Case No.: 2:25-cv-00986-JAD-DJA Kathleen Jordan, et. al., Plaintiffs Order Granting Motion to Dismiss in Part v. and with Limited Leave to Amend
Absolute Dental Group, LLC and Judge [ECF No. 61] Consulting, Inc., Defendants This is a data-breach case alleging that cybercriminals infiltrated Absolute Dental Group LLC’s computer systems and obtained the personally identifiable and protected health information of more than one million patients. The plaintiffs contend that this occurred because Absolute and its managed-services provider, Judge Consulting, Inc., failed to implement reasonable cybersecurity measures despite collecting and maintaining extraordinarily sensitive information. On behalf of themselves and a putative class, the plaintiffs assert negligence, contract, statutory, and related equitable claims arising from that alleged failure. The plaintiffs have reached a class-wide settlement with Absolute, which is pending final approval. Judge Consulting moves to dismiss the claims against it under Federal Rules of Civil Procedure (FRCP) 12(b)(1) for lack of Article III standing and under FRCP 12(b)(6) for failure to state a claim. I deny the motion in part and grant it in part. The plaintiffs have adequately alleged Article III standing at this stage, and they plausibly state claims for negligence and unjust enrichment. But I dismiss the claims for negligence per se, Nevada’s Privacy of Information Collected on the Internet from Consumers Act, invasion of privacy, and declaratory and injunctive relief with limited leave to amend by August 18, 2026. Discussion A. The plaintiffs have standing to pursue their claims at this stage. FRCP 12(b)(1) authorizes federal courts to dismiss a complaint for want of subject-matter jurisdiction.1 A challenge to a plaintiff’s Article III standing is properly brought under FRCP
12(b)(1) because, if a plaintiff is without standing to assert her claims, the district court lacks subject-matter jurisdiction over her.41 “[T]he threshold question of whether [a] plaintiff has standing (and the court has jurisdiction) is distinct from the merits of [her] claim”; the standing question “precedes, and does not require, analysis of the merits.”42 “No principle is more fundamental to the judiciary’s proper role in our system of government than the constitutional limitation of federal-court jurisdiction to actual cases or controversies.”2 “[A] plaintiff must have standing to sue” “[t]o satisfy the ‘Cases’ and ‘Controversies’ requirement.”3 The party asserting federal jurisdiction thus has the burden of establishing Article III standing over a case or controversy.4 In a putative class action, Article III’s requirements are satisfied before a class is certified if at least one named plaintiff has
standing.5 This burden is met by showing that the plaintiff “(1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable judicial decision.”6 “Standing must be proven ‘with the manner and degree of
1 Fed. R. Civ. P. 12(b)(1). 2 Simon v. E. Ky. Welfare Rts. Org., 426 U.S. 26, 37 (1976). 3 Am. Encore v. Fontes, 152 F.4th 1097, 1109–10 (9th Cir. 2025). 4 Elk Grove Unified Sch. Dist. v. Newdow, 542 U.S. 1, 11 (2004), abrogated in part on other grounds in Lexmark Int’l, Inc. v. Static Control Components, Inc., 572 U.S. 118, 127 (2014). 5 Healy v. Milliman, Inc., 164 F.4th 701, 706 (9th Cir. 2026). 6 Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016) (citing Lujan v. Defs. of Wildlife, 504 U.S. 555, 560 (1992)). evidence required at the successive stages of the litigation.’”7 “For purposes of ruling on a motion to dismiss for want of standing, both the trial and reviewing courts must accept as true all material allegations of the complaint and must construe the complaint in favor of the complaining party.”43
Judge Consulting challenges the injury-in-fact prong here.8 The plaintiffs respond that the allegations of one of the named plaintiffs, Kathleen Jordan,9 satisfies the injury-in-fact requirement because, in addition to alleging that her highly sensitive personal information was compromised in the data breach, she alleges that an unauthorized individual opened a PayPal account in her name following the breach, causing her to incur charges or debt.10 Relying principally on the Ninth Circuit’s unpublished holding in Greenstein v. Noblr Reciprocal Exchange,11 Judge Consulting argues that the third-amended complaint (TAC) fails to plausibly allege that Jordan’s own personal information was compromised in the data breach. Judge Consulting emphasizes that the notice only states that “certain sensitive personal information of ‘certain individuals may have been affected’ and that ‘[s]uch sensitive personal information may
include’ things like health information, driver’s license numbers, Social Security numbers,
7 DZ Rsrv. v. Meta Platforms, Inc., 96 F.4th 1223, 1240 (9th Cir. 2024) (quoting Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992)). 8 ECF No. 68 at 26. 9 Because Jordan’s allegations are sufficient to establish Article III standing at this stage, see infra at page 5, I limit my discussion to her allegations and do not separately analyze the standing of the remaining named plaintiffs. 10 ECF No. 78 at 6–7; ECF No. 61 at ¶¶ 201–202, 207. 11 Greenstein v. Noblr Reciprocal Exch., 2024 WL 3886977 (9th Cir. Aug. 21, 2024) (unpublished). contact information.”12 In Judge Consulting’s view, those allegations do not plausibly establish that Jordan’s personal information was stolen. In Greenstein, the Ninth Circuit examined both the complaint and the notice incorporated into it and concluded that the plaintiffs had failed to plausibly allege that their own driver’s
license numbers had been stolen.13 The incorporated notice established only that Noblr had suffered a cyberattack, that some driver’s license numbers had been taken, and that any individual recipient’s driver’s license number “may (or may not) have been among those stolen.”14 Because the complaint alleged little more than that plaintiffs’ information had been “exposed” or “may have been accessed,” its contrary allegations that the plaintiffs’ information “was taken” were deemed conclusory because they were unsupported by the complaint’s incorporated allegations.15 The plaintiffs here allege that Absolute’s investigation determined that multiple categories of sensitive personal information—including names, dates of birth, Social Security numbers, driver’s license information, passport information, health information, and financial-
account information—may have been compromised in the data breach.16 According to the complaint, Jordan’s own information was among the compromised data, and an unauthorized individual later opened a PayPal account in her name, causing her to incur charges or debt.17 Unlike in Greenstein, there is no incorporated notice before me with contents that contradict
12 ECF No. 68 at 27. 13 See generally Greenstein, 2024 WL 3886977. 14 Id. at *2. 15 Id. 16 ECF No. 61 at ¶ 46. 17 Id. at ¶¶ 202–207. those allegations.18 Rather, Judge Consulting’s argument asks me to conclude that because the TAC does not identify the precise categories of Jordan’s information that were compromised, the PayPal account necessarily resulted from some source other than the alleged data breach. That is an inference in its favor. Given the broad scope of personal information alleged to have been
stolen in this case, it is reasonable to infer that such information could plausibly have been used to commit the fraud that Jordan alleges.19 Accepting the TAC’s well-pleaded allegations as true and drawing all reasonable inferences in the plaintiffs’ favor, as I must at this stage, the plaintiffs plausibly allege an actual instance of identity theft and resulting financial harm sufficient to establish a concrete injury. So I deny Judge Consulting’s 12(b)(1) motion on those grounds. B. The plaintiffs plausibly allege some claims, but not others. Having concluded that at least one named plaintiff has adequately alleged Article III standing, I turn to Judge Consulting’s challenge to the plaintiffs’ claims as sufficiently pled. FRCP 8 requires every complaint to contain “[a] short and plain statement of the claim showing that the pleader is entitled to relief.”20 While Rule 8 does not require detailed factual allegations,
18 The TAC references Absolute’s public notice, and provides a URL to that notice, but does not attach the notice or reproduce its full text. The URL identified in the TAC is no longer publicly accessible. Judge Consulting quotes additional language from the notice in its motion, but I must limit my analysis to the allegations contained in the TAC and materials properly before the court. 19 Courts have also found that these types of facts satisfy the traceability prong for standing, too. See In re Sequoia Benefits & Ins. Data Breach Litig., 2024 WL 1091195, at *2 (N.D. Cal. Feb. 22, 2024) (plaintiffs sufficiently alleged that fraud was traceable to data breach that exposed sensitive data, though not banking or credit card information); see also In re Marriott Int’l, Inc., Customer Data Sec. Breach Litig., 440 F. Supp. 3d 447, 467 (D. Md. 2020) (injuries of fraudulent charges on personal-checking account and opening of “accounts for credit cards, consolidated loans, consumer accounts, and other lines of credit” were fairly traceable to data breach, even where no Social Security numbers or banking information was accessed). 20 Fed. R. Civ. P. 8(a)(2); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007); Ashcroft v. Iqbal, 556 U.S. 662, 678–79 (2009). a properly pleaded claim must contain enough facts to “state a claim to relief that is plausible on its face.”21 District courts employ a two-step approach when evaluating a complaint’s sufficiency on an FRCP 12(b)(6) motion to dismiss. The court must first accept as true all well-pleaded factual
allegations in the complaint, recognizing that legal conclusions are not entitled to the assumption of truth.22 Mere recitals of a claim’s elements, supported by only conclusory statements, are insufficient.23 The court must then consider whether the well-pleaded factual allegations state a plausible claim for relief.24 A claim is facially plausible when the complaint alleges facts that allow the court to draw a reasonable inference that the defendant is liable for the alleged misconduct.25 “A court may not look beyond the complaint to a plaintiff’s moving papers, such as a memorandum in opposition to a defendant’s motion to dismiss.”26 Plaintiffs must make direct or inferential factual allegations about “all the material elements necessary to sustain recovery under some viable legal theory,” and a complaint that fails to meet this standard must be dismissed.27
21 Twombly, 550 U.S. at 570. 22 Iqbal, 556 U.S. at 678–79. 23 Id. 24 Id. at 679. 25 Id. 26 Schneider v. Cal. Dept. of Corr., 151 F.3d 1194, 1197 n.1 (9th Cir. 1998). 27 Id. 1. The plaintiffs have sufficiently pled their negligence claim, and their negligence per se claim is duplicative of it.
The plaintiffs assert claims for negligence and negligence per se. Under Nevada law, a negligence claim requires “four elements: (1) the existence of a duty of care, (2) breach of that duty, (3) legal causation, and (4) damages.”28 Judge Consulting argues that these claims fail at the first element because it owed no duty to the plaintiffs.29 In response, the plaintiffs theorize several sources of duty, including a common-law duty to exercise reasonable care in safeguarding plaintiffs’ personal information and duties arising from various statutes, regulations, and industry standards.30 The plaintiffs have adequately alleged a garden-variety negligence claim based on a common-law theory at this stage. Judge Consulting contends that it was merely Absolute’s third-party managed-services provider and that it neither collected the plaintiffs’ personal information directly nor maintained a relationship with them that could give rise to a common- law duty.31 But the plaintiffs allege that Judge Consulting “collect[ed] and maintain[ed] vast quantities” of their private information with the services it provided to Absolute and that those allegations plausibly establish a duty to exercise reasonable care in safeguarding that information.32 Because I must accept those allegations as true at this juncture, the question is whether a company that allegedly collected and maintained another’s sensitive personal
28 Sanchez ex rel. Sanchez v. Wal-Mart Stores, Inc., 221 P.3d 1276, 1280 (Nev. 2009). 29 ECF No. 68 at 15–18. 30 See ECF No. 61 at 52–54; ECF No, 78 at 11–15. 31 See, e.g., ECF No. 68 at 15. 32 ECF No. 61 at ¶ 60. information owes a duty under Nevada law to exercise reasonable care in safeguarding that information from unauthorized access and disclosure. The Nevada Supreme Court has not yet addressed this issue. In the absence of controlling precedent from the state’s highest court, this court may “look to other state-court
decisions, well-reasoned decisions from other jurisdictions, and any other available authority to determine the applicable state law.”33 Courts considering analogous data-breach claims have generally recognized that entities entrusted with another’s sensitive personal information owe a general duty to exercise reasonable care in safeguarding that information from unauthorized access and disclosure.34 Other courts in this district have likewise held that allegations that a defendant collected, maintained, or controlled customers’ personal information are sufficient to plausibly allege such a duty at the pleading stage.35 And because Nevada courts frequently look to California authority when Nevada law is undeveloped,36 I find the California decisions 33 Burns v. Int’l Ins. Co., 929 F.2d 1422, 1424 (9th Cir. 1991). 34 See, e.g., Medoff v. Minka Lighting, LLC, 2023 WL 4291973, at *8 (C.D. Cal. May 8, 2023) (collecting cases); In re Accellion, Inc. Data Breach Litig., 713 F. Supp. 3d 623, 634 (N.D. Cal. 2024), reconsideration denied, 2024 WL 4592367 (N.D. Cal. Oct. 28, 2024) (California recognizes a duty by companies to take reasonable steps to protect all sensitive information they obtain from individuals); Stasi v. Inmediata Health Grp. Corp., 501 F. Supp. 3d 898, 914 (S.D. Cal. 2020) (collecting cases). 35 See, e.g., Archambault v. Riverside Resort & Casino, Inc., 2025 WL 2614044, at *6 (D. Nev. Sept. 9, 2025) (finding that Nev. Rev. Stat. 603.030 and the Nevada Supreme Court’s holding in Aleck v. ZB Nat’l Ass’n, 485 P.3d 210, at *3 (Nev. 2021), creates a duty to exercise reasonable care in the storage of customers’ personal information); Smallman v. MGM Resorts Int’l, 638 F. Supp. 3d 1175, 1188 (D. Nev. 2022) (defendant breached duty of care in manner of collecting, maintaining, and controlling customers’ sensitive personal and financial information); In re Data Breach Sec. Litig. Against Caesars Ent., Inc., 2025 WL 2393024, at *7–8 (D. Nev. Aug. 15, 2025). 36 Reyburn Lawn & Landscape Designers, Inc. v. Plaster Dev. Co., 255 P.3d 268, 277–78 (Nev. 2011); Crippens v. Sav on Drug Stores, 961 P.2d 761, 762–63 (Nev. 1998); Valley Health Sys., LLC v. Murray, 544 P.3d 904, 909 (Nev. 2024); see also Mort v. United States, 86 F.3d 890, 893 (9th Cir. 1996) (“Where Nevada law is lacking, its courts have looked to the law of other jurisdictions, particularly California, for guidance.”). recognizing that duty particularly persuasive. Guided by those authorities, I conclude that the Nevada Supreme Court would recognize a common-law duty under the facts alleged here. Because the complaint plausibly alleges a common-law duty, I need not decide at this stage whether the statutory and regulatory theories identified in the complaint independently create
duties or support the plaintiffs’ negligence theory in other ways. Judge Consulting may renew those arguments at summary judgment. The negligence-per-se claim stands differently. Negligence per se is not an independent cause of action but a means of establishing the duty and breach elements of a negligence claim.37 The plaintiffs rely on the same statutory duties to support both their negligence and negligence- per-se claims. Because those statutory theories are subsumed within the negligence claim itself, and at least one negligence theory is sufficient at this stage, the plaintiffs may proceed on the others. But the separate negligence-per-se claim is duplicative, so I dismiss it. 2. The plaintiffs have plausibly alleged unjust enrichment at this stage. In Nevada, plaintiffs plausibly allege unjust enrichment if they show: (1) “a benefit
conferred on the defendant by the plaintiff,” (2) “appreciation by the defendant of such benefit,” and (3) “acceptance and retention by the defendant under circumstances such that it would be inequitable for him to retain the benefit without payment of the value [].”38 “An action based on a theory of unjust enrichment is not available when there is an express, written contract, because no agreement can be implied when there is an express agreement.”39 Judge Consulting moves to dismiss the unjust-enrichment claim, arguing that plaintiffs fail to plausibly allege that they
37 Munda v. Summerlin Life & Health Ins. Co., 267 P.3d 771, 774 n.3 (Nev. 2011). 38 Leasepartners Corp. v. Robert L. Brooks Tr. Dated Nov. 12, 1975, 942 P.2d 182, 187 (Nev. 1997). 39 Id. conferred any benefit on Judge Consulting or that Judge Consulting appreciated, accepted, or retained such a benefit.40 It separately contends that Sonner v. Premier Nutrition Corp.41 bars equitable relief because the plaintiffs assert contract claims against Absolute that provide an adequate remedy at law.42
The plaintiffs have plausibly alleged an unjust-enrichment claim at this early litigation stage. They allege that they conferred both valuable private information and the economic benefits associated with services that included safeguarding that information.43 In return, Judge Consulting allegedly accepted those benefits, profited from the transactions, and enriched itself by spending less on data security than the plaintiffs contend was required.44 At this stage, those allegations plausibly support the inference that Judge Consulting accepted and retained benefits under circumstances that would make their retention inequitable. Nor do I find dismissal warranted under Sonner. In Sonner, the Ninth Circuit held that plaintiffs must establish that they lack an adequate remedy at law before securing equitable restitution for past harms.45 The plaintiff in that case failed to make such a showing because she
did not allege that she lacked an adequate legal remedy in her complaint.46 She also conceded that she sought the same sum in equitable restitution as the amount requested in damages to 40 ECF No. 68 at 22–23. 41 Sonner v. Premier Nutrition Corp., 971 F.3d 834, 844 (9th Cir. 2020). 42 ECF No. 68 at 22. 43 ECF No. 61 at ¶¶ 353–355. 44 Id. at ¶¶ 356–357, 360–361. 45 Sonner, 971 F.3d at 844. 46 Id. compensate her for the same past harm.47 The panel found that she had failed to explain how the same amount of money, for the exact same harm, would be inadequate or incomplete.48 Unlike the plaintiff in Sonner, these plaintiffs plead unjust enrichment in the alternative and expressly allege that they may lack an adequate remedy at law.49 I therefore cannot
conclude that the legal remedies asserted against Absolute necessarily foreclose equitable relief against Judge Consulting. Nor do plaintiffs allege only a completed economic injury. They contend that the defendants continue to possess their private information, that the information remains vulnerable to future unauthorized disclosure while in defendants’ possession, and that they therefore face ongoing harms beyond those already incurred.50 Accepting those allegations as true, I cannot conclude at this stage that legal damages alone would necessarily provide a complete remedy for the injuries the plaintiffs allege. The unjust-enrichment claim therefore survives dismissal. 3. The plaintiffs do not plausibly allege an invasion-of-privacy claim. Judge Consulting next moves to dismiss the plaintiffs’ invasion-of-privacy claim.
Nevada recognizes four distinct invasion-of-privacy torts: intrusion upon seclusion, appropriation of name or likeness, unreasonable publicity given to private facts, and false light.51 Although the complaint simply labels this claim as “Invasion of Privacy,” it does not identify
47 Id. 48 Id. 49 ECF No. 61 at ¶¶ 352, 364. 50 Id. at ¶¶ 362, 418. 51 People for Ethical Treatment of Animals v. Bobby Berosini, Ltd., 895 P.2d 1269, 1278 (Nev. 1995) (citing the Restatement), overruled in part on other grounds, City of Las Vegas Downtown Redev. Agency v. Hecht, 940 P.2d 134 (Nev. 1997). which theory the plaintiffs intend to pursue.52 Instead, the plaintiffs allege both that the defendants “intrud[ed] into their private affairs” and that defendants “publiciz[ed] private facts” about them.53 The plaintiffs clarify in their opposition that they intend to proceed under an intrusion-upon-seclusion theory,54 but a complaint may not be amended through arguments in an
opposition brief alone,55 and the TAC does not plausibly allege an intrusion-upon-seclusion claim. To state a claim for intrusion upon seclusion under Nevada law, a plaintiff must allege: “(1) an intentional intrusion (physical or otherwise); (2) on the solitude or seclusion of another; (3) that would be highly offensive to a reasonable person.”56 The plaintiffs allege that Judge Consulting intentionally intruded upon their privacy because it knew its cybersecurity measures were inadequate yet failed to correct them, effectively “publicizing” their private information to cybercriminals.57 But that theory is difficult to reconcile with the TAC’s central allegation that unknown cybercriminals carried out the unauthorized intrusion. Even if those allegations could be read to assert an intentional intrusion by Judge Consulting, the plaintiffs identify only one out-
of-circuit decision—a case from the Western District of North Carolina—for the proposition that
52 ECF No. 61 at ¶¶ 391–403. 53 Id. at ¶ 402. 54 ECF No. 78 at 20–21. 55 Schneider v. Cal. Dep’t of Corr., 151 F.3d 1194, 1197 n.1 (9th Cir. 1998) (“In determining the propriety of a Rule 12(b)(6) dismissal, a court may not look beyond the complaint to a plaintiff’s moving papers, such as a memorandum in opposition to a defendant’s motion to dismiss.”). 56 People for Ethical Treatment of Animals, 895 P.2d at 1279 (1995). 57 Id. at ¶¶ 399, 401. a defendant’s failure to prevent a third party’s intentional intrusion satisfies the intentional- intrusion element of an intrusion-upon-seclusion claim.58 Because the plaintiffs have neither clearly identified the privacy theory that they intend to pursue nor plausibly alleged the elements of their claim for intrusion upon seclusion, I dismiss
their privacy claim with leave to amend. If they choose to replead this claim, they must identify the specific Nevada privacy tort on which it is based and allege facts plausibly supporting each element of that claim. 4. The plaintiffs tacitly concede their NRS § 603A claim. Judge Consulting also moves to dismiss the plaintiffs’ claim asserted under Nevada’s Privacy of Information Collected on the Internet from Consumers Act (NPICICA). The plaintiffs offer no response to Judge Consulting’s arguments. Under Local Rule 7-2(d), the failure to oppose a motion may be construed as consent to granting it, and courts in this district routinely treat a party’s failure to respond to a dismissal argument as abandonment of the claim.59 Because the plaintiffs did not respond to Judge Consulting’s arguments as to their
NPICICA claim, I deem their silence as consent to its dismissal. 5. The declaratory- and injunctive-relief claims are dismissed.
Judge Consulting moves to dismiss the plaintiffs’ declaratory- and injunctive-relief claims because these are remedies, not independent causes of action. Although declaratory relief may be pled as a standalone claim, a court may dismiss it if it merely duplicates the plaintiffs’ 58 ECF No. 78 at 20 (citing Capiau v. Ascendum Mach., Inc., 2024 WL 3747191 (W.D.N.C.)). 59 Donor Network W. v. Nev. Donor Network, Inc., 2025 WL 326980, at *5 (D. Nev. Jan. 29, 2025); Umbach Med. Grp., PLLC v. Elevance Health Inc., 2024 WL 4349358, at *2 (D. Nev. Sept. 30, 2024); see also Singh v. Baidwan, 651 Fed. Appx. 616, 618 (9th Cir. 2016) (district court did not abuse its discretion in dismissing plaintiff’s claims for failure to prosecute because plaintiff failed to meaningfully respond to arguments defendant raised in motion to dismiss); Walsh v. Nev. Dep’t of Hum. Res., 471 F.3d 1033, 1037 (9th Cir. 2006). other claims.60 The plaintiffs ask the court to declare that Judge Consulting’s existing data- security measures violate its contractual obligations and duties of care and to order it to adopt additional safeguards, including encryption, employee training, monitoring, audits, data deletion, network segmentation, and third-party assessments.61 They argue that these are requests for
prospective relief, which is different from the retrospective relief requested in their other claims.62 But the negligence claims already seek injunctions that would require Judge Consulting to strengthen its security systems and monitoring procedures and submit those systems to periodic audits.63 While these claims add detail to that requested remedy, they turn on the same duty-and-breach questions that the negligence claim already presents. I therefore dismiss the declaratory and injunctive-relief64 claims as duplicative and because they add nothing more than remedy requests. Because the plaintiffs have otherwise pled surviving substantive claims, I grant them leave to amend for the limited purpose of adding any nonduplicative requests for declaratory or injunctive relief to the prayer for relief or as remedies tied to surviving substantive
claims rather than as independent causes of action. 60 Swartz v. KPMG LLP, 476 F.3d 756, 765–66 (9th Cir. 2007). 61 ECF No. 61 at ¶ 421. 62 ECF No. 78 at 22. 63 Id. at ¶¶ 296, 315. 64 See also Indian Homes Programs, LLC Series III v. Green Tree Serv., LLC, 2015 WL 5132456, at *4 (D. Nev. Sept. 1, 2015); U.S. Bank Nat’l Assoc. v. Saticoy Bay LLC, 2017 WL 277494, at *3 (D. Nev. Jan. 19, 2017); Tillman v. Quality Loan Serv. Corp., 2012 WL 1279939, at *3 (D. Nev. Apr. 2012) (“[I]njunctive relief is a remedy, not an independent cause of action.”); Jensen v. Quality Loan Serv. Corp., 702 F. Supp. 2d 1183, 1201 (E.D. Cal. 2010) (“A request for injunctive relief by itself does not state a cause of action.”). C. This is not a “shotgun pleading” that independently warrants dismissal. Judge Consulting’s remaining argument relies on Collins v. Nevada Department of Corrections65 and Destfino v. Reiswig66 for the proposition that the TAC is an impermissible “shotgun pleading” because it repeatedly refers to Judge Consulting and Absolute collectively as
“Defendants,” therefore depriving Judge Consulting of the notice that Rule 8 requires.67 But the Ninth Circuit in Destfino principally addressed FRCP 9(b)’s heightened pleading standard for fraud claims, under which a plaintiff may not simply “lump multiple defendants together” without differentiating each defendant’s alleged fraudulent conduct,68 and this is not a fraud case to which Rule 9(b) applies. Even if I were to apply that standard here, I don’t find that the allegations are “so vague and ambitious that [Judge Consulting] could not reasonable be required to frame a responsive pleading.”69 Although the complaint frequently pleads allegations collectively against “Defendants,” it also contains allegations specifically directed against Judge Consulting. The plaintiffs allege that Judge Consulting served as Absolute’s managed-services provider, managed
and maintained Absolute’s information systems, and marketed its cybersecurity expertise, and that the alleged data breach originated through an account associated with Judge Consulting.70 Those allegations identify the conduct that the plaintiffs attribute to Judge Consulting and provide fair notice of the claims asserted against it. While Judge Consulting disputes the truth or
65 Collins v. Nev. Dep’t of Corr., 2025 WL 638627 (D. Nev. Feb. 25, 2025). 66 Destfino v. Reiswig, 630 F.3d 952, 958–59 (9th Cir. 2011). 67 ECF No. 68 at 30–31. 68 Destfino, 630 F.3d at 958. 69 Collins, 2025 WL 638627 at *20. 70 ECF No. 61 at ¶¶ 4, 45–58. 1} legal significance of those allegations, such an attack is better suited for summary judgment. So also deny the motion to dismiss as to this argument. 3 Conclusion IT IS THEREFORE ORDERED that Judge Consulting’s motion to dismiss [ECF No 68] GRANTED in part: e The plaintiffs’ negligence and unjust-enrichment claims may proceed; © The negligence per se claim is dismissed as duplicative and without leave to amend; e The invasion-of-privacy claim is dismissed with leave to amend to clarify the exact 8 privacy theory and facts that support it; © The Nev. Rev. Stat. § 603A claim is dismissed with prejudice and without leave to amend; and e The declaratory- and injunctive-relief claims are dismissed with limited leave to amend to add them as forms of relief but not independent causes of action. If the plaintiffs choose to file an amended complaint, they may amend only the claims dismissed with leave to amend in this order. Any amended complaint must be complete in itself, may not incorporate prior pleadings by reference, and must be filed by August 18, 2026. If the plaintiffs do not file an amended complaint by that deadline, this action will proceed only on the claims for negligence and unjust enrichment. q Y ok NK U.S. DistrictNudge J emnifer J Dorsey July 29, 2026