Jimenez Jr. v. OE Federal Credit Union

Opinion

DANIEL JIMENEZ JR., et al., Case No. 24-cv-02746-JST

Plaintiffs, ORDER GRANTING IN PART AND v. DENYING IN PART MOTION TO DISMISS Re: ECF No. 29 Defendant.

Before the Court is Defendant OE Federal Credit Union’s (“OEFCU”) motion to dismiss. ECF No. 29. The Court will grant the motion in part and deny it in part. I. BACKGROUND1 This case involves an alleged ransomware attack on and data breach of OEFCU’s network that resulted in unauthorized access to the personally identifiable information (“PII”) and protected health information (“PHI”) of Plaintiffs Daniel Jimenez Jr., Mark Hendren, Erica Jaramillo, and the class members they seek to represent. ECF No. 16 ¶¶ 1–2. OEFCU is “the country’s largest labor based credit union.” See id. ¶ 24 (internal quotation marks omitted). It maintains the PII/PHI of current and former customers, including: full names; Social Security numbers; dates of birth; bank and/or financial account information; Taxpayer Identification Numbers; driver’s license numbers; usernames and passwords; passport numbers; medical procedure information; clinical or treatment information; medical provider names; and health insurance information. Id. ¶ 25. Plaintiffs “directly or indirectly entrusted” OEFCU with

1 For the purposes of deciding this motion, the Court accepts as true the following factual their PII/PHI. Id. ¶ 26. Between approximately August 19, 2023 and October 29, 2023, OEFCU suffered a targeted data breach impacting at least the above categories of PII/PHI. See id. ¶¶ 33, 44. OEFCU sent impacted individuals of the data breach a notice letter on April 30, 2024, informing them of the breach. Id. ¶ 33. Third-party reports have confirmed that the perpetrators of the cyber-attack were from the cybercriminal group “No Escape.” Id. ¶ 47. Following the breach, OEFCU offered impacted individuals with access to a complimentary 12-month membership with a fraud and identity-monitoring service. Id. ¶¶ 11, 96. Plaintiffs allege that OEFCU failed to comply with the minimum standards of the following frameworks: “the NIST Cybersecurity Framework Version 1.1 (including without limitation PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.AT-1, PR.DS-1, PR.DS-5, PR.PT-1, PR.PT-3, DE.CM-1, DE.CM-4, DE.CM-7, DE.CM-8, and RS.CO-2), and the Center for Internet Security’s Critical Security Controls (CIS CSC), which are all established standards in reasonable cybersecurity readiness,” and that this failure allowed the data breach to occur. Id. ¶ 70. Plaintiffs further allege that OEFCU failed to engage in other security measures, including failing to: “maintain an adequate data security system to reduce the risk of data breaches and cyber-attacks; . . . properly monitor their own data security systems for existing intrusions; . . . ensure that their vendors with access to their computer systems and data employed reasonable security procedures; [and] . . . protect against reasonably anticipated threats or hazards to the security or integrity of electronic PII/PHI.” Id. ¶ 72. Because of the data breach, Plaintiffs “anticipate[] spending considerable time and money on an ongoing basis to try to mitigate and address harms caused by the Data Breach. This includes changing passwords, cancelling credit and debit cards, and monitoring their accounts for fraudulent activity.” Id. ¶ 100. Plaintiffs allege that they have been “placed at a present, imminent, immediate, and continuing increased risk of harm from fraud and identity theft” and that they “may also incur out-of-pocket costs for protective measures such as credit monitoring fees, credit report fees, credit freeze fees, and similar costs directly or indirectly related to the Data will continue to suffer from anxiety and emotional distress. Id. ¶ 113. Hendren and Jaramillo additionally allege that they have received an increased number of spam and scamming calls, texts, and/or emails as a result of the data breach. Id. ¶¶ 130, 145. Plaintiffs assert the following causes of action on behalf of themselves and a class of “[a]ll persons identified by Defendant (or its agents or affiliates) as being among those individuals impacted by the Data Breach, including all who were sent a notice of the Data Breach,” id. ¶ 154: negligence; breach of implied contract; invasion of privacy; unjust enrichment; violation of the California Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code § 17200, et seq.; violation of the California Consumer Privacy Act (“CCPA”), Cal. Civ. Code § 1798.150; violation of the California Customer Records Act (“CCRA”), Cal. Civ. Code § 1798.90, et seq.; and declaratory relief under the Declaratory Judgment Act, 28 U.S.C. §§ 2201, et seq. See id. at 51–75.2 This Court has jurisdiction under 28 U.S.C. § 1332(d)(2). “Dismissal under Rule 12(b)(6) is appropriate only where the complaint lacks a cognizable legal theory or sufficient facts to support a cognizable legal theory.” Mendiondo v. Centinela Hosp. Med. Ctr., 521 F.3d 1097, 1104 (9th Cir. 2008). To survive a motion to dismiss, “a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. In determining whether a plaintiff has met the plausibility requirement, a court must “construe the pleadings in the light most favorable to the nonmoving party.” Knievel, 393 F.3d at 1072. A. Negligence “In order to establish negligence under California law, a plaintiff must establish four required elements: (1) duty; (2); breach; (3) causation; and (4) damages.” Ileto v. Glock Inc., 349 F.3d 1191, 1203 (9th Cir. 2003). The parties here dispute the elements of duty, breach, and damages. 1. Duty “The general rule in California is that everyone is responsible for an injury occasioned to another by his or her want of ordinary care or skill in the management of his or her property or person. In other words, each person has a duty to use ordinary care and is liable for injuries caused by his failure to exercise reasonable care in the circumstances.” Cabral v. Ralphs Grocery Co., 51 Cal. 4th 764, 771 (2011) (simplified); see also Cal. Civ. Code § 1714 (“Everyone is responsible, not only for the result of his or her willful acts, but also for an injury occasioned to another by his or her want of ordinary care or skill in the management of his or her property or person.”). Plaintiffs contend that OEFCU stored their PII/PHI without implementing reasonable safeguards against foreseeable risks of unauthorized access and that this led to the data breach that injured them. District courts have routinely found comparable allegations sufficient to establish a duty at the motion to dismiss stage for negligence claims. See, e.g., In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 799 (N.D. Cal. 2019) (finding a duty because “Facebook had a responsibility to handle its users’ sensitive information with care”); Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1039 (N.D. Cal. 2019) (finding a duty where Facebook allegedly failed to comply with industry data-security standards); In re San Francisco 49ers Data Breach Litig., No. 3:22-CV-05138-JD, 2024 WL 3849336, at *2 (N.D. Cal. Aug. 15, 2024) (finding that a negligence claim was sufficiently pleaded where data breach victims alleged that the 49ers obtained and stored their PII without using reasonable safeguards against hacking). Accordingly, the Court finds that OEFCU had a duty to store Plaintiffs’ PII/PHI with care. 2. Breach OEFCU argues that Plaintiffs have not sufficiently pleaded a breach of any applicable duty because they have only alleged “labels and conclusions” rather than facts “describing the steps that [OEFCU] could have or should have taken to prevent” the data breach. See ECF No. 46 at 3. The Court disagrees. Plaintiffs specifically allege that OEFCU failed to meet the minimum standards of the following frameworks: “the NIST Cybersecurity Framework Version 1.1 (including without limitation PR.AC-1, PR.AC-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.AC-7, PR.AT-1, PR.DS-1, PR.DS-5, PR.PT-1, PR.PT-3, DE.CM-1, DE.CM-4, DE.CM-7, DE.CM-8, and RS.CO-2), and the Center for Internet Security’s Critical Security Controls (CIS CSC), which are all established standards in reasonable cybersecurity readiness,” and that this failure allowed for the data breach to occur. ECF No. 16 ¶ 70. Plaintiffs have also pointed out other security measures that OEFCU failed to implement. See id. ¶ 72 (alleging that OEFCU failed, among other things, to “properly monitor their own data security systems for existing intrusions; . . . [and] ensure that their vendors with access to their computer systems and data employed reasonable security procedures”). Plaintiffs have thus pleaded specific facts describing how OEFCU breached its duty of care to take appropriate measures to safeguard their PII/PHI. See Schmitt v. SN Servicing Corp., No. 21-CV- 03355-WHO, 2021 WL 3493754, at *5 (N.D. Cal. Aug. 9, 2021) (noting that the “burden to plead a corresponding breach based on SNSC's inadequate security measures is not high”); see also In re San Francisco 49ers Data Breach Litig., 2024 WL 3849336, at *2. 3. Damages The Ninth Circuit has not addressed the question of what kind of damages must be alleged to support a negligence claim in the data breach context. But district courts within the circuit have generally found “[i]ncreased time spent monitoring one’s credit and other tasks associated with responding to a data breach . . . to be specific, concrete, and non-speculative.” In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., 613 F. Supp. 3d 1284, 1296 (S.D. Cal. 2020); see, e.g., Schmitt v. SN Servicing Corp., No. 21-CV-03355-WHO, 2021 WL 3493754, at *6 cognizable forms of harm”); In re Accellion, Inc. Data Breach Litig., 713 F. Supp. 3d 623, 637 (N.D. Cal. 2024), reconsideration denied, No. 21-CV-01155-EJD, 2024 WL 4592367 (N.D. Cal. Oct. 28, 2024) (“Additionally, a ‘growing number of federal courts have now recognized Loss of Value of PII as a viable damages theory. And a growing number of courts now recognize that individuals may be able to recover Consequential Out of Pocket Expenses that are incurred because of a data breach, including for time spent reviewing one’s credit accounts.’”) (quoting In re Experian Data Breach Litig., 2016 WL 7973595, at *5 (C.D. Cal. Dec. 29, 2016)); but see Corona, 2015 WL 3916744, at *4 (finding, without discussion, that “general allegations of lost time are too speculative to constitute cognizable injury” in case involving an alleged hack, theft, and misuse of employee financial and medical information). Here, Plaintiffs allege that as a result of the data breach, they have spent time monitoring their accounts and contacting credit bureaus to place freezes on their accounts because they have been placed as imminent risk of identity theft. See ECF No. 16 ¶¶ 100, 102, 106, 128. They also allege that because of the data breach, they have suffered from anxiety, sleep disruption, and emotional distress. Id. ¶¶ 113, 147. Hendren and Jaramillo additionally allege that they have received an increased number of spam calls, texts, and/or emails, as well as a spike in scam emails and phone calls purporting to involve credit, loans, and taxes, because of the data breach. Id. ¶¶ 130, 145. Taken together, the Court finds that Plaintiffs have alleged plausible damages to support their negligence claim. See Landon v. TSC Acquisition Corp., No. 2:23-CV-01377-SVW- PD, 2024 WL 5317240, at *8 (C.D. Cal. Nov. 1, 2024) (finding that the victims of a data breach sufficiently alleged emotional damages to survive the motion to dismiss); Schmitt v. SN Servicing Corp., No. 21-CV-03355-WHO, 2021 WL 3493754, at *5–6 (N.D. Cal. Aug. 9, 2021) (finding that time spend on credit monitoring is a cognizable form of harm to support a negligence claim); Stasi v. Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 918 (S.D. Cal. 2020) (finding that plaintiffs alleged plausible damages in the form of lost time, where plaintiffs experienced increased spam and phishing contacts, even if their e-mail addresses or phone numbers were not directly included in the information that was compromised). B. Breach of Implied Contract “An implied contract is one, the existence and terms of which are manifested by conduct.” Cal. Civ. Code § 1621. To plead breach of an implied contract, a plaintiff must allege: “(1) the contract, (2) plaintiff's performance or excuse for nonperformance, (3) defendant's breach, and (4) the resulting damages to plaintiff.” Reichert v. Gen. Ins. Co. of Am., 68 Cal. 2d 822, 830 (1968) (citations omitted). OEFCU primarily argues that Plaintiffs’ breach of implied contract claim fails because Plaintiffs have not sufficiently alleged the existence of a contract—contending specifically that Plaintiffs have not cited “the consideration OEFCU exchanged that is required to create an enforceable contract.” ECF No. 46 at 6–7. The Court disagrees. Here, Jimenez and Hendren have pleaded that they were required to provide their PII/PHI to OEFCU as a condition of becoming its customers. See ECF No. 16 ¶ 114 (“Plaintiff Jimenez provided his information to Defendant as a condition of becoming a customer of Defendant”); id. ¶ 124 (“As a condition of obtaining services at OEFCU, [Hendren] was required to provide his PII/PHI to Defendant.”). That alleged requirement is sufficient to constitute consideration for an implied contract whereby OEFCU implicitly agreed to reasonably safeguard their PII/PHI. See In re 49ers, 2024 WL 3849336, at *3 (“The amended complaint states that plaintiffs were required to disclose their PII to the 49ers, to the 49ers’ benefit, with the understanding that the 49ers would reasonably protect their information. That is enough for the implied contract claim to go forward.”); Castillo v. Seagate Tech., LLC, No. 16-CV-01958-RS, 2016 WL 9280242, at *9 (N.D. Cal. Sept. 14, 2016) (finding that the plaintiffs adequately alleged a claim of implied breach of contract because they alleged that they were required to submit their PII to Seagate as a condition of employment and Seagate failed to take adequate measures and reasonable efforts to safeguard their information). Because Jaramillo does not allege that she was a customer of OEFCU, however, see ECF No. 40 at 21 n.4, her claim for breach of implied contract is dismissed with leave to amend. C. Invasion of Privacy specific, protected privacy interest; (2) a reasonable expectation of privacy; and (3) a “sufficiently serious” invasion of the privacy interest such that it “constitute[s] an egregious breach of the social norms underlying the privacy right.” Hill v. Nat’l Collegiate Athletic Ass’n, 7 Cal. 4th 1, 35–37 (1994). OEFCU argues that its alleged cybersecurity practices leading to the data breach do not constitute the type of egregious breach of social norms that satisfies the third element of this claim. See ECF No. 29 at 14. It states that Plaintiffs do not “contend that OEFCU intended for their PII to be stolen by cybercriminals,” id., and that “[l]osing personal data through insufficient security doesn’t rise to the level of an egregious breach of social norms underlying the protection of sensitive data like social security numbers.” Id. (quoting Schmitt, 2021 WL 3493754, *7). “Under California law, courts must be reluctant to reach a conclusion at the pleading stage about how offensive or serious the privacy intrusion is.” In re Facebook, Inc., Consumer Priv. User Profile Litig., 402 F. Supp. 3d 767, 797 (N.D. Cal. 2019). “Actionable invasions of privacy must be sufficiently serious in their nature, scope, and actual or potential impact to constitute an egregious breach of the social norms underlying the privacy right.” Hill v. Nat’l Collegiate Athletic Assn., 7 Cal. 4th 1, 37 (1994). When determining whether an invasion is “highly offensive,” courts consider “the degree and setting of the intrusion,” as well as “the intruder’s motives and objectives.” Hernandez v. Hillsides, Inc., 47 Cal. 4th 272, 287 (Cal. 2009). Given the factually intensive nature of the inquiry, “[c]ourts are generally hesitant to decide claims of this nature at the pleading stage.” In re Meta Pixel Healthcare Litig., 647 F. Supp. 3d at 799. Only if the allegations “show no reasonable expectation of privacy or an insubstantial impact on privacy interests” can the “question of [a serious or highly offensive] invasion [ ] be adjudicated as a matter of law.” Hill, 7 Cal. 4th at 40. Plaintiffs argue that the data breach constitutes “an ‘egregious breach of social norms’ because the Data Breach exposed protected health information—including, inter alia, prescription information, treatment information, clinical information, and medical procedure information.” ECF No. 40 at 14 (citing ECF No. 16 ¶¶ 25, 44). They also argue that “the offensiveness of the of PII/PHI which was then viewed by at least 108 individuals on the Dark Web.” Id. (quoting ECF No. 16 ¶¶ 47–52). As this Court has previously stated, it agrees with those courts that “have refused to dismiss invasion of privacy claims at the motion to dismiss stage where, as here, a data breach involved medical information, because the disclosure of such information is more likely to constitute an “egregious breach of the social norms” that is “highly offensive.” St. Aubin v. Carbon Health Techs., Inc., No. 24-CV-00667-JST, 2024 WL 4369675, at *13 (N.D. Cal. Oct. 1, 2024) (quoting In re Ambry Genetics Data Breach Litig., 567 F. Supp. 3d 1130, 1143 (C.D. Cal. 2021)); see also Doe v. Beard, 63 F. Supp. 3d 1159, 1170 (C.D. Cal. 2014) (denying motion to dismiss where plaintiff’s HIV-positive status was disclosed). Accordingly, at least at this stage of the proceedings, the Court cannot conclude as a matter of law that the disclosure of the PII and PHI involved here, is not highly offensive. See Lau v. Gen Digital Inc., No. 22-CV-08981-JST, 2023 WL 10553772, at *6 (N.D. Cal. Sept. 13, 2023). D. Unjust Enrichment The Ninth Circuit “has construed the common law to allow an unjust enrichment cause of action through quasi-contract.” ESG Capital Partners, LP v. Stratos, 828 F.3d 1023, 1038 (9th Cir. 2016) (citing Astiana v. Hain Celestial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015)). Under California law, “a quasi-contract action for unjust enrichment does not lie where [] express binding agreements exist and define the parties’ rights.” E.g., California Med. Ass’n, Inc. v. Aetna U.S. Healthcare of California, Inc., 94 Cal. App. 4th 151, 172 (2001). OEFCU argues that Plaintiffs’ unjust enrichment claim is barred because they have alleged a claim for breach of implied contract and have not “pleaded facts that the contract may be unenforceable or invalid.” See ECF No. 29 at 15. OEFCU primarily cites In re Sequoia Benefits & Insurance Data Breach Litigation, No. 22-CV-08217-RFL, 2024 WL 1091195, at *9 (N.D. Cal. Feb. 22, 2024), as support. In re Sequoia is distinguishable. The court in that case dismissed the unjust enrichment claim because the plaintiffs alleged the existence of an express contract and brought a claim for breach of contract, not breach of implied contract. See In re Sequoia Benefits distinguishable on the same basis. See In the Black Res., LLC v. Blitz Design, Inc., No. 3:22-CV- 04227-WHO, 2022 WL 17082372, at *4 (N.D. Cal. Nov. 17, 2022) (claim for breach of express contract); In re Med. Cap. Sec. Litig., No. ML102145DOCRNBX, 2010 WL 11508332, at *4 (C.D. Cal. Aug. 31, 2010) (same). Here, Plaintiffs bring only a claim for breach of implied contract. OEFCU cites no case, and the Court has found none, barring a plaintiff from bringing claims for both unjust enrichment and breach of implied contract. Indeed, “[t]he doctrine of implied contracts has its foundation in the doctrine of unjust enrichment.” Gonzales v. State of California, 68 Cal. App. 3d 621, 627–28 (quoting McCaffrey v. Cronin, 140 Cal. App. 2d 528, 535 (1956)), abrogated on other grounds by City of Stockton v. Superior Ct., 42 Cal. 4th 730 (2007). The Court therefore declines to dismiss Plaintiffs’ unjust enrichment claim. E. California Unfair Competition Law To bring a UCL claim, a person must have “suffered injury in fact and . . . lost money or property as a result of the unfair competition.” Cal. Bus. & Prof. Code § 17204. Thus, a UCL plaintiff must “(1) establish a loss or deprivation of money or property sufficient to qualify as injury in fact, i.e., economic injury, and (2) show that that economic injury was the result of, i.e., caused by, the unfair business practice or false advertising that is the gravamen of the claim.” Kwikset Corp. v. Superior Court, 51 Cal. 4th 310, 322 (2011) (emphasis in original). Plaintiffs argue that they satisfy the UCL’s injury requirement because they allege that they “spent time and resources mitigating the fallout from the Data Breach,” were “deprived the benefit of their bargain with Defendant and suffered damage to the value of their PII/PHI.” ECF No. 40 at 16–17. Plaintiffs’ arguments are unavailing. First, courts generally view lost time alone as a non-economic injury that is insufficient to confer statutory standing under the UCL. See In re Sequoia Benefits & Ins. Data Breach Litig., No. 22-CV-08217-RFL, 2024 WL 1091195, at *7 (N.D. Cal. Feb. 22, 2024). Second, Plaintiffs fall short of alleging they actually incurred a monetary loss. See ECF No. 16 ¶¶ 14, (“Plaintiffs and Class Members may also incur out of pocket costs for . . . protective measures to deter and specifically alleges having signed up for a credit monitoring service, but he alleges that he signed up for “credit monitoring and identity theft protection services offered by Defendant”—which Plaintiffs acknowledge were complimentary. See id. ¶¶ 11, 128. And while Plaintiffs allege that they were deprived the benefit of their bargain, they do not allege any actual losses related to that deprivation. Nowhere do Plaintiffs allege that they paid any actual sums to OEFCU to receive any services. See generally ECF No. 16. Finally, Plaintiffs’ general allegation that they “suffered damage to the value of their PII/PHI” does not suffice to establish UCL standing. As this Court has recently explained:

Numerous courts have held that disclosure of personal information alone does not constitute economic or property loss sufficient to establish UCL standing, unless the plaintiff provides specific allegations regarding the value of the information. See, e.g., In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-02752- LHK, 2017 WL 3727318, at *22 (N.D. Cal. Aug. 30, 2017) (rejecting UCL standing to victims of data breach who had failed to allege specific benefit-of-the-bargain losses or out-of-pocket expenses); In re Facebook Privacy Litig., 791 F. Supp. 2d 705, 714 (N.D. Cal. 2011), aff’d 572 F. App’x 494 (9th Cir. 2014) (“A plaintiff’s personal information does not constitute property under the UCL.”). Swarts v. The Home Depot, Inc., No. 23-cv-0995-JST, 2023 WL 5615453 (N.D. Cal. Aug. 30, 2023); see also Katz-Lacabe v. Oracle Am., Inc., 668 F. Supp. 3d 928, 943 (N.D. Cal. 2023) (concluding that “[t]he weight of the authority in the district and the state” indicates “that the mere misappropriation of personal information does not establish compensable damages” sufficient to confer standing under the UCL (quotation marks and citations omitted)). Because Plaintiffs do not sufficiently allege having incurred a monetary loss, their UCL claims are dismissed for lack of statutory standing. See In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-02752-LHK, 2017 WL 3727318, at *22 (N.D. Cal. Aug. 30, 2017) (finding that the plaintiffs who alleged having paid for credit monitoring services and late fees related to identity theft had UCL standing but that the plaintiffs who only alleged facing an “imminent risk of future costs” did not have UCL standing). The CCPA provides: Any consumer whose nonencrypted and nonredacted personal information . . . is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information may institute a civil action . . . . Cal. Civ. Code § 1798.150(a)(1). The parties dispute whether OEFCU is a “business” as defined under the statute. As relevant here, to qualify as a “business” under the CCPA, an entity must both collect consumer PII and “determine[] the purposes and means of the processing” of that PII. See id. § 1798.140(d)(1); see also Karter v. Epiq Sys., Inc., 2021 WL 4353274, at *2 (C.D. Cal. July 16, 2021). Furthermore, the CCPA in a separate section provides that actions against “service providers” that violate the CCPA shall be instituted by the California Attorney General—not individual consumers. See Cal. Civ. Code § 1798.155(b). And a “service provider” is defined as an entity “that processes information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose pursuant to a written contract.” Cal. Civ. Code § 1798.140(v). Accordingly, Plaintiffs can only state a claim against OEFCU if it is a “business” and not a “service provider.” OEFCU provides no explanation as to how it fits the definition of a “service provider” other than pointing to Plaintiffs’ passing description of OEFCU as a “financial services provider” in a different context in the first amended complaint. See ECF No. 29 at 19–20. It otherwise primarily relies on In re Accellion, Inc. Data Breach Litig., 713 F. Supp. 3d 623 (N.D. Cal. 2024), to argue that Plaintiffs fail to allege that OEFCU meets the definition of a business under the statute. In that case, the plaintiffs alleged that “Accellion was hired by various companies to ‘securely transfer’ and to ‘facilitate secure, encrypted file sharing that exceeded limits imposed on the size of email attachments.’” Id. at 641. The court thus found that it was actually Accellion’s customers—not Accellion itself—who made the decisions as to why and how any personal information was transferred. Id. Here, however, Plaintiffs specifically allege that OEFCU collected Plaintiffs’ PII and PHI as a condition of providing its services. ECF No. 16 ¶¶ 28, 114, 124, 136, 244. OEFCU thus information needed to provide financial services to its “current and former customers.” See id. ¶ 25. And Plaintiffs further alleged that OEFCU determined the “means” of processing their PII/PHI by choosing to store that information and the method of storing that information. See id. ¶ 3 (alleging that OEFCU “stored that PII/PHI, unencrypted, in an Internet-accessible environment on Defendant’s network”). Plaintiffs thus plausibly allege that OEFCU is a business under the CCPA. See Karter v. Epiq Sys., Inc., No. SACV 20-01385-CJC (KESX), 2021 WL 4353274, at *2 (C.D. Cal. July 16, 2021) (finding that when an entity collects consumers’ personal information from consumers “in order to perform its services,” that “is an activity for a business” under the Accordingly, the Court declines to dismiss Plaintiffs’ CCPA claim. The CCRA “regulates businesses with regard to treatment and notification procedures relating to their customers' personal information.” In re Yahoo! Inc. Customer Data Sec. Breach Litig., 2017 WL 3727318, at *33 (quoting Corona v. Sony Pictures Ent., 2015 WL 3916744, at *6 (C.D. Cal. June 15, 2015)). Section 1798.82(a) of the CCRA provides, in relevant part:

A person or business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or notification of the breach in the security of the data to a resident of California (1) whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person . . . . The disclosure shall be made in the most expedient time possible and without unreasonable delay . . . . Cal. Civ. Code § 1798.82(a). Plaintiffs argue that OEFCU’s delay in waiting at least six months to notify impacted victims of the data breach about the breach constituted unreasonable delay under the CCRA. OEFCU primarily responds that Plaintiffs have not alleged that they have suffered any incremental harm caused by the delay in notice. See ECF No. 46 at 12–14. Reading the first amended complaint in the light most favorable to Plaintiffs, the Court finds that Plaintiffs have sufficiently alleged that had they been given timelier notice, they would have been able to “tak[e] appropriate measures from protecting themselves against harm,” see ECF No. 16 ¶¶ 253–54, including signing up for credit monitoring and fraud prevention services at an earlier time and reducing the likelihood that they would receive the spam and phishing calls, texts, and emails that they have since received. See In re Yahoo! Inc. Customer Data Sec. Breach Litig., 2017 WL 3727318, at *41 (finding that the plaintiffs adequately alleged incremental harm by alleging that, if they had been notified earlier, they could have secured identity theft protection or requested a credit freeze to mitigate the damage from their information being stolen); see also Stasi v. Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 925 (S.D. Cal. 2020) (declining to dismiss the CCRA claim at the motion-to-dismiss stage). OEFCU also argues that Plaintiffs are not “customers” of OEFCU within the meaning of the CCRA. See ECF No. 29 at 20–21; see also Cal. Civ. Code § 1798.80(c) (defining “customer” as “an individual who provides personal information to a business for the purpose of purchasing or leasing a product or obtaining a service from the business”). Plaintiffs respond that because Jimenez and Hendren alleged that they provided their PII to OEFCU as a condition of receiving its services, they have demonstrated their status as “customers” under the CCRA. See ECF No. 40 at 21; see also ECF No. 16 ¶ 114 (“Plaintiff Jimenez provided his information to Defendant as a condition of becoming a customer of Defendant”); id. ¶ 124 (“As a condition of obtaining services at OEFCU, [Hendren] was required to provide his PII/PHI to Defendant.”).3 Accordingly, the Court declines to dismiss Jimenez and Hendren’s CCRA claims at this stage. H. Declaratory Relief The Federal Declaratory Judgment Act provides that, “[i]n a case of actual controversy within its jurisdiction, . . . any court of the United States, upon filing of an appropriate pleading, may declare the rights and other legal relations of any interested party seeking such declaration, whether or not further relief is or could be sought.” 28 U.S.C. § 2201(a). The “Act does not grant litigants an absolute right to a legal determination.” t’Bear v. Forman, 359 F. Supp. 3d 882, 902 3 Jaramillo does not oppose dismissal of her CCRA claim because she does not allege to be a customer of OEFCU. See ECF No. 40 at 21 n.4. Accordingly, the Court dismisses Jaramillo’s (N.D. Cal. 2019) (quoting U.S. v. Washington, 759 F.2d 1353, 1356 (9th Cir. 1985)). “Rather, the decision to grant declaratory relief rests within a district court’s discretion.” Allstate Ins. Co. v. Bos, No. CV 12-1024 PSG (RZx), 2012 WL 12930703, at *1 (N.D. Cal. Feb. 17, 2012). “Declaratory relief should be denied when it will neither serve a useful purpose in clarifying and settling the legal relations in issue nor terminate the proceedings and afford relief from the uncertainty and controversy faced by the parties.” t’Bear, 359 F. Supp. 3d at 902-03 (quoting U.S v. Washington, 759 F.2d at 1357). OEFCU argues that Plaintiffs’ requested declaratory relief is duplicative of their negligence claim. In their claim for declaratory relief, Plaintiffs ask the Court to declare that OEFCU “owed, and continues to owe, a legal duty to employ reasonable data security to secure the PII/PHI it possesses,” that OEFCU “breached, and continues to breach, its duty by failing to employ reasonable measures to secure its customers’ personal and financial information,” and that OEFCU’s “breach of its legal duty continues to cause harm to Plaintiffs and the Class.” ECF No. 16 at 73–74. Plaintiffs also ask for “corresponding injunctive relief,” id. at 74, which the Court understands as a separate request for an injunction. Plaintiffs argue that their negligence and declaratory relief claims are distinct because while Plaintiffs seek monetary damages through their other causes of action for OEFCU’s past conduct, their declaratory relief claim seeks to “address [OEFCU’s] current and future data security practices.” See ECF No. 40 at 22. The Court finds Plaintiffs’ argument unpersuasive. While Plaintiffs do style their request for declaratory relief as regarding OEFCU’s ongoing breach, the determinations they request merely restate the elements of their negligence claim. The proposed declaratory relief would have the same effect as, and duplicate, a finding on their negligence claim. The Court thus dismisses Plaintiffs’ claim for declaratory relief because it would “neither serve a useful purpose in clarifying and settling the legal relations in issue nor terminate the proceedings and afford relief from the uncertainty and controversy faced by the parties.” t’Bear, 359 F. Supp. 3d at 902-03 (quoting U.S v. Washington, 759 F.2d at 1357). Moreover, declaratory relief is a remedy and not a standalone cause of action. See Doe 1 v. 1 claim, granting leave to amend would be futile. Accordingly, Plaintiffs’ claim for declaratory 2 relief is dismissed with prejudice. 4 For the reasons set forth above, the Court grants OEFCU’s motion to dismiss in part: the 5 breach-of-implied-contract claim and the CCRA claim brought by Erica Jaramillo are dismissed 6 with leave to amend; Plaintiffs’ UCL claims are dismissed with leave to amend; and Plaintiffs’ 7 claim for declaratory relief is dismissed with prejudice. The Court denies the remainder of 8 OEFCU’s motion. 9 Plaintiffs may file an amended complaint within 28 days of this order solely to address the 10 deficiencies identified in the order. Failure to timely file an amended complaint will result in 11 dismissal of the relevant claims with prejudice. : 13 Dated: August 19, 2025 . .

M4 JON S. TIGA 15 nited States District Judge 16

18 19 20 21 22 23 24 25 26 27 28