Hold Security, LLC v. Microsoft Corporation

• Court: Court of Appeals for the Ninth Circuit
• Decided: July 15, 2025
• Docket: 24-2768
• Status: Unpublished

Opinion

NOT FOR PUBLICATION FILED UNITED STATES COURT OF APPEALS JUL 15 2025 MOLLY C. DWYER, CLERK U.S. COURT OF APPEALS FOR THE NINTH CIRCUIT

HOLD SECURITY, LLC, Wisconsin No. 24-2768 Limited Liability Company, D.C. No. 2:23-cv-00899-MJP Plaintiff - Appellant,

v. MEMORANDUM*

MICROSOFT CORPORATION, a Washington corporation,

Defendant - Appellee.

Appeal from the United States District Court for the Western District of Washington Marsha J. Pechman, District Judge, Presiding

Argued and Submitted July 9, 2025 Seattle, Washington

Before: HAWKINS, GRABER, and BENNETT, Circuit Judges.

Plaintiff Hold Security, LLC, timely appeals the district court’s Rule

12(b)(6) dismissal of its complaint against Defendant Microsoft Corporation,

which asserted claims under Washington law for (1) breach of contract; (2) breach

of the implied covenant of good faith and fair dealing; and (3) deceptive or unfair

* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. acts or practices in violation of Washington’s Consumer Protection Act (“CPA”),

Wash. Rev. Code § 19.86.020. Plaintiff also challenges the denial of leave to

amend with respect to the CPA claim. Reviewing de novo the dismissal of

Plaintiff’s claims and for abuse of discretion the denial of leave to amend,

D’Augusta v. Am. Petroleum Inst., 117 F.4th 1094, 1100 (9th Cir. 2024), cert.

denied, 145 S. Ct. 1478 (2025), we affirm.

1. Plaintiff’s factual allegations, accepted as true, do not establish that

Defendant had a contractual duty to limit its use of the “Account Credential Data”

(“data”) that Plaintiff provided. We agree with the district court’s conclusion that

Defendant owns the data because the data qualify as a “deliverable” under the

contract. But even assuming that the data constitute “Supplier IP,” the contract—

which, as Plaintiff concedes, is fully integrated—explicitly grants Defendant a

“worldwide, nonexclusive, perpetual, [and] irrevocable” license to use the data in

the ways about which Plaintiff complains.1 Nothing in section 3(b) of the

statement of work modifies that license by prohibiting Defendant from using the

data in any particular way.2 Nor can Plaintiff rely on alleged pre-contract

1 The parties’ agreement consists of three documents that are relevant here: a master supplier services agreement, a statement of work, and a non-disclosure agreement. Unless a specific document is named, the term “contract” refers to all three documents collectively. 2 To the contrary, the contract characterizes section 3(b) as “describ[ing] the details of the Services . . . [Plaintiff] will perform or deliver to [Defendant],”

2 24-2768 representations to contradict the licensing provision. See Brogan & Anensen LLC

v. Lamphiear, 202 P.3d 960, 961 (Wash. 2009) (en banc) (per curiam) (explaining

that extrinsic evidence may not be used to “add to, subtract from, modify, or

contradict the terms of a fully integrated written contract”).

Plaintiff thus fails to state a breach-of-contract claim. See Fitness Int’l, LLC

v. Nat’l Retail Props., LP, 524 P.3d 1057, 1063 (Wash. Ct. App. 2023) (“A breach

of contract is actionable only if the contract imposes a duty.” (quoting Nw. Indep.

Forest Mfrs. v. Dep’t of Lab. & Indus., 899 P.2d 6, 9 (Wash. Ct. App. 1995))).

2. Plaintiff’s implied-covenant claim is also premised on the theory that

Microsoft violated data-use limitations allegedly contained in the contract. Given

Plaintiff’s failure to plead the existence of those limitations, as discussed above,

the district court properly dismissed this claim. See, e.g., Johnson v. Yousoofian,

930 P.2d 921, 925 (Wash. Ct. App. 1996) (“The implied duty of good faith is

derivative, in that it applies to the performance of specific contract obligations. If

there is no contractual duty, there is nothing that must be performed in good faith.”

(internal citations omitted)), as amended (Jan. 9, 1997).

3. To establish its CPA claim, Plaintiff must plead facts sufficient to prove,

among other elements, that the allegedly deceptive or unfair conduct affects the

(emphasis added), a description that in no way alludes to any duties owed by Defendant.

3 24-2768 public interest. See Gordon v. Virtumundo, Inc., 575 F.3d 1040, 1065 (9th Cir.

2009) (stating the legal standard). Where, as here, a complaint involves a private

dispute, the public-interest inquiry turns on four non-dispositive factors, see

Michael v. Mosquera-Lacy, 200 P.3d 695, 700 (Wash. 2009) (en banc) (listing

those factors), with the ultimate question being whether there is a “real and

substantial” likelihood that “additional plaintiffs have been or will be injured in

exactly the same fashion,” id. (emphasis added) (first quoting Eastlake Constr. Co.

v. Hess, 686 P.2d 465, 477 (Wash. 1984) (en banc), and then quoting Hangman

Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 719 P.2d 531, 538 (Wash.

1986) (en banc)).

Plaintiff has failed to allege facts sufficient to prove that such a likelihood

exists. Although one could plausibly infer from the complaint that Defendant both

engaged in the allegedly deceptive or unfair practice in the course of its business

and actively solicited Plaintiff, any additional advertising that Defendant might

have carried out was presumably aimed at other technology companies, not at the

broader public. See Falcon Props. LLC v. Bowfits 1308 LLC, 478 P.3d 134, 142

(Wash. Ct. App. 2020) (concluding that the deception did not affect the public in

part because the defendants marketed to “investors and not the general public”).

And though one could also plausibly conclude that Plaintiff held less bargaining

power than did Defendant, Plaintiff—given its level of sophistication and its

4 24-2768 business experience—is not “representative of bargainers subject to exploitation

and unable to protect themselves.” Hangman Ridge, 719 P.2d at 540; see

Goodyear Tire & Rubber Co. v. Whiteman Tire, Inc., 935 P.2d 628, 635 (Wash.

Ct. App. 1997) (concluding conduct did not affect the public because the

experience of other potential plaintiffs “indicated they were better able than the

average consumer to judge for themselves the risks associated” with the

defendant’s business proposals). At bottom, this case—involving a “long-standing

[business] relationship” and alleged wrongful acts that took place in a private

setting—more closely resembles “a breach of contract claim between private

parties,” rather than a matter of public concern. Cashmere Valley Bank v. Brender,

116 P.3d 421, 428 (Wash. Ct. App. 2005), aff’d, 146 P.3d 928 (Wash. 2006) (en

banc).

Because additional allegations would not change the inherently private

nature of this dispute, the district court did not abuse its discretion in denying

Plaintiff leave to amend. See Lathus v. City of Huntington Beach, 56 F.4th 1238,

1243 (9th Cir. 2023) (explaining that denying leave to amend is not an abuse of

discretion if granting leave would have been futile).

AFFIRMED.

5 24-2768