Quinalty v. FocusIT LLC

• Court: District Court, D. Arizona
• Decided: January 30, 2024
• Docket: 2:23-cv-00207
• Status: Unknown

Opinion

1 WO 2 3 4 5 6 IN THE UNITED STATES DISTRICT COURT 7 FOR THE DISTRICT OF ARIZONA

9 Joshua Quinalty, et al., No. CV-23-00207-PHX-JJT

10 Plaintiffs, ORDER

11 v.

12 FocusIT LLC,

13 Defendant. 14 15 At issue is Defendant FocusIT LLC’s Motion to Dismiss Plaintiff’s Amended Class 16 Action Complaint and Motion to Strike Plaintiff’s Class Allegation (Doc. 27, MTD), to 17 which Plaintiffs Joshua Quinalty and Alene Motta filed a Response (Doc. 29, Resp.) and 18 Defendant filed a Reply (Doc. 30, Reply). The Court has reviewed the parties’ briefs and 19 finds this matter appropriate for decision without oral argument. See LRCiv 7.2(f). For the 20 reasons set forth below, the Court grants Defendant’s Motion to Dismiss and grants 21 Plaintiffs leave to file a Second Amended Complaint. 22 I. BACKGROUND 23 In the Amended Class Action Complaint for Damages, Injunctive, and Equitable 24 Relief (Doc. 26, Am. Compl.), Plaintiffs allege the following facts. Plaintiff Quinalty and 25 Plaintiff Motta provided Personal Identifying Information (“PII”) to banks and financial 26 institutions. (Am. Compl. ¶¶ 2, 4.) Defendant is a third-party vendor that hosts mortgage 27 origination and loan processing software applications for the banks and financial institutions 28 to whom Plaintiff Quinalty and Plaintiff Motta provided their PII. (Am. Compl. ¶ 2.) 1 On June 1, 2022, Defendant’s system was compromised resulting in PII being 2 available to cybercriminals. (Am. Compl. ¶¶ 38-39.) The PII exposed included names, 3 dates of birth, addresses, and social security numbers of 147,799 individuals. (Am. Compl. 4 ¶ 38.) Defendant became aware of the data breach on August 2, 2022, and began notifying 5 affected individuals on September 28, 2022. (Am. Compl. ¶¶ 37, 45.) 6 Plaintiff Quinalty alleges two phones were fraudulently purchased using his PII as 7 a result of the data breach. (Am. Compl. ¶ 65.) Plaintiff Quinalty further alleges that he 8 purchased additional credit monitoring services, experienced an increase in spam phone 9 calls, messages, and targeted advertisements, and spent approximately twelve hours 10 responding to the breach. (Am. Compl. ¶¶ 66, 69.) 11 Plaintiff Motta alleges her PII was also included in the data breach and that she 12 experienced emotional distress as a result. (Am. Compl. ¶¶ 75, 82.) Plaintiff Motta 13 additionally alleges she spent approximately three hours responding to the breach and 14 anticipates spending considerable time and money to mitigate and address the associated 15 harms. (Am. Compl. ¶¶ 79, 83.) 16 On behalf of themselves and a putative nationwide class—consisting of all 17 individuals residing in the United States whose PII was compromised in the data breach 18 (Am. Compl. ¶ 116)—Plaintiffs raise claims of Negligence and Unjust Enrichment. 19 Plaintiffs additionally bring a claim for a putative subclass of Arizona plaintiffs: violation 20 of the Arizona Consumer Fraud Act. (Am. Compl. ¶¶ 165-75.) Defendant filed a Motion 21 to Dismiss for lack of subject matter jurisdiction under Federal Rule of Civil Procedure 22 12(b)(1) and for failure to state a claim upon which relief can be granted under Rule 23 12(b)(6). 24 II. LEGAL STANDARD 25 A. Subject Matter Jurisdiction 26 “A motion to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1) may 27 attack either the allegations of the complaint as insufficient to confer upon the court subject 28 matter jurisdiction, or the existence of subject matter jurisdiction in fact.” Renteria v. 1 United States, 452 F. Supp. 2d 910, 919 (D. Ariz. 2006) (citing Thornhill Publ’g Co. v. 2 Gen. Tel. & Elecs. Corp., 594 F.2d 730, 733 (9th Cir. 1979)). “Where the jurisdictional 3 issue is separable from the merits of the case, the [court] may consider the evidence 4 presented with respect to the jurisdictional issue and rule on that issue, resolving factual 5 disputes if necessary.” Thornhill, 594 F.2d at 733; see also Autery v. United States, 6 424 F.3d 944, 956 (9th Cir. 2005) (“With a 12(b)(1) motion, a court may weigh the 7 evidence to determine whether it has jurisdiction.”). The burden of proof is on the party 8 asserting jurisdiction to show that the court has subject matter jurisdiction. See Indus. 9 Tectonics, Inc. v. Aero Alloy, 912 F.2d 1090, 1092 (9th Cir. 1990). 10 B. Failure to State a Claim for Relief 11 Rule 12(b)(6) is designed to “test[] the legal sufficiency of a claim.” Navarro v. 12 Block, 250 F.3d 729, 732 (9th Cir. 2001). A dismissal under Rule 12(b)(6) for failure to 13 state a claim can be based on either: (1) the lack of a cognizable legal theory; or (2) the 14 absence of sufficient factual allegations to support a cognizable legal theory. Balistreri v. 15 Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). When analyzing a complaint for 16 failure to state a claim, the well-pled factual allegations are taken as true and construed in 17 the light most favorable to the nonmoving party. Cousins v. Lockyer, 568 F.3d 1063, 1067 18 (9th Cir. 2009). A plaintiff must allege “enough facts to state a claim to relief that is 19 plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has 20 facial plausibility when the plaintiff pleads factual content that allows the court to draw the 21 reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. 22 Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556). “The plausibility 23 standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer 24 possibility that a defendant has acted unlawfully.” Id. 25 “While a complaint attacked by a Rule 12(b)(6) motion does not need detailed 26 factual allegations, a plaintiff’s obligation to provide the grounds of his entitlement to relief 27 requires more than labels and conclusions, and a formulaic recitation of the elements of a 28 cause of action will not do.” Twombly, 550 U.S. at 555 (cleaned up and citations omitted). 1 Legal conclusions couched as factual allegations are not entitled to the assumption of truth 2 and therefore are insufficient to defeat a motion to dismiss for failure to state a claim. Iqbal, 3 556 U.S. at 679–80. However, “a well-pleaded complaint may proceed even if it strikes a 4 savvy judge that actual proof of those facts is improbable, and that ‘recovery is very remote 5 and unlikely.’” Twombly, 550 U.S. at 556 (quoting Scheuer v. Rhodes, 416 U.S. 232, 236 6 (1974)). 7 III. ANALYSIS 8 A. Standing 9 Defendant first argues Plaintiffs’ claims should be dismissed under Rule 12(b)(1) 10 for lack of standing. Article III courts are limited to deciding “cases” and “controversies.” 11 U.S. Const. art. III, § 2. Article III of the Constitution requires that one have “the core 12 component of standing.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). To have 13 standing under Article III, a plaintiff must show: (1) an injury in fact that is (a) concrete 14 and particularized and (b) actual or imminent; (2) the injury is fairly traceable to the 15 challenged action of the defendant; and (3) it is likely, not merely speculative, that the 16 injury will be redressed by decision in the plaintiff’s favor. Maya v. Centex Corp., 658 F.3d 17 1060, 1067 (9th Cir. 2011). A complaint that fails to allege facts sufficient to establish 18 standing requires dismissal for lack of subject matter jurisdiction under Rule 12(b)(1). See, 19 e.g., Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1123 (9th Cir. 2010). 20 To establish an injury in fact, “a plaintiff must show that he or she suffered an 21 invasion of a legally protected interest that is concrete and particularized and actual or 22 imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339–40 23 (2016) (citation and quotation marks omitted). A “concrete” and “particularized” injury 24 must be “real,” not “abstract,” id., and “must affect the plaintiff in a personal and individual 25 way.” Lujan, 504 U.S. at 560 n.1. To be “actual or imminent,” a threatened injury must be 26 “certainly impending”— “allegations of possible future injury are not sufficient.” Clapper 27 v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (cleaned up). 28 1 Here, Defendant claims Plaintiffs have not alleged any injuries. Plaintiff Quinalty, 2 however, alleges phones were fraudulently purchased using his PII as a result of the 3 breach.1 Plaintiff Quinalty further alleges he purchased credit monitoring services as a 4 result of the breach. This plausibly constitutes a cognizable injury by way of a reasonable 5 expenditure for harm Plaintiff Quinalty allegedly suffered from the breach. See In re 6 Banner Health Data Breach Litig., No. CV-16-02696-PHX-SRB, 2017 WL 6763548, at 7 *8 (D. Ariz. Dec. 20, 2017) (“A person whose legally protected interests have been 8 endangered by the tortious conduct of another is entitled to recover for expenditures 9 reasonably made or harm suffered in a reasonable effort to avert the harm threatened.” 10 (internal citation omitted)). Accordingly, Plaintiff Quinalty alleges sufficient facts to 11 establish standing. 12 Additionally, Plaintiff Motta alleges she suffered emotional distress because of the 13 data breach. (Am. Compl. ¶ 82.) Specifically, Plaintiff Motta alleges she experienced 14 anxiety and remains “very concerned” about identity theft and fraud. (Am. Compl. ¶ 82.) 15 Emotional distress is a sufficiently concrete injury to establish standing. Goz v. Allied 16 Collection Servs., Inc., 812 F. App’x 544, 545 (9th Cir. 2020). 17 Plaintiff Motta further alleges she is exposed to the future harm that her PII will be 18 disclosed to unauthorized parties and that she could suffer identity theft. (Am. Compl. 19 ¶¶ 82, 89.) To establish a future harm as concrete, the exposure to the risk of future harm 20 must cause a separate concrete harm itself. TransUnion LLC v. Ramirez, 594 U.S. 413, 436 21 (2021); Clemens v. ExecuPharm Inc., 48 F.4th 146, 155 (3d Cir. 2022). For example, the 22 Clemens court held that if a plaintiff’s knowledge of the substantial risk of identity theft 23 causes her to presently experience emotional distress, then the plaintiff has alleged a 24 concrete injury. Id. at 156. Here, Plaintiff Motta alleges the data breach exposed her to the 25 future risk of identity theft. She further alleges the exposure to the future risk of identity 26 27 1 Although Defendant contends that one of the alleged fraudulent purchases 28 occurred before Defendant had possession of Plaintiff Quinalty’s data, Defendant does not dispute that the other alleged fraudulent purchase occurred after Defendant had possession. 1 theft caused her emotional distress. Therefore, Plaintiff Motta’s alleged exposure to the 2 future risk of identity theft is a sufficient injury in fact to establish standing. 3 Plaintiffs allege the Class, however, has a common injury because their data was 4 included in the breach. (Am. Compl. ¶ 123) (“Plaintiffs’ claims are typical of the claims of 5 other members of the Class in that Plaintiffs like every member of the class had their PII 6 compromised in the Defendant’s Data Breach.”). Exposure to the breach alone is not a 7 sufficiently concrete injury to establish standing. Namely, unlike the unique injuries pled 8 by Plaintiff Quinalty and Plaintiff Motta, Plaintiffs allege the Class only suffered harm 9 because their data was subject to the breach. Plaintiffs do not allege the Class suffered 10 actual identity theft, suffered emotional distress because of the risk of identity theft, or 11 incurred out-of-pocket expenses because of the breach. Therefore, Plaintiffs have not 12 alleged sufficient facts to establish standing for the Class. 13 Accordingly, under Rule 12(b)(1), the Court grants Defendant’s Motion to Dismiss 14 only as to the Class. 15 B. Negligence 16 1. Duty and Breach 17 Defendant first argues Plaintiffs fail to adequately plead duty and breach. Defendant 18 specifically argues Plaintiffs fail to allege a relationship that creates a duty because 19 Plaintiffs were not Defendant’s direct customers. (MTD at 9-10.) Plaintiffs, however, argue 20 Defendant had a duty to use reasonable means to secure its systems and networks because 21 Defendant undertook the responsibility to maintain and secure their PII. (Resp. at 10-11.) 22 Plaintiffs further argue that public policy, through 15 U.S.C. § 45, establishes a duty of 23 care. (Resp. at 10-11.) 24 In Arizona, several special relationships can give rise to a duty, including 25 relationships based on contract, familial relations, or conduct undertaken by the defendant. 26 Stanley v. McCarver, 92 P.3d 849, 853 (Ariz. 2004). However, liability based on such an 27 undertaking requires that the defendant undertook conduct directly with or for the plaintiff. 28 1 Cal-Am Props. v. Edais Eng’g Inc., 509 P.3d 386, 390 (Ariz. 2022) (citing McCarver, 2 92 P.3d at 853). 3 Here, Plaintiffs allege Defendant obtained Plaintiffs’ PII from the banks and 4 financial institutions that Defendant services. (Am. Compl. ¶ 2.) Plaintiffs do not allege, 5 however, that Defendant obtained PII directly from Plaintiffs, or for Plaintiffs’ benefit. 6 Therefore, a duty does not arise based solely on Defendant obtaining Plaintiffs’ PII from 7 financial institutions. 8 Additionally, Arizona generally follows the Restatement (Second) of Torts §§ 323 9 and 324A, which provide in part that one who undertakes gratuitously or for consideration, 10 to render services to another which he should recognize as necessary for the protection of 11 the other’s person or things, or a third person or his things, can be subject to liability for 12 physical harm resulting from his failure to exercise reasonable care to perform his 13 undertaking. Guerra v. State, 348 P.3d 423, 425 (Ariz. 2015). The requirement of physical 14 harm for liability based on negligent undertaking was affirmed by the Arizona Supreme 15 Court in Cal-Am Props. 509 P.3d at 391. (“We decline to extend § 324A’s reach beyond 16 what it expressly contemplates: liability for physical harm to the people or property that 17 the services sought to protect.”). Here, Plaintiffs do not allege any physical harm. A duty 18 to Plaintiffs thus does not arise based on a negligent performance of an undertaking as 19 defined in the Restatement. 20 Further, public policy, through state and federal statutes, can be a source of duty. 21 Cal-Am Props., 509 P.3d at 390. Plaintiffs rely on 15 U.S.C. § 45, which recites that 22 “[u]nfair methods of competition in or affecting commerce, and unfair or deceptive acts or 23 practices in or affecting commerce, are hereby declared unlawful.” 15 U.S.C. § 45(a)(1). 24 Plaintiffs then argue Defendant breached its duty by failing to provide fair computer 25 systems and data security practices to safeguard Plaintiffs’ PII. (Resp. at 11.) Yet, assuming 26 15 U.S.C. § 45 creates a duty, Plaintiffs do not allege any facts explaining how or why 27 Defendant’s data security practices were unfair or deceptive. Although Plaintiffs allege 28 1 Defendant failed to comply with industry standards, Plaintiffs do not plead any industry 2 standards. 3 Ultimately, Plaintiffs’ broad characterization of Defendant’s conduct as unfair or 4 deceptive is conclusory. Therefore, even if 15 U.S.C. § 45 creates a duty, Plaintiffs fail to 5 allege sufficient facts from which the Court could infer Defendant breached a duty. 6 Accordingly, Plaintiffs fail to plead facts sufficient to establish duty and breach in 7 their negligence claim. 8 2. Damages 9 Defendant further argues Plaintiffs fail to allege sufficient damages. The Court 10 disagrees as to Plaintiff Quinalty but agrees that Plaintiff Motta does not sufficiently plead 11 damages. 12 Negligence damages must be actual and appreciable, non-speculative, and more 13 than merely the threat of future harm. CDT, Inc. v. Addison, Roberts & Ludwig, 7 P.3d 979, 14 982–83 (Ariz. Ct. App. 2000). Plaintiff Motta alleges damages of time spent responding to 15 the data breach, a diminution in the value of her PII, the likely theft of her PII, imminent 16 and impending injury arising from the increased risk of identity theft and fraud, and 17 emotional distress as a result of the breach. (Am. Compl. ¶ 81.) 18 Generally, lost time alone will not be cognizable as damages. Pruchnicki v. Envision 19 Healthcare Corp., 439 F. Supp. 3d 1226, 1233 (D. Nev. 2020) (“[T]he court finds that 20 tangible, out-of-pocket expenses are required in order for lost time spent monitoring credit 21 to be cognizable as damages.”); Plaintiffs v. MGM Resorts Int’l, 638 F. Supp. 3d 1175, 22 1192 (D. Nev. 2022) (“Lost time alone does not establish compensable damages.”); Griffey 23 v. Magellan Health Inc., 562 F. Supp. 3d 34, 45 (D. Ariz. 2021). Here, Plaintiff Motta does 24 not allege out-of-pocket expenses, or any other tangible harm that supplements her 25 allegation of lost time. Therefore, Plaintiff Motta’s allegation of lost time is insufficient to 26 establish damages. 27 A plaintiff can establish the diminished value of PII as a cognizable injury if the 28 plaintiff shows a “robust market” for the PII and that the plaintiff has been deprived of the 1 ability to sell personal data on the market. Svenson v. Google Inc., No. 13-cv-04080-BLF, 2 2015 WL 1503429, at 5* (N.D. Cal. Apr. 1, 2015) (citing In re Facebook Privacy Litig., 3 572 Fed. App’x 494 (9th Cir. 2014)). Here, Plaintiffs allege stolen PII is one of the most 4 valuable commodities on the “criminal information black market.” (Am. Compl. ¶ 90.) 5 Plaintiff Motta, however, does not allege she can no longer sell her personal data on the 6 market, nor does she allege she ever has, intends to, or intended to, sell her personal data. 7 Further, Plaintiffs do not allege any market for their PII other than the “black market.” See 8 Griffey, 562 F. Supp. 3d at 46 (“This Court declines to recognize the ‘dark web’ as a 9 legitimate market by which individuals may sell their information.”). Therefore, Plaintiff 10 Motta’s allegation of diminished PII value is insufficient to establish damages. 11 Also, threats of future harm, such as the likely theft of PII, and imminent and 12 impending injury arising from the increased risk of identity theft and fraud, are not 13 cognizable harms on their own. Griffey, 562 F. Supp. 3d at 46. Plaintiff Motta does not 14 allege that her PII has been stolen, that her identity has been stolen, or that she has 15 experienced identity fraud. Therefore, Plaintiff Motta’s allegations that theft of her PII is 16 likely, and that she is at an increased risk of identity theft and fraud, are insufficient to 17 establish damages. 18 Concerning Plaintiff Motta’s alleged emotional distress, Arizona applies the “zone 19 of danger” test to determine whether damages for negligent infliction of emotional distress 20 are proper. Rodriguez v. Fox News Network, L.L.C., 356 P.3d 322, 325 (Ariz. Ct. App. 21 2015). Such a claim requires the plaintiff to prove that he or she “witnessed an injury to a 22 closely related person, suffered mental anguish manifested as physical injury, and was 23 within the zone of danger so as to be subjected to an unreasonable risk of bodily harm 24 created by the defendant.” Id. Plaintiff Motta does not allege any exposure to physical 25 injury, or any risk of bodily harm created by Defendant. Therefore, Plaintiff Motta’s 26 allegation of emotional distress resulting from the data breach fails to establish damages. 27 Accordingly, the Court grants Defendant’s Motion to Dismiss as to Plaintiff 28 Quinalty’s negligence claim because he fails to adequately allege duty and breach. The 1 Court also grants Defendant’s motion as to Plaintiff Motta’s negligence claim because she 2 fails to adequately allege duty and breach and further fails to adequately allege damages. 3 C. Unjust Enrichment 4 Next, Defendant argues Plaintiffs have not stated an unjust enrichment claim 5 because the facts pled do not plausibly imply an unjust enrichment on Defendant’s part or 6 an impoverishment on their part. (MTD at 13.) Under Arizona law, “[u]njust enrichment 7 occurs when one party has and retains money or benefits that in justice and equity belong 8 to another.” Loiselle v. Cosas Mgmt. Group, LLC, 228 P.3d 943, 946 (Ariz. Ct. App. 2010). 9 To plead an unjust enrichment claim, a party must allege: “(1) an enrichment, (2) an 10 impoverishment, (3) a connection between the enrichment and the impoverishment, (4) the 11 absence of justification for the enrichment and the impoverishment, and (5) the absence of 12 a remedy provided at law.” Span v. Maricopa Cnty. Treasurer, 437 P.3d 881, 886 (Ariz. 13 Ct. App. 2019). 14 Here, Plaintiffs allege they were impoverished because they received unreasonable 15 data security from Defendant. (Am. Compl. ¶¶ 160-62.) Plaintiffs specifically argue the 16 data security received was unreasonable because Defendant’s security system was defeated 17 by a phishing scam, credentials of one of Defendant’s employees were available on the 18 dark web, and Defendant had to rely on a third party to identify the breach. (Resp. at 14.) 19 This is conclusory, however. Namely, allegations that Defendant’s system was defeated by 20 a phishing scam and that an employee’s data was on the dark web only indicate that the 21 data breach happened, not that the data security Plaintiffs received was unreasonable. 22 Additionally, Plaintiffs’ allegation that a third party notified Defendant of the breach 23 establishes that a third party identified the breach before Defendant, but not that 24 Defendant’s security was unreasonable. Plaintiffs also allege Defendant failed to comply 25 with industry standards, but do not indicate which industry standards were allegedly 26 violated, or how Defendant failed to comply. See Feins v. Goldwater Bank NA, No. CV- 27 22-00932-PHX-JJT, 2022 WL 17552440, at *7 (D. Ariz. Dec. 9, 2022). 28 1 Accordingly, Plaintiffs fail to adequately plead unjust enrichment because 2 Plaintiffs’ conclusory statements that they received unreasonable data security are 3 insufficient to establish impoverishment. Therefore, Defendant’s motion to dismiss is 4 granted as to Plaintiffs’ claim for unjust enrichment. 5 D. Arizona Consumer Fraud Act 6 Defendant further alleges Plaintiffs fail to establish a claim for violation of the 7 Arizona Consumer Fraud Act, A.R.S. § 44-1521 et seq. (MTD 14-16.) To succeed on a 8 claim of consumer fraud, a plaintiff must show “1) a false promise or misrepresentation 9 made in connection with the sale or advertisement of “merchandise,” and 2) consequent 10 and proximate injury resulting from the misrepresentation.” Watts v. Medicis Pharm. 11 Corp., 365 P.3d 944, 953 (Ariz. 2016). “[T]he overwhelming authority in Arizona 12 specifically requires proof of actual reliance.” Stratton v. Am. Med. Sec., Inc., 266 F.R.D. 13 340, 349 (D. Ariz. 2009). 14 Here, Plaintiffs allege they “relied on the affirmatively misrepresented and 15 concealed facts and incurred damages as a consequent and proximate result.” (Am. Compl. 16 ¶ 174.) Plaintiffs, however, fail to allege any facts indicating they were aware of 17 Defendant’s contracts, website, privacy policy, or advertising at the time they provided 18 their PII to Defendant’s clients. Therefore, the claim under the Arizona Consumer Fraud 19 Act must fail. 20 IV. CONCLUSION 21 Plaintiff Quinalty and Plaintiff Motta have alleged sufficient injuries to establish 22 standing on behalf of themselves but have failed to allege sufficient injuries to establish 23 standing on behalf of the Class. Also, Plaintiffs fail to state facts that plausibly show 24 independent claims for negligence, unjust enrichment, or violation of the Arizona 25 Consumer Fraud Act. But if a defective complaint can be cured, a plaintiff is entitled to 26 amend the complaint before it is dismissed. See Lopez v. Smith, 203 F.3d 1122, 1127–30 27 (9th Cir. 2000). Because it is possible that Plaintiffs could allege facts to adequately plead 28 their claims or establish standing for the Class, the Court grants leave to file a Second 1 || Amended Complaint. See id. If any such amendment fails to cure the defects in Plaintiffs’ claims, the Court will dismiss that portion of the Second Amended Complaint with || prejudice. 4 IT IS THEREFORE ORDERED granting Defendant’s Motion to Dismiss || Plaintiffs’ Amended Complaint (Doc. 27). 6 IT IS FURTHER ORDERED granting Plaintiffs leave to amend their complaint, || should they wish to do so. Plaintiffs shall file any Second Amended Complaint no later 8 || than 21 days from the date of this Order. 9 Dated this 30th day of January, 2024. CN

11 efholee— Unifgd State#District Judge 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

-12-