1 FILED IN THE U.S. DISTRICT COURT 2 EASTERN DISTRICT OF WASHINGTON Sep 20, 2024 3 SEAN F. MCAVOY, CLERK 4 EASTERN DISTRICT OF WASHINGTON 6
a Washington corporation, NIKOS NO. 4:24-CV-5045-TOR 8 DANAKOS, and NICOLE DANAKOS, ORDER GRANTING DEFENDANT 9 NEWCOURSE COMMUNICATION Plaintiffs, INC.’S MOTION TO DISMISS 10 v. 11 YOURPEOPLE, INC., a Delaware 12 corporation, KEYBANK NATIONAL ASSOCIATION, a 13 national bank, and NEWCOURSE COMMUNICATIONS, INC., 14 Defendants. 15
16 BEFORE THE COURT is Defendant Newcourse Communication Inc.’s 17 Motion to Dismiss (ECF No. 35). This matter was submitted for consideration 18 without oral argument. The Court has reviewed the record and files herein and is 19 fully informed. For the reasons discussed below, Defendant Newcourse 20 Communication Inc.’s Motion to Dismiss (ECF No. 35) is GRANTED. 2 This matter arises out of alleged identity theft resulting in the loss of
3 $432,500 from Plaintiffs’ business bank account. Plaintiff Greek Islands Cuisine 4 (“Greek Islands”) is a restaurant located in Richland, Washington and owned in 5 part by Plaintiff Nikos Danakos. ECF No. 7 at 5, ¶ 4.1. Greek Islands maintains a
6 business bank account at KeyBank National Association (“KeyBank”), specifically 7 at its branch in Kennewick, Washington. Id., ¶ 4.2. Mr. Danakos, together with 8 his wife Nicole Danakos, held a personal checking account at HomeStreet Bank, 9 headquartered in Seattle, Washington. Id. at 18, ¶ 4.22. HomeStreet bank utilizes
10 Defendant Newcourse Communications, Inc. (“Newcourse”) in its business 11 providing mailing services to financial institutions. Id. 12 On June 7, 2022, Plaintiffs learned that Greek Islands’ business bank
13 account held at KeyBank had been compromised, resulting the loss of $432,500. 14 Id. at 13, ¶ 4.15. Thieves had gained access to the KeyBank business account by 15 impersonating Mr. Danakos to establish a payroll system within the checking 16 account through YourPeople, Inc., d/b/a Zenefits. Id. at 6, ¶ 4.4. The imposters
17 submitted to Zenefits a fraudulent driver’s license with an incorrect middle name, 18 another person’s photograph and signature, and an incorrect address. Id. at 8, ¶ 19 4.7. After establishing the direct deposit payroll account with KeyBank, Zenefits
20 processed two transfers amounting the $432,500 on June 3, 2022. Id. at 9, ¶ 4.9. 1 On September 7, 2022, Newcourse sent Mr. and Mrs. Danakos notice that 2 their account with HomeStreet Bank was included in a data breach occurring
3 sometime between April 27 and May 3, 2022. Id. at 17‒18, ¶¶4.22‒4.23. The 4 notice stated that in August 2022, Newcourse had discovered that the breach 5 included sensitive information including; Plaintiffs’ full names, account numbers,
6 and possibly mortgage statement with their home address and last four digits of 7 their social security numbers. Id. The Amended Complaint does not allege that 8 KeyBank utilized Newcourse’s mailing services. Plaintiffs allege that 9 Newcourse’s data breach allowed the criminals to obtain their sensitive
10 information, which they used to gain access to the KeyBank account. Id. at 21, ¶ 11 4.29. This was accomplished, according to Plaintiffs, by the creation of “Fullz” 12 packages, whereby criminals cross reference illegally obtained information with
13 public information to create a full background of an individual to more completely 14 assume a stolen identity. Id. at 26, ¶¶ 4.44‒4.45. 15 Plaintiffs Nikos and Nicole Danakos bring claims of negligence, negligence 16 per se, and a violation of the Washington Consumer Protection Act against
17 Defendant Newcourse. Id. at 33‒36, ¶¶ 6.7‒6.9. Defendant Newcourse argues that 18 Plaintiffs’ claims against it should be dismissed because: (1) they lack standing to 19 support any of their claims, (2) they are unable to establish a breach of duty or
20 injury in negligence, (3) they cite no statutory authority to establish a claim of 1 negligence per se, and (4) they fail to establish any of the factors required under 2 Washington law to establish a Washington Consumer Protection Act claim. ECF
3 No. 35. Plaintiffs, responded, arguing that they do have standing, and that they 4 have established each of their claims. ECF No. 45.
6 I. Article III Standing 7 Defendant argues that dismissal for lack of Article III standing is warranted 8 because Plaintiffs’ fail to allege an injury-in-fact that is fairly traceable to 9 Newcourse. ECF No. 35 at 5. A jurisdictional challenge brought under Federal
10 Rule of Civil Procedure 12(b)(1) may present as either a facial or factual attack. 11 White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the 12 challenger asserts that the allegations contained in a complaint are insufficient on
13 their face to invoke federal jurisdiction. By contrast, in a factual attack, the 14 challenger disputes the truth of the allegations that, by themselves, would 15 otherwise invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 16 1035, 1039 (9th Cir. 2004). The court “resolves a facial attack as it would a
17 motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s allegations as true 18 and drawing all reasonable inferences in the plaintiff’s favor, the court determines 19 whether the allegations are sufficient as a legal matter to invoke the court’s
20 jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (citation 1 omitted). 2 Article III of the United States Constitution vests in federal courts the power
3 to entertain disputes over “cases” or “controversies.” U.S. CONST. art. III, § 2. 4 To satisfy the case or controversy requirement, and thereby show standing, a 5 plaintiff must demonstrate that throughout the litigation, they suffered, or will be
6 threatened with, an actual injury traceable to the defendant which will likely be 7 redressed by a favorable judicial decision. Spencer v. Kemna, 523 U.S. 1, 7 (1998) 8 (quoting Lewis v. Cont’l Bank Corp., 494 U.S. 472, 477 (1990)); see also Deakins 9 v. Monaghan, 484 U.S. 193, 199 (1988) (“Article III of the Constitution limits
10 federal courts to the adjudication of actual, ongoing cases or controversies between 11 litigants.”). Three elements must be shown in order to establish Article III 12 standing: (1) the plaintiff must have suffered an “injury in fact” which is both
13 concrete and particularized and not “conjectural” or “hypothetical”; (2) there must 14 be a causal connection between the injury and the conduct complained of; and (3) 15 it must be “likely” as opposed to “speculative” that the injury will be “redressed by 16 a favorable decision.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)
17 (internal citations and quotations omitted). The party invoking federal jurisdiction 18 bears the burden of establishing the elements. Id. at 561 (citing FW/PBS, Inc. v. 19 Dallas, 493 U.S. 215, 231 (1990)). However, “[a]t the pleading stage, general
20 factual allegations of injury resulting from the defendant’s conduct may suffice.” 1 Id. 2 “[A] 12(b)(1) motion to dismiss for lack of standing can only succeed if the
3 plaintiff has failed to make ‘general factual allegations of injury resulting from the 4 defendant’s conduct.’” Id.
Free access — add to your briefcase to read the full text and ask questions with AI
1 FILED IN THE U.S. DISTRICT COURT 2 EASTERN DISTRICT OF WASHINGTON Sep 20, 2024 3 SEAN F. MCAVOY, CLERK 4 EASTERN DISTRICT OF WASHINGTON 6
a Washington corporation, NIKOS NO. 4:24-CV-5045-TOR 8 DANAKOS, and NICOLE DANAKOS, ORDER GRANTING DEFENDANT 9 NEWCOURSE COMMUNICATION Plaintiffs, INC.’S MOTION TO DISMISS 10 v. 11 YOURPEOPLE, INC., a Delaware 12 corporation, KEYBANK NATIONAL ASSOCIATION, a 13 national bank, and NEWCOURSE COMMUNICATIONS, INC., 14 Defendants. 15
16 BEFORE THE COURT is Defendant Newcourse Communication Inc.’s 17 Motion to Dismiss (ECF No. 35). This matter was submitted for consideration 18 without oral argument. The Court has reviewed the record and files herein and is 19 fully informed. For the reasons discussed below, Defendant Newcourse 20 Communication Inc.’s Motion to Dismiss (ECF No. 35) is GRANTED. 2 This matter arises out of alleged identity theft resulting in the loss of
3 $432,500 from Plaintiffs’ business bank account. Plaintiff Greek Islands Cuisine 4 (“Greek Islands”) is a restaurant located in Richland, Washington and owned in 5 part by Plaintiff Nikos Danakos. ECF No. 7 at 5, ¶ 4.1. Greek Islands maintains a
6 business bank account at KeyBank National Association (“KeyBank”), specifically 7 at its branch in Kennewick, Washington. Id., ¶ 4.2. Mr. Danakos, together with 8 his wife Nicole Danakos, held a personal checking account at HomeStreet Bank, 9 headquartered in Seattle, Washington. Id. at 18, ¶ 4.22. HomeStreet bank utilizes
10 Defendant Newcourse Communications, Inc. (“Newcourse”) in its business 11 providing mailing services to financial institutions. Id. 12 On June 7, 2022, Plaintiffs learned that Greek Islands’ business bank
13 account held at KeyBank had been compromised, resulting the loss of $432,500. 14 Id. at 13, ¶ 4.15. Thieves had gained access to the KeyBank business account by 15 impersonating Mr. Danakos to establish a payroll system within the checking 16 account through YourPeople, Inc., d/b/a Zenefits. Id. at 6, ¶ 4.4. The imposters
17 submitted to Zenefits a fraudulent driver’s license with an incorrect middle name, 18 another person’s photograph and signature, and an incorrect address. Id. at 8, ¶ 19 4.7. After establishing the direct deposit payroll account with KeyBank, Zenefits
20 processed two transfers amounting the $432,500 on June 3, 2022. Id. at 9, ¶ 4.9. 1 On September 7, 2022, Newcourse sent Mr. and Mrs. Danakos notice that 2 their account with HomeStreet Bank was included in a data breach occurring
3 sometime between April 27 and May 3, 2022. Id. at 17‒18, ¶¶4.22‒4.23. The 4 notice stated that in August 2022, Newcourse had discovered that the breach 5 included sensitive information including; Plaintiffs’ full names, account numbers,
6 and possibly mortgage statement with their home address and last four digits of 7 their social security numbers. Id. The Amended Complaint does not allege that 8 KeyBank utilized Newcourse’s mailing services. Plaintiffs allege that 9 Newcourse’s data breach allowed the criminals to obtain their sensitive
10 information, which they used to gain access to the KeyBank account. Id. at 21, ¶ 11 4.29. This was accomplished, according to Plaintiffs, by the creation of “Fullz” 12 packages, whereby criminals cross reference illegally obtained information with
13 public information to create a full background of an individual to more completely 14 assume a stolen identity. Id. at 26, ¶¶ 4.44‒4.45. 15 Plaintiffs Nikos and Nicole Danakos bring claims of negligence, negligence 16 per se, and a violation of the Washington Consumer Protection Act against
17 Defendant Newcourse. Id. at 33‒36, ¶¶ 6.7‒6.9. Defendant Newcourse argues that 18 Plaintiffs’ claims against it should be dismissed because: (1) they lack standing to 19 support any of their claims, (2) they are unable to establish a breach of duty or
20 injury in negligence, (3) they cite no statutory authority to establish a claim of 1 negligence per se, and (4) they fail to establish any of the factors required under 2 Washington law to establish a Washington Consumer Protection Act claim. ECF
3 No. 35. Plaintiffs, responded, arguing that they do have standing, and that they 4 have established each of their claims. ECF No. 45.
6 I. Article III Standing 7 Defendant argues that dismissal for lack of Article III standing is warranted 8 because Plaintiffs’ fail to allege an injury-in-fact that is fairly traceable to 9 Newcourse. ECF No. 35 at 5. A jurisdictional challenge brought under Federal
10 Rule of Civil Procedure 12(b)(1) may present as either a facial or factual attack. 11 White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the 12 challenger asserts that the allegations contained in a complaint are insufficient on
13 their face to invoke federal jurisdiction. By contrast, in a factual attack, the 14 challenger disputes the truth of the allegations that, by themselves, would 15 otherwise invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 16 1035, 1039 (9th Cir. 2004). The court “resolves a facial attack as it would a
17 motion to dismiss under Rule 12(b)(6): Accepting the plaintiff’s allegations as true 18 and drawing all reasonable inferences in the plaintiff’s favor, the court determines 19 whether the allegations are sufficient as a legal matter to invoke the court’s
20 jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (citation 1 omitted). 2 Article III of the United States Constitution vests in federal courts the power
3 to entertain disputes over “cases” or “controversies.” U.S. CONST. art. III, § 2. 4 To satisfy the case or controversy requirement, and thereby show standing, a 5 plaintiff must demonstrate that throughout the litigation, they suffered, or will be
6 threatened with, an actual injury traceable to the defendant which will likely be 7 redressed by a favorable judicial decision. Spencer v. Kemna, 523 U.S. 1, 7 (1998) 8 (quoting Lewis v. Cont’l Bank Corp., 494 U.S. 472, 477 (1990)); see also Deakins 9 v. Monaghan, 484 U.S. 193, 199 (1988) (“Article III of the Constitution limits
10 federal courts to the adjudication of actual, ongoing cases or controversies between 11 litigants.”). Three elements must be shown in order to establish Article III 12 standing: (1) the plaintiff must have suffered an “injury in fact” which is both
13 concrete and particularized and not “conjectural” or “hypothetical”; (2) there must 14 be a causal connection between the injury and the conduct complained of; and (3) 15 it must be “likely” as opposed to “speculative” that the injury will be “redressed by 16 a favorable decision.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)
17 (internal citations and quotations omitted). The party invoking federal jurisdiction 18 bears the burden of establishing the elements. Id. at 561 (citing FW/PBS, Inc. v. 19 Dallas, 493 U.S. 215, 231 (1990)). However, “[a]t the pleading stage, general
20 factual allegations of injury resulting from the defendant’s conduct may suffice.” 1 Id. 2 “[A] 12(b)(1) motion to dismiss for lack of standing can only succeed if the
3 plaintiff has failed to make ‘general factual allegations of injury resulting from the 4 defendant’s conduct.’” Id. Further, “in determining constitutional standing, ‘it is 5 within the trial court’s power to allow or to require the plaintiff to supply, by
6 amendment to the complaint or by affidavits, further particularized allegations of 7 fact deemed supportive of plaintiff’s standing.’” Maya v. Centex Corp., 658 F.3d 8 1060, 1067 (9th Cir. 2011) (quoting Warth v. Seldin, 422 U.S. 490, 501 (1975)). 9 The burden of proof rests with the party invoking federal jurisdiction, and the party
10 must support the elements of standing “with the manner and degree of evidence 11 required at the successive stages of the litigation.” Lujan, 504 U.S. at 561. 12 Plaintiffs’ claims against Newcourse stemming from the KeyBank
13 infiltration fails because there is no causal connection between the money stolen 14 from the KeyBank account and the data breach from Newcourse. Under factor 15 two, causation must be fairly traceable in connection between the injury a plaintiff 16 complains of and the conduct of the defendant. Steel Co. v. Citizens for a Better
17 Env’t, 523 U.S. 83, 103 (1998) (citing Simon v. E. Ky. Welfare Rts. Org., 426 U.S. 18 26, 41–42 (1976)). A plaintiff may not rely on “a bare legal conclusion to assert 19 injury-in-fact,” or engage in an “ingenious academic exercise in the conceivable”
20 to establish the cause of the injury. Maya, 658 F.3d at 1068 (internal citation and 1 quotations omitted). “A causation chain does not fail simply because it has several 2 ‘links,’ provided those links are not hypothetical or tenuous and remain plausible.”
3 Id. at 1070 (internal quotations and citations omitted). Given the early stage of this 4 case, Plaintiffs’ burden to establish causation is relatively modest. Bennett v. 5 Spear, 520 U.S. 154, 171 (1997).
6 However, there must be some causal connection. Here, Plaintiffs contend 7 that criminals utilized the information gained from the Newcourse data breach to 8 add to an online profile, creating a fuller picture, and then used that information to 9 access the KeyBank account. ECF No. 7 at 26, ¶ 4.45. But the First Amended
10 Complaint alleges that the Zenefits payroll account was opened with a fraudulent 11 driver’s license full of incorrect information, including Mr. Danakos’ middle name 12 and home address, despite the fact that this information was data taken from
13 Newcourse. Id. at 8, ¶ 4.7 and 18, ¶ 4.23. Thus, even if the hackers used Mr. 14 Danakos’ identifying information gained from the Newcourse data breach to add to 15 a “Fullz,” package, none of that information was operationalized to gain access to 16 the bank account. See Lujan, 504 U.S. at 560 (internal citation omitted) (“[T]here
17 must be a causal connection between the injury and the conduct complained of – 18 the injury has to be ‘fairly ... trace[able] to the challenged action of the defendant, 19 and not ... th[e] result [of] the independent action of some third party not before the
20 court.’ ”); see also Greenstein v. Noblr Reciprocal Exch., 585 F. Supp. 3d 1220, 1 1231 (N.D. Cal. 2022) (finding no connection between a data breach and type of 2 data used for an application to an Unauthorized Data Disclosure, particularly
3 where the information was readily available online); Fernandez v. Leidos, Inc., 127 4 F. Supp. 3d 1078, 1086 (E.D. Cal. 2015) (“Plaintiff’s allegations that someone 5 attempted to open a bank account in his name . . . do[es] not allege injuries in fact
6 fairly traceable to the Data Breach, since Plaintiff has not alleged that bank account 7 information or email addresses were on the stolen backup data tapes.”) 8 Plaintiffs do not allege that any information stolen from Newcourse assisted 9 thieves in the discovery of Greek Island’s KeyBank account, nor that the last four
10 digits of their social security numbers or mortgage information gained from the 11 data breach were required by Zenefits to open the account. There is also no 12 allegation that KeyBank uses Newcourse for its own mailing purposes, nor that the
13 two entities are in any way connected. The Court recognizes that Plaintiffs allege 14 that a closeness in time aspect bolsters their claim, but there is still no traceable 15 connection. ECF No. 45 at 14. Unlike in Roper v. Rise Interactive Media & 16 Analytics, LLC, which they rely upon as support for the contention that timeliness
17 between the breach and fraud is a key factor, there is no suggestion in Plaintiffs’ 18 First Amended Complaint that the individuals who opened the Zenefits account 19 used any of the information obtained from Newcourse. No. 23 CV 1836, 2023 WL
20 7410641, at *5 (N.D. Ill. Nov. 9, 2023) (finding that plaintiffs’ were able to show 1 causation through traceability when thieves attempted to use stolen health 2 insurance to fill a prescription and attempted to use stolen financial information to
3 open a bank account); see also Smith v. Loyola Univ. Med. Ctr., No. 23 CV 15828, 4 2024 WL 3338941, at *4 (N.D. Ill. July 9, 2024) (discussing temporal proximity of 5 targeted medical advertisements surrounding online use of personal medical
6 information). As currently presented, these are two separate potential harms 7 without a link: one being the data breach at Newcourse, and the other being the 8 theft of $432,500 from the KeyBank account. Thus, Plaintiff’s theory that their 9 information was traded to create a complete online dossier may be true, but as the
10 First Amended Complaint is currently pled, there is no plausible connection for 11 standing purpose because none of the information allegedly stolen from 12 Newcourse was used in the KeyBank scheme.
13 Newcourse also requests the Court dismiss Plaintiffs’ claims for future harm 14 they may face resulting from the information leaked during the data breach, 15 because these injuries are hypothetical and not concrete. ECF No. 35 at 5‒7. To 16 show standing, a plaintiff must establish an, “‘injury-in-fact’—an invasion of a
17 legally protected interest which is (a) concrete and particularized, and (b) actual or 18 imminent, not conjectural or hypothetical.” Lujan, 504 U.S. at 560 (internal 19 quotations and citations removed). Part of establishing an injury in fact is
20 demonstrating that the claim is specific to the individual bringing it and not based 1 upon an injury “shared with all members of the public.” United States v. 2 Richardson, 418 U.S. 166, 178 (1974) (internal citation and quotation marks
3 omitted) (“[I]t is not sufficient the [plaintiff] has merely a general interest common 4 to all members of the public.”). Additionally, a party must make some showing 5 that their claim is concrete and not hypothetical or conjectural, meaning the injury
6 is “real and not abstract.” Spokeo, Inc. v. Robins, 578 U.S. 330, 340 (2016). 7 The Court declines to address Plaintiffs’ more general claims surrounding 8 the theft of their Personally Identifiable Information (“PII”) against Newcourse, 9 and the current or future financial harms they allege separate from those involving
10 KeyBank. ECF No. 7 at 22, ¶ 4.33 and 23‒24, ¶ 4.36. However, this potential 11 cause of action does not warrant dismissal with prejudice, as the Ninth Circuit has, 12 under certain circumstances, upheld claims where individuals face an immediate
13 harm stemming from compromised personal information. See In re Zappos.com, 14 Inc., 888 F.3d 1020, 1027‒28 (9th Cir. 2018) (finding the type of information 15 stolen, including full credit card numbers, was sufficient to create a credible future 16 threat of identity theft); Krottner v. Starbucks Corp., 628 F.3d 1139, 1143 (9th Cir.
17 2010) (“Here, Plaintiffs–Appellants have alleged a credible threat of real and 18 immediate harm stemming from the theft of a laptop containing their unencrypted 19 personal data. Were Plaintiffs–Appellants’ allegations more conjectural or
20 hypothetical—for example, if no laptop had been stolen, and Plaintiffs had sued 1 based on the risk that it would be stolen at some point in the future—we would 2 find the threat far less credible.”). But see Clapper v. Amnesty Int’l USA, 568 U.S.
3 398, 410 (2013) (“[R]espondents’ theory of standing, which relies on a highly 4 attenuated chain of possibilities, does not satisfy the requirement that threatened 5 injury must be certainly impending.”); Spokeo, 578 U.S. at 342 (discussing how a
6 statutory violation may not result in actual injury). 7 As it currently stands, any case of identity theft Plaintiffs may have against 8 Newcourse is divorced from the relevant facts of the matter at hand, and therefore 9 properly resolved in a separate proceeding. Plaintiffs may either amend their
10 Second Amended Complaint to address the issue of standing and the substance of 11 their claims in this case, or they may pursue a separate lawsuit against Newcourse 12 for harm they allege resulted or will result from identity theft outside of the
13 allegation that the data breach is connected to the loss of $432,500 from KeyBank. 14 See Maya v. Centex Corp., 658 F.3d 1060, 1069 (9th Cir. 2011) (“[P]laintiffs 15 should be permitted to amend their complaint because plaintiffs may be able to 16 establish by amendment that they have standing to pursue their claims.”)
17 // 18 // 19 //
20 // ACCORDINGLY, IT IS HEREBY ORDERED: 2 1. Defendant Newcourse Communication Inc.’s Motion to Dismiss (ECF 3 No. 35) is GRANTED. 4 2. Plaintiffs’ claims of negligence, negligence per se, and a violation of the 5 Washington Consumer Protection Act are DISMISSED without 6 prejudice. 7 3. Plaintiffs may amend their claims against Newcourse in this matter 8 within 14 days of this Order. 9 The District Court Executive is directed to enter this Order, terminate 10|| Newcourse Communication Inc., and furnish copies to counsel. 11 DATED September 20, 2024. | @ hace MS Mg 11 ee UL 13 Sane THOMAS O. RICE <> United States District Judge 14 15 16 17 18 19 20
ORDER GRANTING DEFENDANT NEWCOURSE COMMUNICATION