DigitalDoors, Inc. v. Flushing Bank

• Court: District Court, E.D. New York
• Decided: January 16, 2026
• Docket: 2:25-cv-01895
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF NEW YORK -----------------------------------------------------------------X DIGITALDOORS, INC.,

Plaintiff, MEMORANDUM v. AND ORDER 25-CV-1895-SJB-SIL FLUSHING BANK,

Defendant. -----------------------------------------------------------------X BULSARA, United States District Judge: Pending before the Court is Defendant Flushing Bank’s letter-motion to dismiss Plaintiff DigitalDoors’s Amended Complaint for patent infringement. (Def.’s Mot. to Dismiss dated July 11, 2025 (“Def.’s Mot.”), Dkt. No. 21). Flushing Bank previously submitted a request for a premotion conference (“PMC”) to dismiss the original Complaint. (Def.’s Mot. for PMC dated May 5, 2025, Dkt. No. 16). After holding a PMC, the Court directed DigitalDoors to file an amended complaint and the parties to submit additional letter-briefing on a motion to dismiss the Amended Complaint. (Min. Entry dated June 12, 2025). DigitalDoors filed its Amended Complaint on June 27, 2025, (Am. Compl., Dkt. No. 20), which Flushing Bank now seeks to dismiss. For the reasons explained below, the Amended Complaint is dismissed with prejudice. FACTUAL BACKGROUND DigitalDoors owns a series of patents covering methods for data processing, storage, and security. (Am. Compl. ¶¶ 26–29, 32, 34). DigitalDoors alleges that Flushing Bank, a New York State-chartered bank, infringed four separate patents, and brings an additional, related claim for willful infringement. (Id. ¶¶ 4, 104–236). In its Amended Complaint, DigitalDoors alleges that financial institutions,

including Flushing Bank, are required to comply with the Gramm-Leach-Bliley Act (“GLBA”) and its accompanying regulations, which require banks to establish standards to ensure security of customer information. (Id. ¶¶ 5–7). And New York banks also must comply with state regulations that require covered entities to maintain cybersecurity systems and set guidelines for data security. (Id. ¶¶ 8–9 (citing N.Y. Comp. Codes R. and Regs. tit. 23 §§ 500.2, 500.3, 500.16; N.Y. Gen. Bus. L. § 899-bb(2))).

In essence, DigitalDoors’s lengthy and repetitive Amended Complaint alleges that to comply with these regulations, the financial services industry developed a standard for cybersecurity called “Sheltered Harbor,” which necessarily—because of its design— infringes on DigitalDoors’s patents. (E.g., id. ¶¶ 11, 70–103). With respect to Flushing Bank, DigitalDoors alleges, upon information and belief, that Flushing Bank either uses “systems and methods for processing data” that are Sheltered Harbor compliant, or uses a system with “substantially equivalent

functionality.” (Id. ¶ 103). DigitalDoors further alleges that Flushing Bank uses Sheltered Harbor Certified systems provided by Q2 Software to protect customer data in accordance with the aforementioned regulations. (Am. Compl. ¶ 12). DISCUSSION The Second Circuit has “occasionally affirmed the granting of dispositive motions without full briefing . . . only when the issues were predominantly legal and the complaint had ‘substantial deficiencies.’” Kowalchuck v. Metro. Transp. Auth., 94 F.4th 210, 217 (2d. Cir. 2024) (quoting Grossman v. GEICO Cas. Co., No. 21–2789, 2022 WL 1656593, at *4 (2d Cir. May 25, 2022)). The parties have been heard for oral

argument previously, and the legal and factual issues are straightforward. The Court deems additional briefing unnecessary (and no party has requested additional briefing beyond the letters submitted or in their supplemental submissions),1 and the motion is granted for the reasons explained below. See, e.g., Kapitalforeningen Lægernes Inv. v. United Techs. Corp., 779 F. App’x 69, 70–71 (2d Cir. 2019) (affirming district court’s dismissal of an action by way of premotion letter construed as a motion to dismiss).

“To survive a motion to dismiss [pursuant to Rule 12(b)(6)], a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quotation omitted). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id. A complaint must contain more than “naked assertion[s] devoid of further factual enhancement.” Id. (quotations omitted). In other words, a plausible claim contains “factual content that allows the court to draw the

reasonable inference that the defendant is liable for the misconduct alleged.” Id.; Fed. R. Civ. P. 8(a)(2). “Factual allegations must be enough to raise a right to relief above the

1 After DigitalDoors filed a letter indicating that it was satisfied that the Q2 software used by Flushing Bank was not used to infringe the patents, (Pl.’s Letter dated Nov. 11, 2025, Dkt. No. 26), the parties filed additional letters supplementing their briefing on the motion to dismiss, (Def.’s Suppl. Mot. to Dismiss dated Nov. 21, 2025, Dkt. No. 27; Pl.’s Resp. in Opp’n to Def.’s Suppl. Mot. to Dismiss dated Nov. 24, 2025, Dkt. No. 28). speculative level . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact)[.]” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (citations omitted). The determination of whether a party has alleged a plausible claim is “a

context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679. This pleading requirement “does not impose a probability standard at the motion-to-dismiss stage.” Mosaic Health, Inc. v. Sanofi-Aventis U.S., LLC, 156 F.4th 68, 77 (2d Cir. 2025) (noting that plausibility does not equate to probability). To avoid dismissal, a plaintiff must plead sufficient facts to “nudge[] their claims across the line

from conceivable to plausible.” Twombly, 550 U.S. at 570. Evaluating a complaint on a motion to dismiss, the Court “accept[s] as true all factual allegations and draw[s] from them all reasonable inferences; but [is] not required to credit conclusory allegations or legal conclusions couched as factual allegations.” Hamilton v. Westchester Cnty., 3 F.4th 86, 90–91 (2d Cir. 2021). Direct patent infringement claims “are subject to the pleading standards established by [Twombly and Iqbal].” Golden v. Apple Inc., 819 F. App’x 930, 930–31 (Fed.

Cir. 2020) (per curiam). “There must be some allegation of specific services or products of the defendants which are being accused,” Addiction & Detoxification Inst. L.L.C. v. Carpenter, 620 F. App’x 934, 937 (Fed. Cir. 2015) (emphasis added), to avoid dismissal. As the Federal Circuit has noted, “[i]t is not enough to say ‘you infringe my patent.’” Id. DigitalDoors alleges that Flushing Bank infringes its patents because a series of federal and state regulations require Flushing Bank to adopt standards and develop systems for protecting customer data, (Am. Compl. ¶¶ 5–11), Flushing Bank utilizes

Sheltered Harbor Certified software provided by Q2—as well as other unidentified “systems and methods”—to comply with these regulations, (id. ¶¶ 12, 103), and Sheltered Harbor Certified software infringes DigitalDoors’s patents by design, (id. ¶¶ 11, 71–103). The Amended Complaint, like the original Complaint, describes how the Sheltered Harbor standard works, and that for it to be effectively applied, using the standard necessarily infringes DigitalDoors’s patents. (Id. ¶¶ 70–103).

On November 11, 2025, DigitalDoors filed a letter indicating that after discussions with Flushing Bank’s counsel and investigation of the Sheltered Harbor Certified Q2 software Flushing Bank uses, it was satisfied that Flushing Bank’s use of the Q2 software does not infringe the patents. (Pl.’s Letter dated Nov. 11, 2025 (“Pl.’s Letter”), Dkt. No. 26). Flushing Bank contends that the remaining allegations in the Amended Complaint fail to state a claim for patent infringement. (Def.’s Mot. at 1–3). The Court

agrees. Even taking all of DigitalDoors’s allegations as true, the Amended Complaint fails to state a claim for patent infringement for two reasons. First, the Amended Complaint fails to identify an actual accused “service[] or product[]” Flushing Bank uses that infringes. See Addiction & Detoxification Inst. L.L.C., 620 F. App’x at 937. Because the Q2 software was the only specific product alleged in the Complaint, and DigitalDoors has conceded that it does not infringe the patents, DigitalDoors is back where it started—without any allegations of an actual accused product or service used by Flushing Bank which infringes. Such gaps require dismissal of infringement claims. As the Federal Circuit explained in a similar case:

[Plaintiff’s] third amended complaint described the patents and the parties and alleged that Ball infringes the ’492, ’907, ’998, ’999, and ’347 patents by use of one or more of the machines at least at the Bristol Plant. The third amended complaint did not otherwise identify the accused machines . . . . The complaint also identified additional Ball packaging plants across the country, and alleged that on information and belief, machines in each of these plants similarly infringe one or more of the asserted patents. We agree with the district court that these allegations are insufficient to state a plausible claim for direct infringement. Even taken as true, the facts alleged in the third amended complaint are insufficient to state a plausible, rather than merely possible, claim for relief. . . . [T]he third amended complaint does not sufficiently identify, for example, by photograph or name, any of the particular machines that allegedly infringe other than by broad functional language. . . . [Plaintiff] did not fairly identify the accused machines. The third amended complaint is thus insufficient; under any pleading standard[.]

Artrip v. Ball Corp., 735 F. App’x 708, 714–15 (Fed. Cir. 2018) (quotations and citations omitted); e.g., Arunachalam v. Apple, Inc., 806 F. App’x 977, 981 (Fed. Cir. 2020) (“[T]he Complaint never identified even a single specific app, nor did it specifically allege how such an app (or platform) actually infringes the . . . patent. Such overly broad allegations are insufficient to survive a motion to dismiss.”); Upstream Holdings, LLC v. Brekunitch, No. 22-CV-3513, 2022 WL 17371052, at *1 (C.D. Cal. Aug. 3, 2022) (dismissing patent infringement claim because plaintiff’s allegations “[u]pon information and belief . . . do not clearly identify an accused product, let alone provide factual content demonstrating that an accused product would meet the claim limitations of one or more of the claims in the [patent]” (quotations omitted)). DigitalDoors’s allegations that Flushing Bank still uses other unidentified “systems and methods for processing data” that infringe the patents, (see Am. Compl. ¶ 103; Pl.’s Letter; Pl.’s Resp. in Opp’n to Def.’s Suppl. Mot. to Dismiss dated Nov. 24,

2025, Dkt. No. 28 at 1), cannot save its claims. Such broad, indefinite allegations do not identify an actual accused product or service used by Flushing Bank that infringes DigitalDoors’s patents. The Court recognizes that DigitalDoors “is not required to plead infringement on an element-by-element basis.” Bot M8 LLC v. Sony Corp. of Am., 4 F.4th 1342, 1352 (Fed. Cir. 2021). But the vague allegations of the existence of infringing products—encompassing a supposed system and method used by Flushing Bank to

comply with the federal and state regulations—are so broad that they cannot put Flushing Bank “on notice of what activity . . . is being accused of infringement.” See id. (quoting Lifetime Indus., Inc. v. Trim-Lok, Inc., 869 F.3d 1372, 1379 (Fed. Cir. 2017)); e.g., Addiction & Detoxification Inst. L.L.C., 620 F. App’x at 937 (“The bare allegation that Defendants make, use, sell, and offer for sale undefined ‘activities, methods, and procedures’ provides no detail whatsoever that would put Defendants on notice as to what activity, method, or procedure is alleged to infringe.”); Big Baboon, Inc. v. SAP Am.,

Inc., No. 17-CV-2082, 2018 WL 1400443, at *4 (N.D. Cal. Mar. 20, 2018) (“The Court finds it unnecessary to delve into the myriad ways in which these allegations are insufficient because nowhere do they allege that a specific product of Defendants’ infringes.”). Second, even if DigitalDoors had identified an accused product, the Amended Complaint still lacks sufficient facts to plausibly allege that these unidentified systems infringe the patents. See Adnexus Inc. v. Meta Platforms, Inc., 160 F.4th 1216, 1221 (Fed. Cir. 2025) (“[T]here must be some factual allegations that, when taken as true, articulate why it is plausible that the accused product infringes the patent claim.” (quoting Bot M8 LLC, 4 F.4th at 1353)). The Amended Complaint fails to demonstrate why

implementing systems compliant with the Sheltered Harbor standard necessarily infringes DigitalDoors’s patents. DigitalDoors alleges, for example, that the Sheltered Harbor specifications “require participants to protect critical data sets, including by creating dedicated, isolated environments which are physically separated from corporate networks and backup systems,” (Am. Compl. ¶ 81), and “require[] a data vault, which is an ultra secure environment where data can be safely stored,” (id. ¶ 93

(quotations omitted)). But DigitalDoors presumes, without explanation, that to comply with these specifications, a financial institution like Flushing Bank must develop or use systems that infringe on DigitalDoors’s patents (and that their patents cover all systems that could be designed to meet the regulatory requirements). The allegations in the Amended Complaint about what the Sheltered Harbor standard requires are broad, (see, e.g., id.), and do not lead to the inference that the only way to satisfy regulatory specifications is by infringing on the methods for data storage and security protected by

the patents. And critically, DigitalDoors’s concession—that the Sheltered Harbor Certified Q2 Software used by Flushing Bank does not infringe the patents— undermines its theory of patent infringement. DigitalDoors has conceded that compliance with the regulations, and even use of Sheltered Harbor Certified software, does not necessarily infringe its patents. (See Pl.’s Letter). Ultimately, DigitalDoors’s Amended Complaint fails to “nudge[] [its] claims across the line from conceivable to plausible.” Twombly, 550 U.S. at 570; e.g., Huang v. Amazon.com, Inc., No. 24-1428, 2025 WL 314718, at *3 (Fed. Cir. Jan. 28, 2025) (“[Plaintiff] contends that, because all the cell phones in [the Complaint’s] list of accused products have EEPROM chips, and because

all such EEPROM chips (or, at the very least, the EEPROM chips of major providers) have the infringing circuit in Figure 1 of Exhibit X1, all cell phones thus infringe claim 29 of the ‘259 patent . . . these statements fall short. They simply assume that either all or a majority of cell phones have the infringing circuit.”). Accordingly, the first four claims for direct infringement are dismissed.2 Lastly, the fifth claim, for “Knowledge and Willfulness,” is also dismissed.

(Def.’s Mot. at 4). A claim for willful infringement of a patent requires a properly pled claim for patent infringement, which is absent.3

2 Flushing Bank also argues that the patents are invalid as a matter of law because they pertain to “abstract ideas.” (Def.’s Mot. at 3). “[P]atent eligibility can be determined at the Rule 12(b)(6) stage.” Aatrix Software, Inc. v. Green Shades Software, Inc., 882 F.3d 1121, 1125 (Fed. Cir. 2018). But, “[t]his is true only when there are no factual allegations that, taken as true, prevent resolving the eligibility question as a matter of law.” Id. Here, patent validity would require discovery, including expert witness testimony, to determine whether DigitalDoors’s patents cover patent-eligible concepts.

3 Flushing Bank seeks attorney’s fees under the Patent Act, which allows the prevailing party to recover attorney’s fees in “exceptional cases.” (Def.’s Mot. at 4); 35 U.S.C. § 285. This case does not “stand[] out from others with respect to the substantive strength of a party’s litigating position,” and DigitalDoors has not litigated this case in an “unreasonable manner.” See Octane Fitness, LLC v. ICON Health & Fitness, Inc., 572 U.S. 545, 554 (2014). Therefore, Flushing Bank’s request for attorney’s fees is denied. CONCLUSION For the reasons explained above, the Court grants Flushing Bank’s motion and dismisses DigitalDoors’s Amended Complaint in its entirety. DigitalDoors did not seek

leave to amend or provide any indication of allegations it might add to the Amended Complaint to make it viable, so the dismissal is with prejudice. See Horoshko v. Citibank, N.A., 373 F.3d 248, 249–50 (2d Cir. 2004) (“Because an amendment is not warranted [a]bsent some indication as to what appellants might add to their complaint in order to make it viable, the District Court was under no obligation to provide the [plaintiffs] with leave to amend their complaint, much less provide such leave sua sponte. The

[plaintiffs’] contention that the District Court abused its discretion in not permitting an amendment that was never requested is frivolous.” (quotations omitted)); Univ. of Pittsburgh v. Varian Med. Sys., Inc., 569 F.3d 1328, 1331 (Fed. Cir. 2009) (“In reviewing a district court’s determination that a dismissal should be with prejudice, we apply the procedural law of the pertinent regional circuit.”). The Clerk of Court is directed to close this case. SO ORDERED. /s/ Sanket J. Bulsara SANKET J. BULSARA United States District Judge Date: January 16, 2026 Central Islip, New York