Meghji v. Spadafora

Opinion

UNITED STATES BANKRUPTCY COURT SOUTHERN DISTRICT OF NEW YORK

In re: NOT FOR PUBLICATION

CELSIUS NETWORK LLC, et al., Case No. 22-10964 (MG)

Post-Effective Date Debtors. Chapter 11

MOHSIN Y. MEGHJI, as Representative for the Post-Effective Date Debtors,

Plaintiff, Adv. Pro. No. 24-03981 (MG)

v.

CHRISTOPHER SPADAFORA and CLOUDFLARE, INC.,

Defendants.

MEMORANDUM OPINION AND ORDER DENYING CLOUDFLARE MOTION TO DISMISS A P P E A R A N C E S: MAYER BROWN LLP Attorneys for Defendant Cloudflare, Inc. 1221 Avenue of the Americas New York, New York 10020 By: Matthew D. Ingber, Esq. Niketa K. Patel, Esq. Joaquin M. C de Baca, Esq. David Yolkut, Esq.

WHITE & CASE LLP Attorneys for Representative of Post-Effective Date Debtors 1221 Avenue of the Americas New York, NY 10020 By: Joshua D. Weedman, Esq. Samuel P. Hershey, Esq. Renza Demoulin, Esq. MARTIN GLENN CHIEF UNITED STATES BANKRUPTCY JUDGE Pending before the Court is the motion to dismiss (the “Motion,” ECF Doc. # 7) of Cloudflare, Inc. (“Cloudflare” or the “Defendant”) seeking entry of an order dismissing all claims asserted against it in the Complaint (the “Complaint,” ECF Doc. #1) filed by Mohsin Meghji ( “Litigation Administrator” or the “Plaintiff”), in his capacity as Litigation Administrator of the estates of the above-captioned debtors and debtors-in-possession (collectively, the “Debtors,” and together with their non-Debtor affiliates “Celsius” or the “Company”) appointed pursuant to the Modified Joint Chapter 11 Plan of Reorganization of Celsius Network LLC and its Debtor Affiliates (the “Plan”). Annexed to the Motion are (i) a

proposed order granting the Motion as Exhibit A; and (ii) a memorandum of law in support of the Motion (ECF Doc. # 8). The Plaintiff filed a memorandum of law in opposition to the Motion (the “Opposition,” ECF Doc. # 16). Cloudflare filed a memorandum of law in further support of the Motion (the “Reply,” ECF Doc. # 21). For the reasons discussed below, the Court: DENIES Cloudflare’s Motion to Dismiss.1 I. BACKGROUND A. The Complaint The Complaint asserts two causes of actions against Defendant Cloudflare, Inc.: (i) negligence and (ii) gross negligence, both arising from an alleged failure to maintain adequate cybersecurity protections related to the issuance and management of API keys for the

BadgerDAO platform. (Complaint ¶ 80-94.)

1 The Court already entered a Memorandum Opinion and Order Denying the motion to dismiss of co- defendant Christopher Spadafora. See Meghji v. Spadafora, 2025 WL 1232578 (MG)(Bankr. S.D.N.Y. April 28, 2025). 1. First Cause of Action: Negligence Celsius first alleges that Cloudflare’s conduct constituted negligence. Celsius alleges that Cloudflare owed a duty to BadgerDAO and all its governing members, including Celsius, to implement adequate security protocols for the issuance of API keys granting access to

BadgerDAO’s API. (Id. ¶ 81.) This duty allegedly arose from Cloudflare’s agreement to secure access to accounts containing sensitive passphrases like API keys. (Id. ¶ 82.) There was a flaw in Cloudflare’s system that initially went unnoticed but was eventually fixed. (Id. ¶ 84.) Celsius claims that all BadgerDAO members, including Celsius, reasonably expected Cloudflare to warn users if a vulnerability may have compromised their sensitive information prior to the flaw being remedied. (Id.) However, Cloudflare did not issue such a warning. (Id.) Accordingly, Celsius claims that Cloudflare breached its duty to BadgerDAO and Celsius by issuing API keys prior to proper account verification and by failing to notify users of the vulnerability after it was discovered. (Id. ¶ 85.) Celsius further alleges that this breach was the proximate and but-for cause of Celsius’

injury. (Id. ¶ 86.) Specifically, the Complaint asserts that a hacker was able to gain unauthorized access to BadgerDAO’s systems by obtaining an API key in mid-September and remained undetected for over two months, ultimately executing a first fraudulent transfer of funds on November 20, 2021. (Id.) As a result, Celsius asserts that Cloudflare’s failure to exercise the degree of care required by industry standards and by a reasonably prudent person under similar circumstances constitutes negligence and caused Celsius to lose more than $50 million in assets stored on the BadgerDAO platform. (Id. ¶ 87-88.) 2. Second Cause of Action: Gross Negligence Celsius further alleges in the second cause of action that Cloudflare’s conduct constituted gross negligence. The Complaint asserts that Cloudflare breached its duty to Celsius when it failed to remedy the known vulnerability in its systems, which created an unreasonable risk of

harm to all users of BadgerDAO, including Celsius. (Id. ¶ 92.) Specifically, Cloudflare had been informed of this vulnerability and was aware that it allowed malicious actors to potentially access the developer-end or API of its clients’ platforms—many of which, like BadgerDAO, were used to safeguard significant sums of customer funds. (Id.) By failing to immediately remedy the vulnerability, and by subsequently failing to notify users that their APIs, and therefore their funds, might have been compromised, Cloudflare created an unreasonable risk of harm to its users, including BadgerDAO, and in turn, to BadgerDAO’s users, including Celsius. (Id.) Cloudflare’s failure to act was therefore grossly negligent. (Id. ¶ 93.) As a result of Cloudflare’s alleged breach and its failure to exercise even slight care or diligence in fixing a known issue that had been reported on multiple occasions or notifying

BadgerDAO of a vulnerability, Celsius claims it has suffered damages, amounting to over $50 million in assets, following the hack of the BadgerDAO platform. (Id. ¶ 94.) B. The Cloudflare’s Motion to Dismiss Cloudflare filed the Motion to dismiss all claims asserted against it in the Complaint. (Motion at 1-2.) Cloudflare argues that Celsius fails to state both a negligence claim and a gross negligence claim. (Id.) Cloudflare argues that it owes no legal duty to Celsius, as there was no direct relationship, contract, or special connection between them. (ECF Doc. #8 at 16-21.) This absence of relationship, Cloudflare alleges, is fatal to the negligence claim. (Id. at 16.) Cloudflare claims that New York law recognizes an exception to the general rule that there is no duty to protect others from injuries caused by third parties if there is a special relationship exists, either between either between defendant and a third-person tortfeasor that encompasses defendant’s actual control of the third person’s actions, or between defendant and plaintiff that

requires defendant to protect plaintiff from the conduct of others. (Id. at 20.) Cloudflare claims Celsius failed to allege either form of special relationship as Cloudflare had no contacts or dealings either with the criminal hackers or with Celsius. (Id.) Furthermore, Cloudflare claims Celsius failed to allege any breach by Cloudflare because it has failed to plausibly allege that Cloudflare owed it any duty of care. (Id. at 23.) Celsius’ negligence claim fails for the additional and independent reason, Cloudflare argues, that Plaintiff’s allegations on causation are “reed-thin,” and that certain actions by BadgerDAO, third-party hackers, or Celsius are intervening causes to Cloudflare’s breach. (Id. at 24-25.) Cloudflare further contends that Celsius’ gross negligence claim fails for the same reasons as its ordinary negligence claim, and additionally lacks the heightened culpability

required under New York law. (Id. at 28.) Gross negligence requires conduct that demonstrates reckless disregard or intentional wrongdoing, far beyond ordinary carelessness. (Id. at 29.) Celsius merely alleges that Cloudflare was aware of a potential API key vulnerability discussed in a public forum and failed to act quickly enough. (Id.) However, Cloudflare notes it responded within days and addressed the issue, which cannot reasonably be characterized as reckless. (Id. at 30.) C. The Opposition Celsius filed the Opposition to the Motion. For the negligence claim, Celsius argues that Cloudflare owed Celsius a duty of care because of a special relationship formed through Cloudflare’s role in securing access to the BadgerDAO platform. (Opposition ¶ 10.) Celsius argues that it has adequately pleaded proximate cause since Cloudflare’s actions breach a clearly established industry standard and there were no intervening causes to Cloudflare’s Breach. (Id. ¶ 35.)

For the gross negligence claim, the plaintiff claims Cloudflare acted with gross negligence by showing a reckless disregard for the safety of its users. (Id. ¶ 39.) Cloudflare allegedly ignored repeated warnings about a security flaw and failed to implement safeguards in a timely manner. (Id. ¶ 40.) This indifference, particularly in a high-stakes environment involving large crypto assets, should be characterized as an extreme departure from standard conduct. (Id.) Cloudflare’s defense—that it responded within two days and intended to fix the issue—raises factual disputes inappropriate for resolution at the motion to dismiss stage. (Id. ¶ 41.) Additionally, Cloudflare’s claim that it lacked knowledge of the vulnerability is contradicted by its own admission of recognizing increased abnormal activity. (Id. ¶ 42.) D. Cloudflare’s Reply

Cloudflare filed the Reply to the Opposition. Cloudflare argues that Celsius fails to state a negligence claim because there was no duty of care owed, as Cloudflare had no direct relationship, control, or interaction with Celsius, and did not handle its data. (Reply at 8-10.) It also challenges Celsius’ claim to be a general partner of BadgerDAO, pointing out that Celsius disclaimed any actual control or governance. (Id. at 12.) Cloudflare argues that even if it had been negligent, BadgerDAO’s failure to implement basic security and reliance on a free service without adequate safeguards were unforeseeable intervening acts that break the chain of proximate causation. (Id. at 13.) For the gross negligence claim, the reply highlights that the alleged vulnerability was publicly discussed on a forum, and Cloudflare responded and fixed the issue within two days, which it argues is inconsistent with recklessness. (Id. at 14.) It also contends that Celsius’ allegation of a failure to guard against a risk does not amount to the extreme or outrageous

conduct necessary to sustain a gross negligence claim. (Id.) II. LEGAL STANDARD To survive a motion to dismiss brought under Rule 12(b)(6), made applicable here by FED. R. BANK. P. 7012, “a complaint must contain sufficient factual matter . . . to ‘state a claim to relief that is plausible on its face.’ ” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556). “While a complaint attacked by a Rule 12(b)(6) motion to dismiss does not need detailed factual allegations, a plaintiff’s obligation to provide the grounds of his entitlement to relief requires

more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 (internal quotation marks, citations, and alterations omitted). Thus, unless a plaintiff’s well-pleaded allegations have “nudged [its] claims across the line from conceivable to plausible, [the plaintiff's] complaint must be dismissed.” Id. at 570; see also Iqbal, 556 U.S. at 679. Courts use a two-prong approach when considering a motion to dismiss. McHale v. Citibank, N.A. (In re the 1031 Tax Group, LLC), 420 B.R. 178, 189–90 (Bankr. S.D.N.Y. 2009). First, the court must accept all factual allegations in the complaint as true, discounting legal conclusions clothed in factual garb. See, e.g., Kiobel v. Royal Dutch Petroleum Co., 621 F.3d 111, 124 (2d Cir.2010) (stating that a court must “assum[e] all well-pleaded, nonconclusory factual allegations in the complaint to be true”) (citing Iqbal, 556 U.S. at 678–79). Second, the court must determine if these well-pleaded factual allegations state a “plausible claim for relief.” Iqbal, 556 U.S. at 679 (citation omitted).

Courts do not make plausibility determinations in a vacuum; it is a “context specific task that requires the reviewing court to draw on its judicial experience and common sense.” Id. (citation omitted). A claim is plausible when the factual allegations permit “the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. at 678 (citation omitted). A complaint that only pleads facts that are “merely consistent with a defendant's liability” does not meet the plausibility requirement. Id. (quoting Bell Atl. Corp. v. Twombly, 550 U.S. at 557) (internal quotation marks omitted). “A pleading that offers ‘labels and conclusions’ or a ‘a formulaic recitation of the elements of a cause of action will not do.’” Id. (quoting Twombly, 550 U.S. at 555) (internal quotation marks omitted). “Threadbare recitals of the elements of a cause of action, supported by mere conclusory statements, do not suffice.” Id.

(citation omitted). “The pleadings must create the possibility of a right to relief that is more than speculative.” Id.; In re MF Glob. Holdings Ltd, No. 11-15058 (MG), 2013 WL 4511863, at *3 (Bankr. S.D.N.Y. Aug. 23, 2013), rev’d sub nom. In re MF Glob. Holdings, Ltd., No. 13 CIV. 07218 LGS, 2014 WL 4054281 (S.D.N.Y. Aug. 14, 2014) III. DISCUSSION A. Negligence Claim To show negligence under New York law, a plaintiff must demonstrate (1) the defendant owed the plaintiff a cognizable duty of care; (2) the defendant breached that duty; and (3) the plaintiff suffered damage as a proximate result. Ferreira v. City of Binghamton, 975 F.3d 255, 266 (2d Cir. 2020) (quoting Williams v. Utica Coll. of Syracuse Univ., 453 F.3d 112, 116 (2d Cir. 2006)). 1. Duty New York courts have recognized that a duty could be predicated on the danger of third-

party misconduct where a relationship between the defendant and either the plaintiff or the third- party wrongdoer provides the defendant with the ability to minimize the risk. Hamilton v. Accu- Tek, 62 F. Supp. 2d 802 (E.D.N.Y. 1999), vacated sub nom. Hamilton v. Beretta U.S.A. Corp., 264 F.3d 21 (2d Cir. 2001). Examples include the relationship between a carrier and its passenger or a tavern owner and its patron, where the defendant is obligated to take reasonable steps to protect from foreseeable risks, including the criminal conduct of others. (Id.) “The injured party must show that a defendant owed not merely a general duty to society but a specific duty to him or her, for without a duty running directly to the injured person there can be no liability in damages, however careless the conduct or foreseeable the harm. That is required in order to avoid subjecting an actor to limitless liability to an indeterminate class of persons

conceivably injured by any negligence in that act.” Hamilton v. Beretta U.S.A. Corp., 96 N.Y.2d 222, 232, 727 N.Y.S.2d 7, 750 N.E.2d 1055 (2001) (first quoting Lauer, 95 N.Y.2d at 96, 711 N.Y.S.2d 112, 733 N.E.2d 184; and then quoting Eiseman v. State, 70 N.Y.2d 175, 188, 518 N.Y.S.2d 608, 511 N.E.2d 1128 (1987)); Toretto v. Donnelley Fin. Sols., Inc., 583 F. Supp. 3d 570, 593 (S.D.N.Y. 2022). Courts have extended this principle to cybersecurity contexts. In Toretto, 583 F. Supp. 3d 570, the court held that a proxy services provider owed a duty to reasonably safeguard plaintiffs’ personal information. The court noted that defendant was in the best position to protect the information on its servers, understood the importance of data security, knew it was a target of cyber-attacks, and promoted its data security measures to customers. The court emphasized that imposing a duty would not result in limitless liability, as it would be limited to individuals whose information the defendant obtained while providing its service. Similarly, in Koeller v. Numrich Gun Parts Corp., 675 F. Supp. 3d 260 (N.D.N.Y. 2023), the court found that

the plaintiffs plausibly alleged a breach of duty by the defendant in failing to exercise reasonable care in securing and handling personal information, supervising agents, and timely notifying customers of a data breach. These cases support the conclusion that where a defendant undertakes to provide cybersecurity-related services and is in a unique position to prevent foreseeable harm to a limited party, a duty may arise under New York law. Here, Celsius alleges that Cloudflare undertook responsibility for securing access to API keys for the BadgerDAO platform and for warning users of known vulnerabilities. Cloudflare’s failure to address or disclose the flaw could create a foreseeable risk of harm to Celsius who used BadgerDAO platform to store substantial digital assets. Accordingly, Celsius has plausibly alleged that Cloudflare owed it a duty of care.

2. Breach In the Complaint, Celsius alleges that Cloudflare failed to implement and enforce appropriate verification protocols before issuing API keys and failed to notify users once it discovered the vulnerability in its system. Celsius alleged that the failure to implement standard account verification procedures and to provide timely notice of a known vulnerability deviates from both industry practices and the care expected of a reasonably prudent service provider handling sensitive authentication infrastructure. These allegations are sufficient to plausibly allege that Cloudflare breached its duty. See In re GE/CBPS, 2021 WL 3406374, at *8 (finding allegations sufficient to sustain a negligence claim where the complaint alleged that defendants failed to adopt and oversee appropriate data security processes and hardware systems to safeguard and protect the personal and financial information entrusted to them, despite a reasonably foreseeable risk of unauthorized disclosure); Sackin, 278 F. Supp. 3d at 748 (finding allegations sufficient to sustain a negligence claim where

the complaint alleged that the defendant was aware of the sensitivity of personal data but failed to take reasonable steps to prevent the wrongful dissemination including erecting a digital firewall, conducting data security training and adopting retention and destruction policies); see also Toretto, 583 F. Supp. 3d 570 (S.D.N.Y. 2022) (finding allegations sufficient to sustain a negligence claim where the complaint alleged the defendant was aware of ongoing cyber threats but failed to safeguard personal information it collected and maintained). 3. Damages Celsius has sufficiently alleged that it suffered damages as a proximate result of Cloudflare’s alleged negligence. Specifically, Celsius claims that due to Cloudflare’s failure to implement adequate verification protocols and to warn of a known vulnerability, a hacker was

able to exploit an unverified API key, gain unauthorized access to the BadgerDAO platform, and execute fraudulent fund transfers. As a result, Celsius allegedly lost over $50 million in digital assets stored on the platform. At the pleading stage, these allegations are adequate to plausibly support the element of damages. Courts have found such actual economic harm sufficient to satisfy the damages element of a negligence claim. See Toretto, 583 F. Supp. 3d 570; In re GE/CBPS, 2021 WL 3406374, at *9. Cloudflare argues that Celsius’ allegations on causation are “reed-thin,” and that certain actions by BadgerDAO, third-party hackers, or Celsius are intervening causes to Cloudflare’s breach. While other actors may have played a role, proximate cause under New York law does not require that the defendant’s negligence be the sole cause of harm—only that it be a substantial factor. See In re Methyl Tertiary Butyl Ether (MTBE) Prods. Liab. Litig., 739 F. Supp. 2d 576, 596 (S.D.N.Y. 2010). Intervening acts do not sever the causal chain where the

risk of such acts was foreseeable. Accordingly, Celsius has plausibly alleged that Cloudflare’s negligence was a proximate cause of its injury. Accordingly, Cloudflare’s motion to dismiss the negligence claim is DENIED. B. Gross Negligence Claim Under New York law, “to prevail on a claim for gross negligence, plaintiff must establish” the elements necessary to prevail on a claim for negligence—(1) duty; (2) breach; and (3) injury—plus a fourth element, namely, that defendant’s conduct “evinces a reckless disregard for the rights of others or ‘smacks’ of intentional wrongdoing.” Farash v. Cont’l Airlines, Inc., 574 F. Supp. 2d 356, 367–68 (S.D.N.Y. 2008), aff’d, 337 F. App’x 7 (2d Cir. 2009) (quoting AT&T v. City of New York, 83 F.3d 549, 556 (2d Cir. 1996)). To constitute gross negligence, the

act or omission must be of an aggravated character, as distinguished from the failure to exercise ordinary care. Am. Auto. Ins. Co. v. Rest Assured Alarm Sys., Inc., 786 F. Supp. 2d 798, 807 (S.D.N.Y. 2011) (citation omitted). New York courts have analyzed whether conduct is sufficiently aggravated to constitute gross negligence in an analogous context: the provision and maintenance of fire and burglar alarm services. “Generally, no issue of gross negligence is raised where the claim is based upon either inappropriate installation of an alarm system or an inappropriate response to an alarm. . . . On the other hand, a sufficient issue regarding gross negligence has been held to have been raised in cases referred to as including ‘outrageous acts of folly.’” Metro. Prop. & Cas. Ins. Co. v. Budd Morgan Cent. Station Alarm Co., 95 F. Supp. 2d 118, 122–23 (E.D.N.Y. 2000) (citation omitted). Thus, for example, the New York Court of Appeals has found that a plaintiff “alleged much more than mere failure to install a proper working alarm system and inspect it,” because the plaintiff alleged that “defendants had knowledge—for weeks, if not months—that the

equipment had been malfunctioning” and “that defendants not only failed to investigate the source of their equipment malfunction, but they failed to put anyone at the branch on notice of the potential security breach.” Abacus Fed. Sav. Bank v. ADT Sec. Servs., Inc., 18 N.Y.3d 675, 944 N.Y.S.2d 443, 967 N.E.2d 666, 669 (2012). Similarly, the First Department has found that a jury could find that an alarm company was grossly negligent when it failed to send guards to a jewelry manufacturer eleven hours after a weekend break-in and the manufacturer had not alerted the alarm company that it would be open over the weekend. Rand & Paseka Mfg. Co. v. Holmes Prot. Inc., 130 A.D.2d 429, 515 N.Y.S.2d 468, 469–70 (1st Dep’t 1987); see also Hanover Ins. Co. v. D & W Cent. Station Alarm Co., 164 A.D.2d 112, 560 N.Y.S.2d 293, 295–96 (1st Dep’t 1990) (finding summary judgment for alarm company inappropriate where the

record indicated that the alarm company received three signals over four hours, did not notify the police, and directed the guard sent to investigate the issue to “forget the assignment” when he encountered difficulty entering the building). But courts have found insufficient to find gross negligence “failure to wire a skylight,” which burglars broke through to steal paintings, Colnaghi, U.S.A., Ltd. v. Jewelers Prot. Servs., Ltd., 81 N.Y.2d 821, 595 N.Y.S.2d 381, 611 N.E.2d 282, 284 (1993), or “an alarm company’s delayed or inadequate response to an alarm signal, without more,” Abacus Fed. Sav. Bank v. ADT Sec. Servs., Inc., 77 A.D.3d 431, 908 N.Y.S.2d 654, 656 (1st Dep’t 2010), aff’d as modified, 18 N.Y.3d 675, 944 N.Y.S.2d 443, 967 N.E.2d 666 (2012) (collecting cases); Am. Auto. Ins. Co., 786 F. Supp. 2d 807. In Yuille v. Uphold HQ Inc., 686 F. Supp. 3d 323 (S.D.N.Y. 2023), the court found that the plaintiff sufficiently alleged gross negligence where the defendant was aware of increased hacking activity, was explicitly warned about a potential security breach, and failed to act for over two days while unauthorized transactions occurred.

In this case, Celsius alleges that Cloudflare, a leading cybersecurity service provider, was repeatedly warned about a critical vulnerability in its API key system that permitted unauthorized access to platforms like BadgerDAO, yet it failed to take corrective action or notify users—including Celsius—for an extended period. This alleged failure occurred in the context of heightened risk, where Cloudflare knew or should have known that the compromised API keys could grant access to platforms securing millions in digital assets. Much like the defendant in Yuille, who was explicitly warned of a breach and failed to act for over two days during which unauthorized activity occurred, Cloudflare is alleged to have ignored repeated warnings over a longer period and failed to implement even minimal protective measures. Moreover, the Complaint asserts that Cloudflare did not issue any notification to users after discovering the

vulnerability, allowing the unauthorized access to continue undetected. Taken together, these facts plausibly support an inference of reckless disregard rather than mere carelessness, and supporting denial of the motion to dismiss the gross negligence claim at this stage. Accordingly, the Cloudflare’s motion to dismiss the gross negligence claim is DENIED. IV. CONLUSION For the reasons explained above, Cloudflare’s Motion is DENIED. IT IS SO ORDERED.

Dated: May 6, 2025 New York, New York

Martin Glenn

MARTIN GLENN Chief United States Bankruptcy Judge