Michael Terpin v. AT and T Inc

Opinion

O

United States District Court Central District of California

MICHAEL TERPIN, Case No. 2:18-cv-06975-ODW (KSx)

Plaintiff, ORDER GRANTING v. DEFENDANT’S PARTIAL AT&T MOBILITY, LLC, et al., MOTION TO DISMISS [43]

Defendants.

Defendant AT&T Mobility, LLC (“AT&T”) moves to dismiss certain of Plaintiff Michael Terpin’s (“Mr. Terpin”) claims in his Second Amended Complaint (“SAC”), including deceit by concealment, misrepresentation, requests for punitive damages, and all claims against Doe defendants (the “Motion”). (Mot., ECF No. 43.) For the reasons that follow, the Court GRANTS AT&T’s Motion.1 As previously set forth in the Court’s February 24, 2020 Order (“Feb. Order”), (ECF No. 37), granting in part and denying in part AT&T’s motion to dismiss the First Amended Complaint (“FAC”), Mr. Terpin is a prominent and well-known

1 Having carefully considered the papers filed in connection with the Motion, the Court deemed the matter appropriate for decision without oral argument. Fed. R. Civ. P. 78; C.D. Cal. L.R. 7-15. member of the cryptocurrency community. (SAC ¶¶ 18–19, ECF No. 42.) He is domiciled in Puerto Rico with a residence in California. (SAC ¶ 1.) On June 11, 2017, Mr. Terpin’s phone suddenly became inoperable because his cell phone number had been hacked. (SAC ¶ 86.) After hackers attempted and failed eleven times to change Mr. Terpin’s AT&T password in AT&T retail stores, the hackers were able to change his password remotely. (SAC ¶ 86.) Mr. Terpin alleges that this allowed the hackers to gain control of his phone number, which allowed them to gain access to his accounts that use his telephone number for authentication. (SAC ¶ 87.) Mr. Terpin asserts the hackers used his telephone number to access his cryptocurrency accounts and also impersonated him by using his Skype account. (SAC ¶ 87.) By impersonating him, the hackers convinced one of Mr. Terpin’s clients to send them cryptocurrency and diverted the cryptocurrency to themselves. (SAC ¶ 87.) Later that day, AT&T was able to cutoff the hackers’ access to Mr. Terpin’s telephone number. (SAC ¶ 87.) However, by this time, the hackers had stolen substantial funds from Mr. Terpin. (SAC ¶ 87.) Around June 13, 2017, Mr. Terpin met with AT&T representatives in Puerto Rico to discuss the hack. (SAC ¶ 88.) AT&T allegedly promised to place Mr. Terpin’s account on a “higher security level with special protection.” (SAC ¶ 89 (internal quotation marks omitted).) This included requiring a six-digit passcode (known only to Mr. Terpin and his wife) of anyone attempting to access or change Mr. Terpin’s account settings or transfer his telephone number to another phone. (SAC ¶ 89.) Mr. Terpin alleges that this form of “celebrity” protection was created with the knowledge and approval of AT&T’s officers, including Bill O’Hern and David S. Huntley, who are in charge of AT&T’s security and privacy efforts. (SAC ¶ 90.) Mr. Terpin maintains that he “relied upon AT&T’s promises that his account would be much more secure against hacking, including SIM swap fraud, after it implemented the increased security measures,” and this led him to remain an AT&T customer. (SAC ¶ 92.) Mr. Terpin alleges that AT&T and its officers, such as Mr. O’Hern and Mr. Huntley, knew at the time he adopted the six-digit security code that it would not provide adequate protection because it could be overridden by AT&T employees. (SAC ¶ 93.) On Sunday, January 7, 2018, Mr. Terpin’s phone again became inoperable. (SAC ¶ 94.) Mr. Terpin alleges that an employee at an AT&T store in Norwich, Connecticut assisted an imposter with a SIM card swap.2 (SAC ¶¶ 95–96.) This resulted in AT&T transferring Mr. Terpin’s phone number to an imposter. (FAC ¶ 95.) Mr. Terpin alleges that when his phone became inoperable, he attempted to contact AT&T to have his telephone number canceled, but AT&T failed to promptly cancel his account. (SAC ¶ 97.) By having access to Mr. Terpin’s phone number, Mr. Terpin alleges that “the hackers were able to intercept Mr. Terpin’s personal information, including telephone calls and text messages, change passwords, access programs and files and locate information that allowed them to gain access to his cryptocurrency wallets and/or accounts.” (SAC ¶ 100.) Mr. Terpin alleges that, as a result, between January 7 and 8, 2018, the hackers stole nearly $24 million worth of cryptocurrency from him. (SAC ¶¶ 101, 103.) On August 15, 2018, Mr. Terpin filed his Complaint asserting sixteen causes of action. (See generally Compl., ECF No. 1.) AT&T moved to dismiss the Complaint in its entirety, which motion the Court granted in part and denied in part, with leave to amend (“July Order”). (See July Order, ECF No. 29.) On August 9, 2019, Mr. Terpin filed his FAC against AT&T alleging nine causes of action. (See generally FAC, ECF No. 32.) Again, AT&T moved to dismiss the FAC in its entirety, which motion the Court granted in part and denied in part, with partial leave to amend. (See Feb. Order.) On March 16, 2020, Mr. Terpin filed his SAC against AT&T alleging eight causes of action: (1) declaratory relief; (2) unauthorized disclosure, 47 U.S.C. §§ 206,

2 Mr. Terpin alleges that “SIM swapping consists of tricking a provider . . . into transferring the target’s phone number to a SIM card controlled by the criminal. Once they get the phone number, fraudsters can leverage it to reset the victims’ passwords and break into their online accounts.” (SAC ¶ 70.) 222; (3) deceit by concealment, California Civil Code sections 1709, 1710; (4) misrepresentation; (5) negligence; (6) negligent supervision and training; (7) negligent hiring; and (8) breach of contract. (SAC ¶¶ 111–211.) AT&T now moves to dismiss Mr. Terpin’s third and fourth causes of action as well as his claims against Doe defendants and request for punitive damages. (See generally Mot.) A court may dismiss a complaint under Federal Rule of Civil Procedure (“Rule”) 12(b)(6) for lack of a cognizable legal theory or insufficient facts pleaded to support an otherwise cognizable legal theory. Balistreri v. Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1988). To survive a dismissal motion, a complaint need only satisfy the minimal notice pleading requirements of Rule 8(a)(2)—a short and plain statement of the claim. Porter v. Jones, 319 F.3d 483, 494 (9th Cir. 2003). The factual “allegations must be enough to raise a right to relief above the speculative level.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). That is, the complaint must “contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks omitted). The determination of whether a complaint satisfies the plausibility standard is a “context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Id. at 679. A court is generally limited to the pleadings and must construe all “factual allegations set forth in the complaint . . . as true and . . . in the light most favorable” to the plaintiff. Lee v. City of Los Angeles, 250 F.3d 668, 679 (9th Cir. 2001). However, a court need not blindly accept conclusory allegations, unwarranted deductions of fact, and unreasonable inferences. Sprewell v. Golden State Warriors, 266 F.3d 979, 988 (9th Cir. 2001). Where a district court grants a motion to dismiss, it should generally provide leave to amend unless it is clear the complaint could not be saved by any amendment. See Fed. R. Civ. P. 15(a); Manzarek v. St. Paul Fire & Marine Ins. Co., 519 F.3d 1025, 1031 (9th Cir. 2008). Leave to amend may be denied when “the court determines that the allegation of other facts consistent with the challenged pleading could not possibly cure the deficiency.” Schreiber Distrib. Co. v. Serv-Well Furniture Co., 806 F.2d 1393, 1401 (9th Cir. 1986). Thus, leave to amend “is properly denied . . . if amendment would be futile.” Carrico v. City and Cty. of San Francisco, 656 F.3d 1002, 1008 (9th Cir. 2011). A. Deceit by Concealment (Claim 3) Under California law, a plaintiff may assert a claim for deceit by concealment based on “[t]he suppression of a fact, by one who is bound to disclose it, or who gives information of other facts which are likely to mislead for want of communication of that fact.” Cal. Civ. Code § 1710(3). An action for fraud and deceit based on concealment has five elements: (1) the defendant must have concealed or suppressed a material fact, (2) the defendant must have been under a duty to disclose the fact to the plaintiff, (3) the defendant must have intentionally concealed or suppressed the fact with the intent to defraud the plaintiff, (4) the plaintiff must have been unaware of the fact and would not have acted as he did if he had known of the concealed or suppressed fact, and (5) as a result of the concealment or suppression of the fact, the plaintiff must have sustained damage. In re Yahoo! Inc. Customer Data Security Breach Litig., 313 F. Supp. 3d 1113, 1133 (N.D. Cal. 2018). As in AT&T’s previous motion, AT&T challenges only two elements, arguing that Mr. Terpin fails to sufficiently plead a duty to disclose or reliance in connection with his deceit by concealment claim. (Mot. 6–9.) First, the Court addresses Mr. Terpin’s allegations regarding AT&T’s duty to disclose. As discussed in the February Order, California law recognizes four circumstances in which an obligation to disclose may arise: “(1) when the defendant is in a fiduciary relationship with the plaintiff; (2) when the defendant had exclusive knowledge of material facts not known to the plaintiff; (3) when the defendant actively conceals a material fact from the plaintiff; and (4) when the defendant makes partial representations but also suppresses some material facts.” LiMandri v. Judkins, 52 Cal. App. 4th 326, 336 (1997). AT&T contends that Mr. Terpin has failed to sufficiently allege any of the four circumstances and, thus, cannot establish a duty to disclose. (Mot. 6–8.) The Court agrees. First, Mr. Terpin argues that a duty to disclose arose because AT&T had “‘exclusive knowledge of material facts’ relating to its security system” and Mr. Terpin had no way of knowing about the system’s inadequacies. (Opp’n to Mot. (“Opp’n”) 5, ECF No. 44; see SAC ¶¶ 92, 143.) However, as the Court recognized in its February Order, AT&T did disclose the limits of its security protections to Mr. Terpin in his AT&T contract. AT&T’s Privacy Policy explicitly states that it “cannot guarantee that your Personal Information will never be disclosed in a manner inconsistent with [AT&T’s] Policy (for example, as the result of unauthorized acts by third parties that violate the law or this Policy).” (SAC, Ex. B (“Privacy Policy”) 99, ECF No. 42-1.) Although AT&T implemented a six-digit code on Mr. Terpin’s account to offer him increased protection, there are no allegations that AT&T indicated the code was immune to the limitations expressed in its Privacy Policy. Because AT&T disclosed that its security system was subject to inadequacies, the fact was not within AT&T’s exclusive knowledge. Next, Mr. Terpin also contends that AT&T actively concealed the fact that the six-digit security code could be overridden or ignored by AT&T employees when it promised him increased security protection. (Opp’n 6; see SAC ¶ 144.) To establish active concealment, a plaintiff must allege “affirmative acts on the part of the defendants in hiding, concealing or covering up the matters complained of.” Lingsch v. Savage, 213 Cal. App. 2d 729, 734 (1963). “Mere nondisclosure does not constitute active concealment.” Herron v. Best Buy Co., 924 F. Supp. 2d 1161, 1176 (E.D. Cal. 2013). Mr. Terpin describes nondisclosure in his SAC. AT&T may have omitted the fact that its employees could override Mr. Terpin’s six-digit code, but the omission itself does not amount to AT&T’s affirmatively covering up the information. Further, AT&T promised Mr. Terpin the code would provide “additional levels of security” and that his account was “much less likely to be subject to SIM swap fraud.” (SAC ¶¶ 89, 143 (emphasis added)). AT&T did not promise that the code would provide absolute protection when it knew otherwise. Cf. Johnson v. Harley-Davidson Motor Co., No. 2:10-cv-02443 JAM (EFB), 2011 WL 3163303, at *5 (E.D. Cal. July 22, 2011) (finding active concealment where the defendant told the plaintiffs their motorcycle defect was completely corrected when the defendants knowingly used equally defective parts for the repair). Last, Mr. Terpin asserts that AT&T made a partial representation when it assured him of the six-digit code’s protections but concealed that the code could be rendered ineffective by AT&T’s employees. (See Opp’n 7.) A claim for partial representation may arise when “the defendant makes representations but does not disclose facts which materially qualify the facts disclosed, or which render his disclosure likely to mislead.” Herron, 924 F. Supp. 2d at 1177 (quoting Warner Constr. Corp. v. City of Los Angeles, 2 Cal. 3d 285, 294 (1970)). AT&T represented to Mr. Terpin that the six-digit code would provide heightened security and AT&T appropriately qualified that promise within its privacy policy. Although AT&T did not specifically spell out that a security breach may occur if an employee violates their obligations and overrides the code at the behest of a criminal, it did disclose that a breach may be the “result of unauthorized acts by third parties.” (Privacy Policy 99.) Therefore, a duty to disclose did not arise from a partial representation. For the reasons stated above, Mr. Terpin fails to allege that AT&T had a duty to disclose in his SAC. As such, Mr. Terpin’s allegations are insufficient to state a claim for deceit by concealment.3 Accordingly, the Court GRANTS AT&T’s motion to dismiss Mr. Terpin’s third claim with prejudice. B. Misrepresentation (Claim 4) To state an intentional misrepresentation claim under California law, Mr. Terpin must plead: “(1) misrepresentation; (2) knowledge of falsity; (3) intent to defraud or to induce reliance; (4) justifiable reliance; and (5) resulting damage.” Yastrab v. Apple Inc., 173 F. Supp. 3d 972, 977–78 (N.D. Cal. 2016) (citing Engalla v. Permanente Med. Grp., Inc., 15 Cal. 4th 951, 974 (1997)). In its February Order, the Court dismissed this claim “because Mr. Terpin [did] not allege that he actually read AT&T’s Privacy Policy or COBC, which [made] Mr. Terpin’s allegation that he reasonably relied on the statements contained therein implausible.” (Feb. Order 11.) AT&T argues that in his SAC, Mr. Terpin “does nothing to cure his inadequate reliance allegations as to the written statements in the Privacy Policy and the COBC.” (Mot. 10–11.) Mr. Terpin does not dispute this. (See Opp’n 10–11.) Instead, Mr. Terpin argues that he relied on promises made by an AT&T employee after the hack in June 11, 2017, that his information would be secured by adding a six-digit code. (Opp’n 10; SAC ¶ 159.) Mr. Terpin alleges that AT&T promised heightened security so it could retain him as a customer and he relied on that promise in continuing his AT&T account. (Opp’n 10; SAC ¶ 162.) Finally, Mr. Terpin alleges that AT&T never intended to perform its promise because it knew that its security measures were ineffectual, it did not adhere to its own standards, and it did not have state-of-the-art security protection in place, like SIM lockout. (See SAC ¶¶ 159–160). Mr. Terpin still fails to state an intentional misrepresentation claim. “[M]aking a promise with an honest but unreasonable intent to perform is wholly different from making one with no intent to perform and, therefore, does not constitute a false

3 Having found no duty to disclose, the Court does not address whether Mr. Terpin sufficiently pleads reliance on AT&T’s alleged non-disclosure. promise.” Tarmann v. State Farm Mut. Auto. Ins. Co., 2 Cal. App. 4th 153, 159 (1991). Even if AT&T knew that the six-digit code could not prevent every potential security breach; the Court cannot infer from Mr. Terpin’s allegations that AT&T intended for the code to provide no increase to security when it promised additional protection. A defendant may be “overly optimistic” in making its promise, but “an erroneous belief, no matter how misguided, does not justify a finding of fraud.” Magpali v. Farmers Grp., Inc., 48 Cal. App. 4th 471, 481 (1996) (citing Tarmann, 2 Cal. App. 4th at 159). Therefore, Mr. Terpin’s allegations again fall short of pleading actionable fraud. Because Mr. Terpin fails to allege AT&T never intended to adhere to its heightened security protocols, the Court GRANTS AT&T’s motion to dismiss the fourth claim with prejudice. C. Punitive Damages Mr. Terpin seeks punitive damages in connection with his claims for deceit by concealment (Claim 3), misrepresentation (Claim 4), negligence (Claim 5), negligent supervision and training (Claim 6), and negligent hiring (Claim 7). (SAC ¶¶ 156, 164, 175, 189, 203.) AT&T argues that Mr. Terpin has not adequately pleaded that he is entitled to punitive damages. (Mot. 14–23.) AT&T advances four arguments in support of dismissal of Mr. Terpin’s claims for punitive damages. First, AT&T argues that Mr. Terpin has not alleged that an officer, director, or agent of AT&T committed or ratified an oppressive, fraudulent, or malicious act. (Mot. 15–18.) Second, AT&T argues that Mr. Terpin has not pleaded the requisite mental state on the part of an AT&T executive to justify punitive damages. (Mot. 18–22.) Third, AT&T argues that Mr. Terpin’s negligence claims are ineligible for punitive damages. (Mot. 22–23.) Fourth, AT&T argues punitive damages are not appropriate in this, a case of first impression. (Mot. 23.) By statute, where a plaintiff proves “by clear and convincing evidence that the defendant has been guilty of oppression, fraud, or malice, the plaintiff, in addition to the actual damages, may recover [punitive] damages.” Cal. Civ. Code § 3294(a). Nevertheless, a corporate entity cannot commit willful and malicious conduct; instead, “the advance knowledge and conscious disregard, authorization, ratification or act of oppression, fraud, or malice must be on the part of an officer, director, or managing agent of the corporation.” Id. § 3294(b); Taiwan Semiconductor Mfg. Co. v. Tela Innovations, Inc., No. 14-CV-00362-BLF, 2014 WL 3705350, at *6 (N.D. Cal. July 24, 2014) (“[A] company simply cannot commit willful and malicious conduct—only an individual can.”). Therefore, Mr. Terpin must plead that an officer, director, or managing agent of AT&T committed or ratified an act of oppression, fraud, or malice. Mr. Terpin asserts that his claim for punitive damages does not arise out of an act undertaken by an individual employee and ratified by an officer of AT&T; rather, it arises from acts AT&T officers committed themselves. (Opp’n 13.) In his SAC, Mr. Terpin added allegations that Bill O’Hern, AT&T’s Chief Security Officer, and David Huntley, AT&T’s Executive Vice President and Chief Compliance Officer, deliberately ignored the security requirements set forth in the 2015 Consent Decree, promoted a system that did not protect its customers, and did nothing to prevent AT&T employees from turning over customer information to hackers in SIM swaps. (SAC ¶¶ 75, 77– 79, 83–84, 90–93, 143–45, 149, 156.) Because the Court dismisses Mr. Terpin’s claims for fraud—including deceit by concealment and misrepresentation—he may only seek punitive damages based on AT&T and its officers’ negligent conduct. Usually, negligent conduct “does not satisfy the highly culpable state of mind warranting punitive damages.” Evans v. Home Depot U.S.A., Inc., No. 16-cv-07191-JSW, 2017 WL 679531, at *2 (N.D. Cal. Feb. 21, 2017) (quoting Woolstrum v. Mailoux, 141 Cal. App. 3d Supp. 1, 10 (1983)). Nevertheless, “if the plaintiff can make a showing that defendant’s conduct goes beyond gross negligence and demonstrates a knowing and reckless disregard, punitive damages may be available.” Simplicity Int’l v. Genlabs Corp., No. 09-cv-06146-SVW (RCx), 2010 WL 11515296, at *2 (C.D. Cal. Apr. 21, 2010) (citing Sturges v. Charles L. Harney, Inc., 165 Cal. App 2d 306, 320 (1958)). The plaintiff must show that the defendant (1) had “actual knowledge of the risk of harm it is creating” and (2) “in the face of that knowledge, fail[ed] to take steps it [knew would] reduce or eliminate the risk of harm.” Ehrhardt v. Brunswick, Inc., 186 Cal. App. 3d 734, 742 (1986) (emphasis in original). Mr. Terpin attempts to allege that Mr. Huntley and Mr. O’Hern had actual knowledge of the high risk of employee-facilitated SIM swaps by referencing various reports, news articles, and indictments. (SAC ¶¶ 65–74, 83.) However, all of the examples Mr. Terpin provides occurred after his January 2018 hack. Therefore, these allegations do not support the inference that, at time of Mr. Terpin’s injury, AT&T and its executives had knowledge of the widespread threat of SIM swapping. See Johnson & Johnson Talcum Powder Cases, 37 Cal. App. 5th 292, 334 (2019) (finding “that evidence [that] developed post-injury did not create a reasonable inference that [the defendant] was acting with malice, pre-injury”). Mr. Terpin also alleges that the FCC Consent Decree issued in 2015 put AT&T and its executives on notice that its employees were disclosing customers’ confidential and private information and required AT&T to cure the deficiencies in its security, hiring, and training. (Opp’n 14; SAC ¶¶ 39–51.) Mr. Terpin alleges that AT&T failed to meet the Consent Decree’s standard for adequate security procedures and, by virtue of their role at AT&T as head of security and compliance, Mr. O’Hern and Mr. Huntley knew flaws existed. (See SAC ¶¶ 51, 75.) On top of that, Mr. Terpin alleges that AT&T had been contacted “numerous times by law enforcement authorities” specifically regarding SIM swap fraud involving its own employees cooperating with hackers and, given their responsibilities in the company, Mr. O’Hern and Mr. Huntley knew of such contacts. (SAC ¶ 91.) Taking these allegations as true, as the Court must in a motion to dismiss, it is plausible that Mr. O’Hern and Mr. Huntley had actual knowledge of the threat posed by AT&T’s inadequate security system. However, Mr. Terpin fails to demonstrate that Mr. O’Hern and Mr. Huntley consciously disregarded the threat. Mr. Terpin alleges that the executives did nothing to prevent SIM swap scams. (SAC ¶ 78.) But a conclusory allegation that the defendant failed to take steps to reduce the risk of harm, with no factual support, cannot justify a claim for punitive damages. See Diehl v. Starbucks Corp., No. 12-CV-2432-AJB (BGS), 2014 WL 5171799, at *5 (S.D. Cal. Oct. 14, 2014) (finding that “legal conclusions and . . . magic words” will not save an otherwise faulty pleading for punitive damages). Mr. Terpin does not provide factual allegations that show the ways in which Mr. O’Hern and Mr. Huntley deliberately avoided taking steps to remedy the security gaps at the time of his attack. Cf. In re Yahoo! Inc., 313 F. Supp. 3d at 1148 (finding malice where the plaintiffs alleged that internal documents between executives showed they knew about a security breach, but purposefully did not tell the public for two years). In contrast, AT&T argues that Mr. Terpin himself admitted SIM swap fraud is a new risk and that no service provider has figured out how to prevent it. (Reply to Mot. (“Reply”) 10, ECF No. 45 (citing SAC ¶¶ 5, 70).) The Court agrees that Mr. Terpin’s allegations do not suggest that Mr. O’Hern and Mr. Huntley identified an appropriate security measure before Mr. Terpin’s attack and consciously chose not to implement it. Therefore, Mr. Terpin has not alleged sufficient facts to support a prayer for punitive damages. Mr. Terpin relies on two recent decisions from district courts in the Ninth Circuit arising out of similar facts against AT&T to justify denying this motion to dismiss his claims for punitive damages at the pleading stage.4 Mr. Terpin first refers 4 Mr. Terpin requests the Court take judicial notice of two recent decisions and the associated complaints, arising out of similar facts against AT&T. (Request for Judicial Notice (“RJN”) 1, ECF No. 47.) AT&T does not object. (Resp. to RJN 1, ECF No. 48.) “A court may consider certain materials . . . [including] matters of judicial notice” when ruling on a Rule 12(b)(6) motion to dismiss. United States v. Ritchie, 342 F.3d 903, 909 (9th Cir. 2003); see also Fed. R. Evid. 201 (providing that judicial notice may be appropriate where facts are not subject to reasonable dispute). Accordingly, the Court GRANTS the Mr. Terpin’s RJN and takes judicial notice of the orders in Ross v. AT&T Mobility, LLC, Case No. 19-cv-0669-JST (N.D. Cal., May 14, 2020) (RJN Ex. 1 (“Ross Order”), ECF No. 47-1) and Shapiro v. AT&T Mobility, LLC, Case No. 2:19-cv-8972-CBM- to Ross v. AT&T Mobility, LLC, where the plaintiff relies on ExxonMobil Oil Corp. v. Southern California Edison Co., No. CV-12-10001-GHK (VBKx), 2013 WL 12166214 (C.D. Cal. May 1, 2013), to support a claim for punitive damages. (See Ross Order 29–30.) This Court does not find the analogy to ExxonMobil persuasive. In ExxonMobil, the court found malice sufficiently alleged where the plaintiff alleged the “decades-long history” between the parties, as well as each specific step the defendant failed to take to ensure reliable service, despite prior litigation between the two parties and repeated assurances it would improve. ExxonMobil, 2013 WL 12166214, at *1–3. Here, Mr. Terpin has not alleged such a history nor any specific steps Mr. O’Hern and Mr. Huntley have failed to take to remedy AT&T’s security flaws; therefore, in this respect, Ross is inapposite. Mr. Terpin also refers the Court to Shapiro v. AT&T Mobility, LLC, yet the Court respectfully disagrees with the lenient pleading standard applied in Shapiro, which permitted “unsupported and conclusory averments of malice.” (Shapiro Order 12.) Thus, neither decision provides persuasive reasoning to alter the Court’s conclusion that Mr. Terpin fails to sufficiently allege malice in his SAC. Because Mr. Terpin does not successfully allege malice, the Court GRANTS AT&T’s motion to dismiss Mr. Terpin’s request for punitive damages without leave to amend. However, the Court recognizes that critical facts may arise during discovery that provide Mr. Terpin the ability to adequately plead punitive damages. Mr. Terpin may move to add a request for punitive damages at the appropriate time, and no later than twenty-one days (21) after the discovery cutoff deadline. D. Doe Defendants The Court previously granted AT&T’s motion to dismiss Mr. Terpin’s claims against Doe defendants, with leave to amend in accordance with Local Rule 19-1

FFM (C.D. Cal., May 18, 2020) (RJN Ex. 2 (“Shapiro Order”)), but not the truth of the facts therein. Lee, 250 F.3d at 690; see also Reyn’s Pasta Bella, LLC v. Visa USA, Inc., 442 F.3d 741, 746 n.6 (9th Cir. 2006) (taking judicial notice of pleadings, memoranda, and other court documents). (which permits no more than ten fictitiously named parties). (Feb. Order 14.) However, in his SAC, Mr. Terpin again brings claims against Doe defendants □□□□□ (See SAC.) AT&T moves to dismiss Mr. Terpin’s claims against Doe defendants because Mr. Terpin has alleged more than ten fictitious defendants and has not made individualized allegations about particular fictitious defendants. (Mot. 13-14.) Mr. Terpin does not oppose on this issue. (See generally Opp’n.) The Court finds it premature to dismiss Doe defendants 1—10, as they are permitted by Local Rule 19-1 and facts may develop during discovery which enable Mr. Terpin to identify the Does. However, as no complaint may include more than ten Doe defendants, the Court GRANTS AT&T’s motion to dismiss Doe defendants 11-25 with prejudice. See } C.D. Cal. L.R. 19-1. Vv. CONCLUSION As discussed above, the Court GRANTS AT&T’s Motion to Dismiss. (ECF No. 43.) September 8, 2020 ‘Se? Le Pm od bid tite OTIS D. WRIGHT, II UNITED STATES DISTRICT JUDGE