claims, it must be amended and supported with additional factual allegations. Plaintiffs also allege that they suffered cognizable harm because the theft of their PII has diminished in value. (Id. ¶¶ 83, 108–13). “Diminution in value of personal information can be a viable theory of damages.” Pruchnicki v. Envision Healthcare Corp., 439 F. Supp. 3d 1226, 1234 (D. Nev. 2020), aff’d, 845 Fed. App’x 613 (9th Cir. 2021). Plaintiffs contend that their PII has an “inherent market value in both legitimate and dark markets,” and that its value has diminished by its unauthorized release onto the dark web. (FAC ¶ 113). Riverside argues that this cannot constitute a concrete injury because plaintiffs “must establish both the existence of a market for [their] personal information and an impairment of [their] ability to participate in that market.” (Mot. Dismiss 5:13–22) (quoting Pruchnicki, 439 F. Supp. 3d at 1234). This Court has previously explained, however, that “these pleading requirements, that Plaintiffs must establish both the existence of a market for their PII and an impairment of their ability to participate in that market, is not supported by Ninth Circuit precedent, and other district courts in this Circuit have rejected them.” Smallman, 638 F. Supp. 3d at 1190 (collecting cases); see

also In re Anthem, Inc. Data Breach Litig., No. 15-MD-02617-LHK, 2016 WL 3029783, at *15 (N.D. Cal. May 27, 2016) (“These statements [in the case law] appear to require a plaintiff to allege that there was either an economic market for their PII or that it would be harder to sell their own PII, not both.”). The Court thus denies Riverside’s motion to the extent it seeks dismissal on the grounds that Plaintiffs’ allegation of diminution of value is not a cognizable harm. Next, Plaintiffs allege that there is a future risk their PII will be used to commit fraud and identity theft. While the Ninth Circuit has addressed the risk of future harm in the context of standing, as discussed above, neither party provides clear guidance from the Ninth Circuit as to what extent it can serve as a cognizable injury in the damages context. This Court, however, found in Smallman that stolen PII can create a substantial risk of future harm sufficient to constitute cognizable harm. Smallman, 638 F. Supp. 3d at 1191–92. Plaintiffs have alleged that their PII has already been published on the dark web or will soon be published. (FAC ¶¶ 50, 62–66). Multiple named Plaintiffs have received information from credit reporting agencies that their information was discovered on the dark web, and still others allege that unauthorized transactions have appeared in their accounts. Even if some of the Plaintiffs have not yet discovered a misuse of their PII, “Plaintiffs do not have to wait until hackers inevitably use their private information for nefarious purposes to allege a cognizable injury.” In re Eureka Casino Breach Litig., 2024 WL 4253198, at *5. The Court denies Riverside’s motion to the extent it seeks dismissal on this ground. Plaintiffs also allege that “invasion of privacy” is a cognizable injury. (FAC ¶ 83). Riverside cites an unpublished case from the Southern District of New York that found intrusion upon seclusion to be insufficient to confer standing because it was not defendants who improperly accessed the plaintiffs’ data, but a third party. (Mot. Dismiss 5:23-6:3) (quoting Aponte v. Ne. Radiology, P.C., No. 21 CV 5883 (VB), 2022 WL 1556043, at *5 (S.D.N.Y. May

16, 2022)). But in the context of negligence damages, not standing, this Court noted in Smallman that an invasion of privacy implicates non-economic harms because “[i]n the data breach context, courts within the Ninth Circuit have found that an individual’s loss of control over the use of their identity due to a data breach and the accompanying impairment in value of PII constitutes non-economic harms.” 638 F. Supp. 3d at 1188 (citing Stasi v. Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 913 (S.D. Cal. 2020) (concluding that the plaintiffs alleged noneconomic harms in the form of the privacy injury they suffered, irrespective of whether they subsequently suffered identity fraud)). The Court therefore finds that Plaintiffs have sufficiently alleged an invasion of privacy harm due to their loss of control over the use of their identities and denies Riverside’s motion seeking dismissal on this ground. Moving lastly to Plaintiffs’ allegation of lost time and expenses, Riverside argues that “Plaintiffs cannot allege any out-of-pocket costs or mitigation measures that were reasonably necessary in light of Riverside’s offer of comprehensive mitigation services.” (Mot. Dismiss 5:2–12). Plaintiffs’ response does not identify any out-of-pocket costs, and “lost time alone does not establish compensable damages.” Smallman, 638 F. Supp. 3d at 1192 (citing Pruchnicki v. Envision Healthcare Corp., 845 F. App’x 613, 614 (9th Cir. 2021)). Accordingly, the Court dismisses Plaintiffs’ claims to the extent they rely on loss of time damages. Because it is not clear that amendment is futile, the dismissal is without prejudice and with leave to amend. 2. Negligence Riverside’s first argument for the dismissal of Plaintiffs’ negligence claim is that they failed to allege facts that give rise to a duty of care. (Mot. Dismiss 9:24–10:20). Under Nevada law, “[t]o prevail on a negligence claim, a plaintiff must establish four elements: (1) the existence of a duty of care, (2) breach of that duty, (3) legal causation, and (4) damages.” Sanchez ex rel. Sanchez v. Wal-Mart Stores, Inc., 221 P.3d 1276, 1280 (Nev. 2009).

Plaintiffs allege that upon storing their PII, “Defendant undertook and owed a duty to Plaintiffs and Class members to exercise reasonable care to secure and safeguard that information and to use secure methods to do so,” and to “avoid causing a foreseeable risk of harm” when storing personal information. (FAC ¶¶ 292–96). In its Motion to Dismiss, Riverside argues that Nevada negligence law prescribes no general duty to control the dangerous conduct of another or warn of dangerous conduct. (Mot. Dismiss 9:24–10:20). In response, Plaintiffs argue that pursuant to Aleck v. ZB National Association, Riverside owes a duty to their employees and customers. (Resp. 10:14–11:2). The Court in Aleck reversed and remanded a decision by the district court dismissing a claim for negligence due to a lack of a duty of care for a customer by bank tellers. Aleck v. ZB Nat’l Ass’n, 485 P.3d 210, at *3 (Nev. 2021). It contrasted the fact that the plaintiff was a customer of the defendant bank with the anonymous third-party plaintiff in Sanchez—the case on which Riverside relies—to find that the bank tellers owed the customer a duty of care. (Id.) The Court thus agrees with Plaintiffs that Riverside owes them a duty to exercise reasonable care in the storage of their personal information. Not only did the Aleck Court find that a duty of care exists for a business’s customers, NRS 603.030 requires “data collectors” to maintain reasonable security measures to protect personal information records “from unauthorized access, acquisition, destruction, use, modification or disclosure.” Riverside, as a “corporation, financial institution, or retail operator,” is a data collector. In addition, California courts have made it clear that businesses owe a duty of care to their employees and customers to protect PII. See Medoff v. Minka Lighting, LLC, No. 2:22-CV-08885-SVW-PVC, 2023 WL 4291973, at *8 (C.D. Cal. May 8, 2023) (collecting cases). Even if there is a duty of care, Riverside contends, Plaintiffs failed to allege facts demonstrating that the duty was breached. (Mot. Dismiss 10:21–11:11). Plaintiffs have alleged that Riverside breached its duty by failing to encrypt their PII, storing their PII longer than

necessary, inadequately testing and training its employees, deviating from industry standards such as those established by the Federal Trade Commission and National Institute of Standards and Technology, failing to implement processes such as multi-layer firewalls and endpoint detection, and notifying them of the breach promptly, among other things. (FAC ¶¶ 54–65, 170, 261–70, 299–318). A factual determination as to the reasonableness of Riverside’s actions is inappropriate at this stage. Therefore, the Court finds that Plaintiffs have adequately pled facts supporting the breach element. Finally, Riverside argues that Nevada’s economic loss doctrine bars Plaintiffs’ negligence claim. (Mot. Dismiss 11:13–12:14). The economic loss doctrine “generally ‘bars unintentional tort actions when the plaintiff seeks to recover purely economic losses.’” Lombino v. Bank of Am., N.A., 797 F. Supp. 2d 1078, 1082 (D. Nev. 2011) (quoting Terracon Consultants W., Inc. v. Mandalay Resort Grp., 206 P.3d 81, 86 (Nev. 2009)). “In the data breach context, courts within the Ninth Circuit have found that an individual’s loss of control over the use of their identity due to a data breach and the accompanying impairment in value of PII constitutes non-economic harms.” Smallman, 638 F. Supp. 3d at 1188 (collecting cases). In this case, Plaintiffs have alleged harm under multiple theories, including an increased risk of identity theft, and thus the harms are not purely economic. The Court thus denies Riverside’s Motion to Dismiss on the grounds that the negligence claim is barred by the economic loss doctrine. Plaintiffs’ negligence claim is sufficiently pled. 3. Breach of Implied Contract Next, Riverside asserts that Plaintiffs’ claim for breach of implied contract fails because they did not allege an “independent contractual agreement under which Riverside assumed specific obligations regarding data security and data breach notification, nor are there any claims of a meeting of the minds on this issue.” (Mot. Dismiss 12:20–23). Plaintiffs respond that the terms of the contract were manifested by the conduct of the parties and points to this

Court’s decision in Smallman. (Resp. 12:21–23) (quoting Smallman, 638 F. Supp. 3d at 1194– 95). Nevada law requires the plaintiff in a breach of contract action to show: (1) the existence of a valid contract; (2) a breach by the defendant; and (3) damage as a result of the breach. Mizrahi v. Wells Fargo Home Mortg., 2010 WL 2521742, at *3 (D. Nev. June 16, 2010) (citing Saini v. Int’l Game Tech., 434 F. Supp. 2d 913, 919–20 (D. Nev. 2006)). Although the terms of an implied contract are manifested by conduct rather than written words as in an express contract, both “are founded upon an ascertainable agreement.” Smith v. Recrion Corp., 541 P.2d 663, 664–65 (Nev. 1975). To form an enforceable contract requires the following: (1) offer and acceptance, (2) meeting of the minds, and (3) consideration. May v. Anderson, 121 119 P.3d 1254, 1257 (Nev. 2005). The Smallman plaintiffs alleged that an implied contract was entered into during the reservation process when they provided the hotel with their PII, and the hotel impliedly promised to protect it. Smallman, 638 F. Supp. 3d at 1195. This Court explained that even though the plaintiffs had not alleged an explicit promise as to the protection of the PII, “it is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of . . . sensitive personal information would not imply the recipient’s assent to protect [the] information sufficiently.” Id. (quoting Castillo v. Seagate Tech., LLC, No. 16-CV-01958-RS, 2016 WL 9280242, at *9 (N.D. Cal. Sept. 14, 2016)). It then found that because the plaintiffs were required to provide their PII to stay at the hotel, and did so with the understanding that the hotel would take adequate measures to protect it, that the plaintiffs had sufficiently pled their implied contract claim. (Id.). Like the Smallman plaintiffs, the Plaintiffs here were required to provide their PII to receive employment or hospitality services. (FAC ¶ 322). They allege that a meeting of the

minds occurred when the Plaintiffs provided their PII to Riverside with the understanding that it would be adequately protected, and that Riverside’s implied duty to protect their PII was included in Riverside’s own Privacy Policy. (Id. ¶¶ 324–25). Similar allegations were found sufficient by this Court in Smallman, as well as by other courts in the Ninth Circuit. See, e.g., Medoff, 2023 WL 4291973 at *11 (finding adequately pled implied contract claim where defendant offered to employ plaintiff in exchange for his PII and labor, defendant impliedly agreed through internal policies that it would not disclose the PII, and plaintiff accepted offer by providing PII in exchange for employment”); Kirsten v. California Pizza Kitchen, Inc., No. 2:21-CV-09578-DOC-KES, 2022 WL 16894503, at *5 (C.D. Cal. July 29, 2022) (“Other courts in this district have held, and the Court agrees, that the mandatory receipt of PII implies the recipient’s assent to protect the PII sufficiently.”); Landon v. TSC Acquisition Corp., No. 2:23- CV-01377-SVW-PD, 2024 WL 5317240, at *9 (C.D. Cal. Nov. 1, 2024) (finding adequately pled claim where plaintiffs alleged they were required to provide PII to purchase the defendant’s services, the defendant agreed it would protect PII in its privacy policy, and plaintiffs provided their PII in exchange for defendant’s services). The Court thus finds that the Plaintiffs have adequately pled that an implied contract existed. Lastly, Riverside contends that even if Plaintiffs alleged the existence of an implied contract, they failed to claim a breach of any particular term, because they did not allege how Riverside violated its promise. (Mot. Dismiss 14:5–13). The Court disagrees, however, because Plaintiffs included specific allegations as to how Riverside failed to comply with applicable standards, such as by failing to encrypt their data, train its employees on cybersecurity protocols, follow FTC guidelines, or notify Plaintiffs of the breach in a timely manner. (See FAC ¶¶ 44, 55, 58, 79, 81, 98, 261–70). Plaintiffs adequately pled the breach of an implied contract. 4. Unjust Enrichment

Riverside also moves for the dismissal of Plaintiffs’ unjust enrichment claim. (Mot. Dismiss 14:15–15:11). The Employee Plaintiffs allege that they conferred a benefit on Riverside by providing their labor and PII with the understanding that Riverside would pay the costs for reasonable data privacy and security from the revenue it derived therefrom. (FAC ¶ 330). And the Customer Plaintiffs allege that they conferred a benefit to Riverside in the form of payment for services, and that at least some of the money paid was supposed to be used for data security. (Id. ¶ 331). They assert that Riverside enriched itself and increased its own profits by saving the money that it reasonably should have spent to protect Plaintiffs’ PII. (Id. ¶¶ 332–35). Riverside argues that Plaintiffs fail to plead a lack of legal remedies. (Mot. Dismiss 14:21–15:6). It also argues that Plaintiffs have failed to allege that Riverside did not provide a benefit in return. (Id. 15:7–11). In response, Plaintiffs assert that alleging they lack an adequate remedy at law, at this stage of the proceedings, is sufficient to survive a motion to dismiss. (Resp. 14:2–3). They also contend that they appropriately alleged that they are entitled to the portion of the payments they made to Riverside for reasonable data security measures. (Id. 14:10–16). In Nevada, the elements of an unjust enrichment claim are: “(1) a benefit conferred on the defendant by the plaintiff; (2) appreciation of the benefit by the defendant; and (3) acceptance and retention of the benefit by the defendant; (4) in circumstances where it would be inequitable to retain the benefit without payment.” Ames v. Caesars Ent. Corp., No. 2:17- CV-02910-GMN-VCF, 2019 WL 1441613, at *5 (D. Nev. Apr. 1, 2019) (quoting Leasepartners Corp. v. Robert L. Brooks Tr., 942 P.2d 182, 187 (Nev. 1997)). “It is undisputed that unjust enrichment and disgorgement are equitable remedies.” Smallman, 638 F. Supp. 3d at 1196. Pursuant to Sonner v. Premier Nutrition Corp., a plaintiff seeking equitable relief must plausibly allege that they lack an adequate remedy at law. 971 F.3d 834, 844 (9th Cir. 2020). In Sonner, the Ninth Circuit held that plaintiffs must establish that they lack an adequate

remedy at law before securing equitable restitution for past harms. Id. The plaintiff in that case failed to make such a showing because the complaint did not allege that she lacked an adequate legal remedy. Id. She also conceded that she sought the same sum in equitable restitution as the amount requested in damages to compensate her for the same past harm. Id. The court found that she failed to explain how the same amount of money, for the exact same harm, would be inadequate or incomplete. Id. Riverside also cites a case in the Northern District of California for support for their argument that Plaintiffs seek “monetary damages and statutory damages for virtually all of their other claims, which are based on the same conduct underlying their putative unjust enrichment.” (Mot. Dismiss 15:1–3). In that case, Sharma v. Volkswagen AG, the plaintiffs represented a class of people who purchased or leased a vehicle with a braking defect. 524 F. Supp. 3d 891, 899 (N.D. Cal. 2021). The complaint included several paragraphs about the inadequacy of legal remedies, but the court did not find the allegations persuasive because the plaintiff’s injury was a loss of money or loss in value. Id. at 908. The court explained that the monetary injury was the same type in which other courts had found a legal remedy to be appropriate. Id. (citing In re MacBook Keyboard Litig., No. 5:18-cv-02813-EJD, 2020 WL 6047253, at *4 (N.D. Cal. Oct. 13, 2020) (“Because Plaintiffs’ claims rest on their alleged overpayments and Apple’s failure to issue refunds, the Court finds that monetary damages would provide an adequate remedy for the alleged injury.”)); see also Gibson v. Jaguar Land Rover N. Am., LLC, No. CV 20-00769-CJC(GJSx), 2020 WL 5492990, at *3 (C.D. Cal. Sept. 9, 2020) (“[T]here is nothing in the [complaint] to suggest that monetary damages would not make Plaintiff or the putative class whole. Indeed, throughout the [complaint] Plaintiff repeatedly alleges that he and the putative class ‘lost money or property’ as a result of Jaguar’s wrongful conduct.”)). Here, Plaintiffs allege that their claim is brought “in the alternative to all other claims

and remedies at law,” (FAC ¶ 329), and they seek “relief in the form of restitution and disgorgement of all ill-gotten gains.” (Id. ¶ 339). They also allege that if the Court does not enter an injunction and a second breach occurs, they will lack an adequate remedy at law because the “resulting injuries are not readily quantified in full.” (Id. ¶ 381). “Simply put, monetary damages, while warranted for out-of-pocket damages and other legally quantifiable and provable damages, cannot cover the full extent of Plaintiffs’ and Class Members’ injuries.” (Id.). So unlike the Sonner plaintiff, the Plaintiffs here allege in the alternative that they lack a legal remedy. The Plaintiffs in this case also do not suffer from a purely monetary injury, nor are they requesting the same sum in both restitution and monetary damages from the same harm. The Court thus finds Plaintiffs’ unjust enrichment claim to be adequately pled. 5. Violation of the CCPA Plaintiff Laudonio and the California subclass assert that Riverside violated the California Consumer Privacy Act (“CCPA”) when it failed to implement and maintain reasonable security procedures to protect Plaintiffs’ PII. (FAC ¶¶ 340–50). The CCPA states that consumers “whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information” may bring a civil action. Cal. Civ. Code § 1798.150(a)(1). Riverside’s first argument is that Plaintiff Laudonio cannot pursue statutory damages because she did not provide pre-suit notice and an opportunity to cure. (Mot. Dismiss 15:18– 16:3). It contends that because she filed her original complaint on September 20, 2024, served pre-suit demand the same day, and then filed the FAC two months later, she did not comply with the statute. (Id.). The CCPA states that actions “may be brought by a consumer if, prior to initiating any action against a business for statutory damages on an individual or class-wide

basis, a consumer provides a business 30 days’ written notice identifying the specific provisions of this title the consumer alleges have been or are being violated.” 13 Cal. Civ. Code § 1798.150(b). Consumers can recover “actual pecuniary damages” or statutory damages. Id. § 1798.150(a)–(b). “No notice shall be required prior to an individual consumer initiating an action solely for actual pecuniary damages suffered as a result of the alleged violations of this title.” Id. Plaintiff Laudonio responds that she followed the CCPA’s requirements because her initial complaint sought only actual damages and injunctive relief—not statutory damages. (Resp. 15:21–23) (citing Laudonio Compl. ¶ 71, ECF No. 1 in 2:24-cv-01775-GMN-DJA). She alleged that if Riverside did not cure the violation, she would amend the complaint to pursue statutory damages, which require the 30-day notice. (Laudonio Compl. ¶ 70). She then waited more than 30 days before filing the FAC seeking statutory damages. (See FAC ¶ 350). The Court agrees with Plaintiff. The statute states plainly that no notice is required prior to a consumer bringing suit for actual pecuniary damages, which is what Plaintiff Laudonio initially sought when filing her initial complaint and providing notice on September 20, 2024. She did not seek statutory damages until more than 30 days had passed and she filed the FAC in November. The Court thus denies Riverside’s Motion to Dismiss this claim based on pre-suit notice. Riverside also argues that the Court should dismiss this claim because it rests on conclusory allegations that Riverside failed to implement and maintain reasonable security measures and because Plaintiff Laudonio failed to allege facts supporting that the theft occurred “as a result” of its violation of the duty to maintain reasonable security measures. (Mot. Dismiss 16:4–22). As the Court has found above, Plaintiffs’ factual allegations regarding the specific deficiencies in Riverside’s security are sufficient and not conclusory. The allegations further support the conclusion that the theft occurred as a result of the deficiencies. The Court

thus finds Plaintiffs’ CCPA claim to be sufficiently pled. 6. Violation of the California UCL Plaintiffs also allege that Riverside violated the California Unfair Competition Law (“UCL”) by engaging in unfair and unlawful acts. (FAC ¶¶ 351–63). Riverside moves to dismiss this claim by arguing that Plaintiffs have not adequately alleged UCL standing, unfair or unlawful conduct, and failed to show causation. (Mot. Dismiss 16:23–19:27). The California UCL prohibits “unfair competition” and defines the term as a “business act or practice” that is (1) “fraudulent,” (2) “unlawful,” or (3) “unfair.” Bus. & Prof. Code §17200. Each prong of the UCL provides “a separate and distinct theory of liability[.]” Kearns v. Ford Motor Co., 567 F.3d 1120, 1127 (9th Cir. 2009). To have standing to pursue a UCL claim, the California Plaintiffs must show that they “lost money or property” because of Defendant MGM’s conduct. Cal. Bus. & Prof. Code § 17204; see In re Facebook, Inc., Consumer Privacy User Profile Litig., 402 F. Supp. 3d 767, 804 (N.D. Cal. 2019). Riverside argues that none of Plaintiff Laudonio’s alleged injuries amount to cognizable harm. (Mot. Dismiss 16:5–13). However, the FAC states that “Plaintiff Laudonio and California Subclass Members paid Defendant money in exchange for goods or services and paid more than they would have based on the belief that Defendant would implement reasonable data security practices.” (FAC ¶ 360). This allegation is sufficient for standing. See Smallman, 638 F. Supp. 3d at 1201–02 (finding that plaintiffs sufficiently pled allegations establishing standing where plaintiffs alleged that they paid the “overinflated cost of the hotel rooms they purchased as a result of Defendant[’s] omissions regarding the adequacy of data security policies.”); see also In re Eureka Casino Breach Litig., 2024 WL 4253198, at *10 (finding standing where plaintiffs pled that they overpaid for the defendant casino’s goods and services and part of their payment was designed to establish adequate safety measures). Riverside also argues that Plaintiff Laudonio has not alleged unfair conduct prohibited

by the UCL. (Mot. Dismiss 17:14–18:11). “The UCL does not define the term ‘unfair.’ . . . [And] the proper definition of ‘unfair’ conduct against consumers ‘is currently in flux’ among California courts.” Davis v. HSBC Bank Nev., N.A., 691 F.3d 1152, 1169 (9th Cir. 2012). There are at least two possible tests. The tethering test requires that the “unfairness must be tethered to some legislatively declared policy or proof of some actual or threatened impact on competition.” Lozano v. AT&T Wireless Servs., Inc., 504 F.3d 718, 735 (9th Cir. 2007) (internal quotation marks omitted). The “balancing test” examines whether the challenged business practice is “immoral, unethical, oppressive, unscrupulous or substantially injurious to consumers and requires the court to weigh the utility of the defendant's conduct against the gravity of the harm to the alleged victim.” In re Adobe Sys., Inc. Priv. Litig., 66 F. Supp. 3d 1197, 1226 (N.D. Cal. 2014). Under the balancing test, Plaintiff Laudonio alleges that Riverside’s failure to implement and maintain reasonable security measures was contrary to declared public policy that seeks to protect data, including the FTC Act, California’s Customer Records Act, and California’s Consumer Privacy Act. (FAC ¶ 354). She further alleges that the lack of security measures led to substantial injuries, including those described above. (Id.). Riverside argues that Plaintiff does not allege how it engaged in “immoral, unethical, oppressive, or unscrupulous” practices and that Plaintiff merely parrots the element of the claim. (Mot. Dismiss 17:2–18:4). But Plaintiff provides detailed allegations throughout the rest of the FAC and incorporates those allegations into this claim by reference. (FAC ¶ 351). Further, several California statutes upon which Plaintiff relies here reflect “California’s public policy of protecting consumer data.” In re Adobe, 66 F. Supp. 3d at 1227. The Court thus follows its previous decision in Smallman, and the decision of other courts in the Ninth Circuit, finding that the determination of whether the defendant’s “public policy violation is outweighed by the utility of their conduct under the

balancing test is a question more appropriately resolved at a later stage of this litigation.” See Smallman, 638 F. Supp. 3d at 1203; see also Mehta v. Robinhood Fin. LLC, No. 21-cv-01013, 2021 WL 6882377, at *12 (N.D. Cal. May 6, 2021) (“At the motion to dismiss stage, the Court cannot say that the benefit from Robinhood's business practices of allegedly emphasizing growth and profit over protecting their customers’ personal and financial information and failing to implement industry-standard security measures outweighs the harms.”); In re Anthem, 162 F. Supp. 3d at 990 (finding, on a motion to dismiss, that the question of whether a violation is outweighed by its utility should be resolved later in the litigation). Riverside also argues that Plaintiff has not alleged unlawful conduct under the UCL. (Mot. Dismiss 18:12–19:10). This prong prohibits “anything that can properly be called a business practice and that at the same time is forbidden by law.” Cel–Tech, 20 Cal.4th at 180, 83 Cal.Rptr.2d 548, 973 P.2d 527 (internal quotation marks omitted). “By proscribing ‘any unlawful’ business practice, the UCL permits injured consumers to ‘borrow’ violations of other laws and treat them as unlawful competition that is independently actionable.” In re Adobe Sys., Inc. Priv. Litig., 66 F. Supp. 3d at 1225 (quoting Cel–Tech, 20 Cal. 4th at 180). Under this prong, Plaintiff’s claim is predicated on violations of the CCPA and Federal Trade Commission Act (“FTCA”). Because the Court has found that Plaintiff has sufficiently alleged a violation of the CCPA, as well as a violation of the unfair prong of the UCL, she has therefore alleged unlawful conduct that can serve as a basis for a claim under the UCL’s unlawful prong. Riverside’s last argument for dismissal is that to the extent Plaintiff is basing her UCL claim on deception or misrepresentation, she must allege actual reliance. (Mot. Dismiss 19:12– 27). Plaintiff responds that her UCL claim is not premised on deception or actual reliance. (Resp. 21:4–15). The Court thus finds Plaintiff’s UCL claim based on unlawful or unfair practices to be sufficiently pled and denies Riverside’s Motion to Dismiss this claim. 7. Nevada Deceptive Trade Practices Act

The Nevada Deceptive Trade Practices Act (“NDTPA”) provides a private right of action to victims of deceptive trade practices. Watkins v. Rapid Fin. Sols., Inc., No. 3:20-CV- 00509-MMD-CSD, 2024 WL 3938537, at *9 (D. Nev. Aug. 26, 2024). “A person engages in a ‘deceptive trade practice’ when in the course of his or her business or occupation he or she knowingly . . . (b) Fails to disclose a material fact in connection with the sale or lease of goods or services” or “(c) Violates a state or federal statute or regulation relating to the sale of lease of goods or services.” NRS 598.0923(1)(b)–(c). Plaintiffs allege that Riverside violated this provision by failing to disclose the material fact that its data security measures were inadequate and by violating statutes such as the FTC and NRS 603A.210 requiring data collectors to “implement and maintain reasonably security measures” to protect PII. (FAC ¶¶ 367–69). Riverside’s first argument for dismissal is that Plaintiffs’ “failure to disclose” claim requires that Plaintiffs allege that Riverside had an affirmative duty to disclose the information. (Mot. Dismiss 20:1–21:1). Riverside cites primarily to Soffer v. Five Mile Cap. Partners, LLC, but as Plaintiffs point out, Soffer involved a common law fraud claim, not a statutory one. No. 2:12–CV–1407 JCM (GWF), 2013 WL 638832, at *10 (D. Nev. Feb. 19, 2013). And as the Supreme Court of Nevada recently noted, “[s]tatutory offenses that sound in fraud are separate and distinct from common law fraud.” Leigh-Pink v. Rio Props, LLC, 512 P.3d 322, 328 (Nev. 2022) (quoting Betsinger v. D.R. Horton, Inc., 232 P.3d 433, 436 (Nev. 2010)). Riverside has thus not demonstrated that Plaintiffs must allege an affirmative duty to disclose. Riverside’s other two cited district court cases, one of which is from the District of Georgia, do not convince the Court otherwise. Another court in the District of Nevada mentions offhand in a footnote that omissions must be true at the time defendants had a duty to disclose them, but lumps together statutory and common law fraud claims in its analysis. Taddeo v. Taddeo, No. 2:08-CV-01463-KJD, 2011 WL 4074433, at *6 (D. Nev. Sept. 13, 2011). And the In re Equifax court does not discuss Nevada law specifically, but rather broadly finds that 17 of the

state consumer-fraud statutes do not impose liability for omissions unless a duty to disclose exists. In re Equifax, Inc., Customer Data Sec. Breach Litig., 362 F. Supp. 3d 1295, 1337 (N.D. Ga. 2019). Riverside also argues that Plaintiffs cannot allege a violation of a state or federal statute or regulation because NRS 603A.030 only applies to protect Nevada residents and their claims as to FTC violations are too vague and conclusory. (Mot. Dismiss 21:2–18). “Under NRS 41.600(1), ‘any person who is a victim of consumer fraud’ may bring an action against the alleged perpetrator.” R.J. Reynolds Tobacco Co. v. Eighth Jud. Dist. Ct. in & for Cnty. of Clark, 514 P.3d 425, 429 (Nev. 2022) (quoting NRS 41.600(1) (emphasis added)). And Nevada Supreme Court decisions liberally construe NDTPA claims, refusing to “read in” requirements for suing. Id. at 431. Riverside cites NRS 603A.210(1), arguing that coverage is limited to the “personal information of a resident of this State.” (Mot. Dismiss 21:6–10). The statute states that a “data collector that maintains records which contain personal information of a resident of this State shall implement and maintain reasonable security measures . . . .” NRS 603A.210(1). Riverside does not argue that its records do not contain PII of Nevada residents, nor does it cite a single case in which a Court has limited the application or enforcement of this statute to Nevada residents. The Court thus denies Riverside’s Motion to Dismiss on this ground. Plaintiffs, however, did not respond to Riverside’s argument that their FTC violations were vague and conclusory. It is well settled in the District of Nevada that a party’s failure to respond to arguments presented in a motion constitutes consent to the granting of the motion. Layton v. Green Valley Vill. Cmty. Ass’n, No. 2:14-cv-01347-GMN-EJY, 2022 WL 1748067, at *1 (D. Nev. May 27, 2022) (collecting cases). Thus, to the extent Plaintiffs’ NDTPA claim is premised on FTC violations, it is dismissed. 8. Declaratory and Injunctive Relief Lastly, Riverside argues that Plaintiffs’ claims for declaratory and injunctive relief are

duplicative and redundant of their other claims. (Mot. Dismiss 21:21–22:12). Plaintiffs respond that their claims for declaratory and injunctive relief are distinct because they request a remedy for ongoing and future conduct, and their other claims request relief for past conduct. (Resp. 23:18–24:1). A claim for declaratory relief may be “unnecessary where an adequate remedy exists under some other cause of action.” Reyes v. Nationstar Mortg. LLC, No. 15-cv-01109- LHK, 2015 WL 4554377, at *7 (N.D. Cal. July 28, 2015) (quoting Mangindin v. Wash. Mut. Bank, 637 F. Supp. 2d 700, 707 (N.D. Cal. 2009)). However, “[t]he existence of another adequate remedy does not preclude a declaratory judgment that is otherwise appropriate.” Fed. R. Civ. P. 57. Based on the FAC, Plaintiffs’ negligence, contract, and statutory claims seek different relief than their declaratory and injunctive relief claims. Their negligence and contract claims seek restitution in the form of disgorgement or in the alternative, actual, consequential, and punitive damages for their injuries. (See FAC □□ 320, 327, 339). In contract, the declaratory relief asks the Court to declare that Riverside continues to owe a legal duty, breaches it by failing to use reasonable measures, and causes injuries from that breach. (U/d. 4379). It also the Court to issue injunctive relief requiring Riverside to use adequate security measures. g || Ud. 4 380). Although Plaintiffs’ contract and negligence claims also address a breach of Riverside’s duty, they seek to obtain damages for the harms they have already suffered. However, to the extent that Plaintiffs seek the Court to declare that Defendant owed a duty, breached it, and caused injury, the claim is dismissed as duplicative. Ud. § 379). And as discussed above, Plaintiffs’ claim for injunctive relief is dismissed with leave to amend due to a lack of factual allegations to demonstrate that future injury is “certainly impending.” IT IS HEREBY ORDERED that the Motion to Dismiss, (ECF No. 23), is GRANTED, in part, and DENIED in part. Plaintiffs’ claim for injunctive relief is dismissed with leave to amend, and Plaintiffs’ negligence and contract claims are dismissed to the extent they rely on is || loss of time damages. DATED this 9 _ day of September, 2025.

UNITED S ES DISTRICT COURT

Page 25 of 25