Bruderman Asset Management, LLC v. Real Time Consultants, Inc.

CourtDistrict Court, S.D. New York
DecidedMay 9, 2021
Docket1:20-cv-03164-DLC
StatusUnknown

This text of Bruderman Asset Management, LLC v. Real Time Consultants, Inc. (Bruderman Asset Management, LLC v. Real Time Consultants, Inc.) is published on Counsel Stack Legal Research, covering District Court, S.D. New York primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Bruderman Asset Management, LLC v. Real Time Consultants, Inc., (S.D.N.Y. 2021).

Opinion

USDC SDNY DOCUMENT UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK ELECTRONICALLY FILED . □□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□□ X DOC# EWEN. 5/9/2021 BRUDERMAN ASSET MANAGEMENT, © : DATE FILED: . LLC : Plaintiff, : 20-CV-3164 (VSB) - against - : OPINION & ORDER

REAL TIME CONSULTANTS, INC., : Defendant. :

wee eee X Appearances: Nathan A. Goldberg Schoeman Updike Kaufman & Gerber LLP New York, NY Counsel for Plaintiff Carmine J. Castellano Joseph P. Goldberg Hodgson Russ LLP New York, NY Counsel for Defendant VERNON S. BRODERICK, United States District Judge: Plaintiff Bruderman Asset Management, LLC (“Plaintiff” or “Bruderman”’) brings this action against Real Time Consultants, Inc. (“Defendant” or “Real Time”) for breach of contract and negligence. Before me is Defendant’s motion to dismiss Plaintiff's complaint. (Doc. 18.) For the reasons below, Defendant’s motion to dismiss is GRANTED IN PART and DENIED IN PART.

Factual Background1 Plaintiff is a New York limited liability company registered with the Securities and Exchange Commission (“SEC”) as an investment adviser. (Compl. ¶ 1.)2 Defendant is a New Jersey information technology consulting company that is registered to do business in New York. (Id. ¶¶ 3, 8.) On or around March 1, 2016, Plaintiff and Defendant entered into a Network

Management Premium Support Agreement (the “Agreement”), (Doc. 19-2), “for the support, administration, and management of the Microsoft Office platform and office environments.” (Compl. ¶¶ 10, 24.) Defendant’s “Premium Level” services included monitoring alerts generated by Defendant’s monitoring tool, notification of unusual events, antivirus and spyware management, premium-level firewall configuration and management, and a 15-minute “ticket open” window once an alert is received. (Id. ¶ 10.) Other elements of the Agreement include a New Jersey choice-of-law provision; a limitation of liability clause; a disclaimer of warranties provision; and a requirement that any amendments to the Agreement be in writing and signed by both parties. (Id. ¶ 11.)

The Agreement provided for a 12-month term that automatically renews for another 12- month term unless one of the parties gives 60-days written notice of its intention to terminate or modify the Agreement. (Id. ¶ 12.) The Agreement automatically renewed on March 1, 2017 and March 1, 2018. (Id.) On or around February 21, 2018, one or more unidentified persons (the “Intruders”) in Nigeria gained access to Plaintiff’s email environment, and access to the email account of a

1 The facts set forth herein are taken from allegations in the Complaint. (Doc. 10.) I assume Plaintiff’s allegations in the Complaint to be true for purposes of the motion. Kassner v. 2nd Ave. Delicatessen Inc., 496 F.3d 229, 237 (2d Cir. 2007). However, my reference to these allegations should be not construed as a finding as to their veracity, and I make no such findings. 2 “Compl.” refers to Plaintiff’s Complaint filed on April 29, 2020. (Doc. 10.) particular financial adviser employed by Plaintiff. (Id. ¶ 13.) This access went undetected until sometime in May 2018. (Id.) On or around April 21, 2018, the Intruders obtained access to the administrative privileges for Plaintiff’s server, changing them to (1) forward certain internal emails to an unknown Gmail account, and (2) move certain emails into the archive folders of Plaintiff’s employees rather than delivering them first to those accounts’ inboxes, such that those

employees would not see the emails when they came in. (Id.) Defendant did not detect this activity. (Id.) On or around May 13, 2018, the Intruders in Nigeria accessed Plaintiff’s fax email account and the email account of a Bruderman Managing Director, Andrew J. Leblanc (“Leblanc”). (Id. ¶ 14.) The Intruders created an email rule for the email accounts of Leblanc, Jannine Barbosa (“Barbosa”), Plaintiff’s then-Chief Operating Officer, and other employees that moved certain emails into a separate folder without first sending those emails to their main email inboxes. (Id. ¶ 15.) On or around May 14, 2018, Leblanc received an email from an Outlook email address, requesting that he transfer $950,000 from the account of one of Plaintiff’s clients

to a bank in Hong Kong. (Id. ¶ 16.) Although Leblanc never saw the email because of the changed email settings, the Intruders forwarded the email to Jannine Barbosa, Plaintiff’s then- Chief Operating Officer, along with a forged authorization form, requesting that she process the transfer. (Id.) Barbosa emailed Leblanc requesting that he call her to discuss the issue; Barbosa subsequently received a response from Leblanc’s email account that said: “Everything is in the right order. I checked it all carefully.” (Id.) Barbosa then transferred the funds by wire. (Id.) On or around May 15, 2018, the Intruders used a similar scheme to effectuate a $2,000,000 transfer from one of the same client’s accounts to a bank in Hong Kong. (Id. ¶ 17.) The next day, Barbosa received another wire transfer request, but determined the request was fraudulent and Bruderman contacted the FBI and Hong Kong police. (Id. ¶ 18.) Plaintiff subsequently engaged STI Group, an incident response team, to evaluate the nature and severity of the breach. (Id. ¶¶ 18–20.) STI Group conducted its evaluation and determined that “several administrative, technical and procedural controls for access management, logging and training monitoring were not in place and contributed to the inability

to detect the activity earlier and prevent the incident.” (Id. ¶ 19.) STI Group detailed that there were at least six “expected security controls” that were not in place at the time of the security breach:  Centralized system logs available for review,  Clearly defined onboarding and off-boarding procedures for controlled approval of end-user access and authorization,  Access controls to prevent outside parties from accessing the email system,  Preventing the sharing of administration accounts, or at least providing better accounting for actions taken from those accounts,  Multi-factor authentication for email and remote access, and  Monitoring and logging of third-party access and associated activity.

(Id.) Plaintiff alleges that all of these services were those that Defendant was expected to provide to Plaintiff pursuant to the Agreement. (Id. ¶¶ 19–20.) Plaintiff has paid its client back for the full $2,950,000 it erroneously wired from the client’s account. (Id. ¶ 21.) On or around November 12, 2018, Plaintiff terminated the Agreement, citing Defendant’s breach, and informed Defendant that it would not pay the remaining balance of its outstanding invoices. (Id. ¶ 22.) Procedural History On April 21, 2020, Plaintiff initiated this action by filing its complaint. (Doc. 1.) On April 28, 2020, Plaintiff filed an amended motion for leave to file a corrected complaint, (Doc. 8), which I granted on April 29, 2020, (Doc. 9.) On that same day, Plaintiff filed its corrected complaint, (“Complaint”), alleging claims for breach of contract and negligence. (Doc. 10.) On July 1, 2020, Defendant filed its motion to dismiss Plaintiff’s Complaint, accompanied by a memorandum of law, declaration, and two exhibits. (Docs. 18–20.) Plaintiff submitted a memorandum of law in opposition to Defendant’s motion to dismiss on July 27, 2020. (Doc. 23.) The motion became fully briefed when Defendant filed its reply memorandum of law on August 12, 2020. (Doc. 24.)

Legal Standard To survive a motion to dismiss under Federal Rule of Civil Procedure

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
Travelers Indem. Co. v. Dammann & Co., Inc.
594 F.3d 238 (Third Circuit, 2010)
Kassner v. 2nd Avenue Delicatessen Inc.
496 F.3d 229 (Second Circuit, 2007)
Saltiel v. GSI Consultants, Inc.
788 A.2d 268 (Supreme Court of New Jersey, 2002)
People Express Airlines, Inc. v. Consolidated Rail Corp.
495 A.2d 107 (Supreme Court of New Jersey, 1985)
Dean v. Barrett Homes, Inc.
8 A.3d 766 (Supreme Court of New Jersey, 2010)
L-7 Designs, Inc. v. Old Navy, LLC
647 F.3d 419 (Second Circuit, 2011)
Sommer v. Federal Signal Corp.
79 N.Y.2d 540 (New York Court of Appeals, 1992)
Syracuse Cablesystems, Inc. v. Niagara Mohawk Power Corp.
173 A.D.2d 138 (Appellate Division of the Supreme Court of New York, 1991)
Trustees of Columbia University v. Siegel
192 A.D.2d 151 (Appellate Division of the Supreme Court of New York, 1993)
Atkins Nutritionals, Inc. v. Ernst & Young, LLP
301 A.D.2d 547 (Appellate Division of the Supreme Court of New York, 2003)
Krock v. Lipsay
97 F.3d 640 (Second Circuit, 1996)
Curley v. AMR Corp.
153 F.3d 5 (Second Circuit, 1998)
Chambers v. Time Warner, Inc.
282 F.3d 147 (Second Circuit, 2002)

Cite This Page — Counsel Stack

Bluebook (online)
Bruderman Asset Management, LLC v. Real Time Consultants, Inc., Counsel Stack Legal Research, https://law.counselstack.com/opinion/bruderman-asset-management-llc-v-real-time-consultants-inc-nysd-2021.