Connor Burns v. Mammoth Media, Inc.

• Court: District Court, C.D. California
• Decided: August 6, 2021
• Docket: 2:20-cv-04855
• Status: Unknown

Opinion

1 2 O 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 CENTRAL DISTRICT OF CALIFORNIA 10 11 CONNOR BURNS, ) Case No. CV 20-04855 DDP (SKx) ) 12 Plaintiff, ) ) ORDER GRANTING DEFENDANT’S MOTION 13 v. ) TO DISMISS ) 14 MAMMOTH MEDIA, INC., ) ) 15 Defendants. ) [Dkt. 19] ) 16 17 Presently before the court is Defendant Mammoth Media, Inc. 18 (“Mammoth”)’s Motion to Dismiss. Having considered the submissions 19 of the parties and heard oral argument, the court grants the motion 20 and adopts the following Order. 21 I. Background 22 Plaintiff Connor Burns, a citizen of Idaho, downloaded 23 Mammoth’s mobile “Wishbone” application (“app”) when he was 24 fourteen years old. (First Amended Complaint (“FAC”) ¶ 2.) To use 25 the app, Plaintiff was required to create an account, select a 26 username and password, and provide his e-mail address. (Id.). 27 Plaintiff deleted the app soon after downloading it, but did not 28 delete his account. (FAC ¶ 3.) 1 Four years later, Mammoth informed Plaintiff that it had 2 suffered a data breach, and that Wishbone users’ “usernames, 3 emails, phone numbers, timezone/region, full name, bio, gender, 4 hashed [i.e., encrypted,] passwords, and profile pictures” may have 5 been compromised. (FAC ¶ 4.) Plaintiff also alleges that Mammoth 6 collected and maintained other types of user data that were also 7 compromised, including date of birth, location information, user 8 settings, social media profiles, and “access tokens.” (Id. ¶¶ 15, 9 25.) Plaintiff further alleges that data pertaining to 40 million 10 Wishbone users was circulated for sale on the dark web, and 11 ultimately released for free. (Id. ¶ 22.) 12 Plaintiff alleges that, following the Wishbone data breach, 13 his Spotify and Reddit accounts were compromised, forcing him to 14 change his passwords. (FAC ¶¶ 57-58.) Plaintiff also began 15 receiving spam e-mails. (Id.) Plaintiff spent about three hours 16 changing other online passwords, setting up fraud alerts, and 17 reviewing his bank accounts for fraudulent transactions. (Id. ¶ 18 58.) Plaintiff alleges that the theft of his data will result in 19 identity theft and fraud, lowered credit scores resulting from 20 fraudulent activity, loss of access to online and financial 21 accounts, and the loss of time and enjoyment stemming from efforts 22 to mitigate or prevent identity theft. (Id. ¶ 64.) 23 The FAC alleges, on behalf of a putative class, five causes of 24 action for negligence, declaratory judgment, breach of confidence, 25 violation of California’s Unfair Competition Law (Cal. Bus. & Prof. 26 Code ¶¶ 17220, et seq.), and violations of “data breach statutes” 27 of thirty-eight different states. Defendant Mammoth now seeks to 28 dismiss the FAC pursuant to Federal Rule of Procedure 12(b) (1) and Rule 12 (b) (6). 3] II. Legal Standard 4 A motion under Rule 12(b) (1) may challenge the court’s jurisdiction facially, based on the legal sufficiency of the claim, 6]/or factually, based on the legal sufficiency of the jurisdictional facts. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000) (citing 2 James Wm. Moore et al., Moore’s Federal Practice 12.30[4], at 12-38 to 12-41 (3d ed.1999)). Where the motion attacks the complaint on its face, the court considers the complaint’s 11] allegations to be true, and draws all reasonable inferences in the 12] plaintiff’s favor. Doe v. Holy See, 557 F.3d 1066, 1073 (9th Cir. 2009). In a factual challenge, the court is not required to accept the allegations of the complaint as true and may consider additional evidence outside of the pleadings. Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). Once the moving party has presented evidence showing a lack of subject-matter jurisdiction, the burden shifts to “the party opposing the motion [to] furnish affidavits or other evidence necessary to satisfy its burden of establishing subject matter jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). If the plaintiff cannot meet its burden of establishing the jurisdiction it seeks to invoke, the court must dismiss the case. Fed. R. Civ. 24 P. 12(h) (3). 25 When considering a Rule 12(b) (6) motion, a court must “accept 26]/ as true all allegations of material fact and must construe those facts in the light most favorable to the plaintiff.” Resnick v. 28] Hayes, 213 F.3d 443, 447 (9th Cir. 2000). A complaint will survive

1]}/a motion to dismiss when it “contain[s] sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Igbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Although a 5] complaint need not include “detailed factual allegations,” it must 6} offer “more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Igqgbal,556 U.S. at 678. Conclusory allegations or allegations that are no more than a statement of a legal conclusion 9} “are not entitled to the assumption of truth.” Id. at 679. In other words, a pleading that merely offers “labels and conclusions,” a “formulaic recitation of the elements,” or “naked assertions” will not be sufficient to state a claim upon which relief can be granted. Id. at 678 (citations and internal quotation marks omitted). 15 “When there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they 17] plausibly give rise to an entitlement of relief.” Iqbal,556 U.S. 18} at 679. Plaintiffs must allege “plausible grounds to infer” that 19] their claims rise “above the speculative level.” Twombly, 550 U.S. 20]}/at 555-56. “Determining whether a complaint states a plausible claim for relief” is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Igbal, 556 U.S. at 679. IIIT. Discussion 25 A party invoking federal jurisdiction bears the burden of 26} demonstrating that he has Article III standing. Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992). To meet that burden, “a 28 |} plaintiff must show (1) it has suffered an ‘injury in fact’ that is

. . actual or imminent, not conjectural or hypothetical; (2) the 2 injury is fairly traceable to the challenged action of the 3} defendant; and (3) it is likely, as opposed to merely speculative, 4} that the injury will be redressed by a favorable decision. Friends 5] of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), Inc., 528 U.S. 6/167, 181 (2000). “Rule 12(b) (1) jurisdictional attacks can be 7|)/either facial or factual.” White, 227 F.3d at 1242. “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal Jurisdiction.” Safe Air, 373 F.3d 1035 at 131039. The distinction is important. When considering a facial attack, the court considers all factual allegations to be true and draws all inferences in favor of the plaintiff. Doe, 557 F.3d at 16}/ 1073. “In resolving a factual attack on jurisdiction, [however], the district court may review evidence beyond the complaint without 18] converting the motion to dismiss into a motion for summary judgment.” Safe Air, 373 F.3d at 1039. 20 Here, although Mammoth’s factual and facial challenges are interwoven to some extent, Mammoth clearly asserts a factual challenge to Plaintiff’s standing. (E.g., Memorandum in Support of 23 Motion at 1:20-21 (“Mammoth asserts both a facial and factual 24 attack . . .), 6:24-25 (“Mammoth makes both a facial and a factual 25|| challenge here.”) A party making a factual challenge under Rule 26 12 (b) (1) must present affidavits or other evidence. Savage v. 271 Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 281 1036, 1039 n.2 (9th Cir. 2003) (citing St. Clair v. City of Chico,

1 880 F.2d 199, 201 (9th Cir. 1989)). Mammoth supports its factual 2 challenge with the Declaration of Brian DeBoer, Mammoth’s Chief 3 Technology Officer. DeBoer states that Plaintiff’s compromised 4 information includes “his name, his username for the Wishbone app, 5 his email address, a record of the date he created his Wishbone 6 profile, his gender, the user ID number that Mammoth assigned to 7 him, his encrypted password, his Mammoth assigned access token, an 8 authorization token, a Facebook ID, a url to an image, country, 9 time zone, Apple idfa, stickers left, and the date last updated.” 10 (DeBoer Decl. ¶ 6.) DeBoer further states that Plaintiff’s 11 compromised information did not include his birth date, address, 12 social security number, or any financial information. (Id. ¶ 7.) 13 And, critically, DeBoer’s declaration states that the nature of 14 Plaintiff’s information is such that it cannot be used to access 15 Spotify, Reddit, or any other account.1 (Id. ¶¶ 9-14.) 16 Rather than address these facts directly, Plaintiff contends 17 that the DeBoer declaration is not sufficient to raise a factual 18 challenge because it does not cast doubt on the veracity of any of 19 Plaintiff’s allegations. (Response at 4:19-24.) Plaintiff’s FAC, 20 however, is premised largely on the allegation that “[a]s a result 21 of Mammoth’s failure to protect the [information] it was entrusted 22 with, Plaintiff and class members have been exposed to and/or are 23 at a significant risk of identity theft, financial fraud, and other 24 identity-related fraud into the indefinite future.” (FAC ¶ 8.) 25 The FAC goes on to allege a host of other harms flowing from the 26 27 1 As Plaintiff acknowledges, the FAC does not allege that Plaintiff used his Wishbone password, an encrypted version of which 28 was compromised, as his Spotify or Reddit password. data breach, including expenses associated with credit monitoring and protection services, the loss of access to online accounts, lowered credit scores, and loss of time and enjoyment related to mitigation efforts in the wake of fraud and identity theft. □□□□ 64.)° These allegations are impossible to square with DeBoer’s declaration that Plaintiff’s compromised information is essentially useless. If, as DeBoer’s declaration suggests, Plaintiff’s allegations as to the likelihood of identity theft and fraud are false, Plaintiff cannot possibly establish an injury in fact, let 10 11 * The FAC also makes reference to Plaintiff’s loss of the 12 “inherent value” of his information. (FAC FTI 34, 64(c).) Although Plaintiff’s response to Mammoth’s Motion to Dismiss does mention 13 this theory as it relates to standing under California’s Unfair Competition Law (Response at 18), Plaintiff does not discuss the 14 inherent value theory as it pertains to Article III standing. It is not entirely clear that Mammoth’s factual challenge encompasses 15 this theory. Although the DeBoer declaration could, perhaps, be read to suggest that Plaintiff’s compromised data has no value, 16 insofar as DeBoer opines that the data is essentially useless, the declaration does not use the term “inherent value” or take an express position on the truth of Plaintiff’s allegation as to the existence of any such value. The court notes, however, that 18 several courts have rejected similar theories as implausible, speculative, or otherwise infirm, especially where, as here, there 19 is no allegation of a legitimate market for the information. See, e.g., In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 20 F. Supp. 3d 767, 784 (N.D. Cal. 2019) (“The plaintiffs do not plausibly allege that they intended to sell their non-disclosed personal information to someone else. Nor, in any event, do they plausibly allege that someone else would have bought it as a 29 stand-alone product. The plaintiffs’ economic-loss theory is therefore purely hypothetical and does not give rise to 23 standing.”); Svenson v. Google Inc., 65 F. Supp. 3d 717, 724-25 (N.D. Cal. 2014); Low v. LinkedIn Corp., No. 11-CV-01468-LHK, 2011 DA WL 5509848, at *5 (N.D. Cal. Nov. 11, 2011); LaCourt v. Specific Media, Inc., No. SACV 10-1256 GW JCGX, 2011 WL 1661532, at *4-5 25 (C.D. Cal. Apr. 28, 2011); Chambliss v. Carefirst, Inc, 189 F. Supp. 3d 564, 572 (D. Md. 2016); Green v. eBay Inc., No. CIV.A. 26 14-1688, 2015 WL 2066531, at *5 (E.D. La. May 4, 2015); cf. In re Google Inc. Cookie Placement Consumer Priv. Litig., 806 F.3d 125, 27 149 (3d Cir. 2015); Adkins v. Facebook, Inc., No. C 18-05982 WHA, 2019 WL 3767455, at *3 (N.D. Cal. Aug. 9, 2019); but see In re 28 Anthem, Inc. Data Breach Litig., No. 15-MD-02617-LHK, 2016 WL 3029783, at *15 (N.D. Cal. May 27, 2016).

1] alone an injury that is traceable to Mammoth or redressable by 2 order of this Court. 3 Plaintiff’s reliance on In re Zappos.com, Inc., 888 F.3d 1020 4 (9th Cir. 2018) is misplaced. Although Plaintiff correctly observes that the Zappos court refused to consider material extrinsic to the plaintiff’s complaint, it did so because, as the 7! court explicitly noted, the defendant “presented its arguments as a facial, not a factual, attack on standing.” Zappos, 888 F.3d at 91 1023 n.2, 1028. Where, as here, “the defendant raises a factual attack, the plaintiff must support h[is] jurisdictional allegations with competent proof, under the same evidentiary standard that governs in the summary judgment context.” Leite v. Crane Co., 749 13] F.3d 1117, 1121 (9th Cir. 2014) (internal quotation marks and citation omitted); see also Augustine v. United States, 704 F.2d 15/1074, 1077 (9th Cir. 1983). “The plaintiff bears the burden of proving by a preponderance of the evidence that each of the requirements for subject-matter jurisdiction has been met.” 18] Leite, 749 F.3d at 1121 (emphasis added). “Once the moving party has converted the motion to dismiss into a factual motion by presenting affidavits or other evidence properly brought before the court, the party opposing the motion must furnish affidavits or 221] other evidence necessary to satisfy its burden... .” Savage, 343 F.3d at 1039 n. 2; see also Johnson v. Oishi, 362 F. Supp. 3d 24] 843, 847 (E.D. Cal. 2019) (“If the plaintiff’s allegations of jurisdictional facts are challenged by the adversary in the appropriate manner, the plaintiff cannot rest on the mere assertion 27 that factual issues may exist.”); Strojnik v. 8757 Rio San Diego 28 Mission Valley Owner, LLC, No. 20CV0384 DMS (MSB), 2020 WL 5544220,

at *2 (S.D. Cal. Sept. 16, 2020). Plaintiff has produced no such evidence here. 3 Plaintiff also argues, briefly, that dismissal under Rule 41 12(b) (1) is not appropriate because the factual questions regarding 5 jurisdiction are “inextricably intertwined.” (Response at 6 n.2.) Generally, “[j]urisdictional finding of genuinely disputed facts is inappropriate when ‘the jurisdictional issue and substantive issues are so intertwined that the question of jurisdiction is dependent 9]/on the resolution of factual issues going to the merits’ of an action.” Sun Valley Gasoline, Inc. v. Ernst Enterprises, Inc., 711 F.2d 138, 139 (9th Cir. 1983) (quoting Augustine, 704 F.2d at 1077) (emphasis added). “Normally, the question of jurisdiction and the merits of an action will be considered intertwined where .. .a statute provides the basis for both the subject matter jurisdiction of the federal court and the plaintiff’s substantive claim for relief.” Sun Valley, 711 F.2d at 139. Because such is not the case here, Defendant suggests that the jurisdictional facts are not “intertwined” with the merits. (Reply at 3.) Defendant, however, 19}/ takes too narrow a view. Although situations where a federal statute provides both the jurisdictional and substantive basis for 21]/a claim may present archetypical examples of intertwined facts, courts have not limited their inquiries to the question whether or to what extent a federal statute is at issue. See, e.g., Autery v. United States, 424 F.3d 944, 956 (9th Cir. 2005); Roberts v. Corrothers, 812 F.2d 1173, 1177 (9th Cir. 1987); Rosales v. United 26]| States, 824 F.2d 799, 803 (9th Cir. 1987). 27 Here, there is significant overlap of jurisdictional and 28] substantive allegations regarding Plaintiff’s risk of identity

1} theft, fraud, and related harms. There is, however, no corresponding intertwining of jurisdictional and merits-related, disputed facts. As discussed above, Plaintiff has failed to meet 4! his burden to respond to Defendant’s evidence with any competent 5} proof. Under such circumstances, courts have concluded that “material facts concerning Article III’s causation element are 7! undisputed since Plaintiffs did not produce evidence to support that issue. Consequently, any factual overlap between Plaintiffs’ standing and the merits is not an impediment to granting [a] Rule 12 (5) (1) motion.” Foster v. Essex Prop., Inc., No. 5:14-CV-05531-EJD, 2017 WL 264390, at *4 (N.D. Cal. Jan. 20, 2017); cf. Leite, 749 F.3d at 1122 n.3 ([“[A] court must leave the resolution of material factual disputes to the trier of fact when the issue of subject-matter jurisdiction is intertwined with an 15}/element of the merits of the plaintiff's claim.”) (emphasis added); Sun Valley, 711 F.2d at 139 (“Jurisdictional finding of genuinely disputed facts is inappropriate when the jurisdictional issue and 18] substantive issues are so intertwined ... .”) (internal quotation mark omitted) (emphasis added); Augustine, 704 F.2d at 1077 (“In 20] ruling on a jurisdictional motion involving factual issues which also go to the merits, the trial court should employ the standard applicable to a motion for summary judgment. .. . [T]he moving 23] party should prevail only if the material jurisdictional facts are 24 not in dispute ... .”) (emphasis added); Williams v. Facebook, Inc., 498 F. Supp. 3d 1189, 1195-96 (N.D. Cal. 2019) ([]Plaintiffs initially failed to submit any competing evidence to create a dispute of material fact warranting deferral ... .”). 28 10

1 Because the only evidence in the record currently before the 2 court indicates that the Mammoth data breach could not possibly 3 have caused the risk of identity theft, fraud, and attendant harms 4 alleged in the FAC, Plaintiff’s complaint must be dismissed for 5 lack of standing.3 6 IV. Conclusion 7 For the reasons stated above, Defendant’s Motion to Dismiss is 8 GRANTED. Plaintiff’s FAC is DISMISSED, with leave to amend. Any 9 amended complaint shall be filed within fourteen days of the date 10 of this Order. 11 12 13 IT IS SO ORDERED. 14 15 16 Dated: 8-6-21 DEAN D. PREGERSON 17 United States District Judge 18 19 20 21 22 23 24 25 26 27 3 Having concluded that the FAC must be dismissed for lack of 28 standing, the court does not reach Defendant’s other arguments.