Riordan v. Western Digital Corporation

CourtDistrict Court, N.D. California
DecidedJune 5, 2024
Docket5:21-cv-06074
StatusUnknown

This text of Riordan v. Western Digital Corporation (Riordan v. Western Digital Corporation) is published on Counsel Stack Legal Research, covering District Court, N.D. California primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
Riordan v. Western Digital Corporation, (N.D. Cal. 2024).

Opinion

1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 SAN JOSE DIVISION 7 8 KEVIN RIORDAN, et al., Case No. 21-cv-06074-EJD

9 Plaintiffs, ORDER GRANTING DEFENDANT’S MOTION TO DISMISS CLAIMS 1, 3, & 10 v. 4 OF PLAINTIFFS’ SECOND AMENDED COMPLAINT 11 WESTERN DIGITAL CORPORATION, 12 Defendant. Re: ECF No. 62

13 14 Plaintiffs Kevin Riordan, Ashley Laurent, Jeremy Bobo, and Nagui Sorial (together, 15 “Plaintiffs”) bring this putative class action against Defendant Western Digital Corporation 16 (“Defendant” or “Western Digital”), a manufacturer of data storage devices, alleging that 17 Defendant failed to properly secure and safeguard information Plaintiffs stored on Defendant’s 18 devices. The operative Second Amended Complaint (“SAC”) asserts claims for (1) violation of 19 the Song-Beverly Consumer Warranty Act (the “Song-Beverly Act” or the “Act”), California Civil 20 Code §§ 1792, et seq.; (2) negligence / failure to warn; (3) violation of the California Unfair 21 Competition Law (“UCL”), California Business & Professions Code §§ 17200, et seq.; and (4) 22 unjust enrichment. See SAC ¶¶ 127–70, ECF No. 61. Now pending before the Court is 23 Defendant’s Motion to Dismiss Plaintiff’s Second Amended Complaint (the “Motion”), which 24 requests that the Court dismiss Plaintiffs’ first, third, and fourth claims, as well as any claims for 25 injunctive relief, without leave to amend. See Mot., ECF No. 62. The Court took the motion 26 under submission for decision without oral argument pursuant to Civil Local Rule 7-1(b). For the 27 reasons discussed herein, the Court GRANTS Defendant’s Motion without leave to amend. 1 I. BACKGROUND 2 A. Factual Allegations1 3 Western Digital is a “leading global data storage brand” incorporated in Delaware and 4 headquartered in San Jose, California. SAC ¶¶ 68, 71. It develops, manufactures, and provides 5 data storage devices, including the “My Book Live” and “My Book Live Duo” (the “Data Storage 6 Devices”). Id. ¶¶ 6–7. Plaintiffs are four individuals who reside in Tennessee (Mr. Riordan), 7 Minnesota (Mr. Laurent), and California (Mr. Bobo and Mr. Sorial). Id. ¶¶ 23, 34, 47, 56. 8 Plaintiffs all purchased and used at least one of the Data Storage Devices. Id. 9 Plaintiffs bring this class action against Western Digital for failure to properly secure and 10 safeguard Plaintiffs’ and proposed class members’ personal, commercial, and proprietary 11 information (the “Stored Data”) within the Data Storage Devices. SAC ¶ 2. The Data Storage 12 Devices were “configured to operate remotely and/or utilizing Defendant’s web portal for such 13 purposes,” id. ¶ 6, and Plaintiffs used the web portal to access their data remotely, id. ¶ 72. 14 Defendant marketed the web portal remote access as a key feature of the Data Storage Devices. 15 Id. ¶¶ 11, 86. Plaintiffs allege that each Data Storage Device had at least two security flaws—the 16 “2018 Vulnerability” and the “2021 Vulnerability”—in its software at the time of the cyber attack. 17 Id. ¶¶ 8, 18, 92. Plaintiffs further allege that the 2018 Vulnerability was listed on the National 18 Institute of Standards and Technology’s National Vulnerability Database on June 19, 2019, so that 19 Defendant knew or should have known of the 2018 vulnerability by at least this date. Id. ¶ 133. 20 Plaintiffs also allege that Defendant “created/caused the 2021 Vulnerability insofar as it was 21 Defendant that, much earlier than 2021, disabled at least five lines of code . . . that were intended 22 to prevent anyone lacking the [relevant] password(s) from accessing and/or performing a factory 23 reset” of a given Data Storage Device. SAC ¶ 89. 24 Due to the 2018 and 2021 Vulnerabilities, unauthorized persons accessed and deleted data 25 on Data Storage Devices beginning on June 23, 2021, and each Plaintiff lost personal and business 26

27 1 The following recitation is taken in large part from the Court’s order on Defendant’s motion to dismiss Plaintiffs’ First Amended Complaint (“FAC”). See ECF No. 59. 1 data in one or more cyber attacks. See id. ¶¶ 1, 9. The hackers performed factory resets on 2 Plaintiffs’ Data Storage Devices—thereby wiping Plaintiffs’ Stored Data from the devices—and 3 users were unable to log into their devices using their own credentials. SAC ¶ 95. Various 4 Plaintiffs have consulted unsuccessfully with numerous data recovery services. See, e.g., id. ¶ 67. 5 Defendant has offered to provide a data recovery service and device trade-in, but given the 6 hackers’ data wipe procedure, the recovery attempt would be largely ineffectual in reversing the 7 deletion of the Stored Data. Id. ¶¶ 102–04. Plaintiffs are unaware of whether their Stored Data 8 was merely deleted or whether the information is also in the hands of cyber criminals. Id. ¶ 100. 9 B. Procedural History 10 Plaintiffs filed this lawsuit on August 6, 2021. See Compl., ECF No. 1. Defendant 11 responded by moving to dismiss. See ECF No. 22. The Court granted the motion on the ground 12 that Plaintiffs had failed to plead facts sufficient to establish Article III standing. See ECF No. 34. 13 Plaintiffs then filed the First Amended Complaint (“FAC”), and the Court granted Defendant’s 14 subsequent motion to dismiss. See Order Granting in Part & Denying in Part Deft.’s Mot. to 15 Dismiss (“FAC Order”), ECF No. 59. Plaintiffs then filed the SAC in October 2023. See SAC. 16 Defendant filed the pending Motion, which was fully briefed in November 2023 and set for 17 hearing in January 2024. See Mot.; Opp’n, ECF No. 63; Reply, ECF No. 64. The Court took the 18 Motion under submission in January 2024. See ECF No. 65. 19 II. LEGAL STANDARDS 20 A. Subject Matter Jurisdiction 21 Federal courts are courts of limited jurisdiction. They “have only the power that is 22 authorized by Article III of the Constitution and the statutes enacted by Congress thereto.” Couch 23 v. Telescope Inc., 611 F.3d 629, 632 (9th Cir. 2010) (quoting Bender v. Williamsport Area Sch. 24 Dist., 475 U.S. 534, 541 (1986)). “Article III confines the federal judicial power to the resolution 25 of ‘Cases’ and ‘Controversies,’” meaning that the plaintiff must have “a ‘personal stake’ in the 26 case—in other words, standing.” TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021) (citation 27 omitted). To establish Article III standing, a plaintiff must show “(i) that he suffered an injury in 1 fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused 2 by the defendant; and (iii) that the injury would likely be redressed by judicial relief.” Id. (citing 3 Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992)). “[A] plaintiff must demonstrate 4 standing separately for each form of relief sought.” Friends of the Earth, Inc. v. Ladlaw Env’t 5 Servs. (TOC), Inc., 528 U.S. 167, 185 (2000) (citations omitted). 6 A party may assert a defense of lack of subject matter jurisdiction, including for Plaintiffs’ 7 lack of Article III standing, under Federal Rule of Civil Procedure 12(b)(1). A jurisdictional 8 attack may be “facial,” such that the defendant “asserts that the allegations contained in a 9 complaint are insufficient on their face to invoke federal jurisdiction.” Safe Air for Everyone v. 10 Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004).

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Bender v. Williamsport Area School District
475 U.S. 534 (Supreme Court, 1986)
Lujan v. Defenders of Wildlife
504 U.S. 555 (Supreme Court, 1992)
Bell Atlantic Corp. v. Twombly
550 U.S. 544 (Supreme Court, 2007)
Ashcroft v. Iqbal
556 U.S. 662 (Supreme Court, 2009)
Couch v. Telescope Inc.
611 F.3d 629 (Ninth Circuit, 2010)
Fayer v. Vaughn
649 F.3d 1061 (Ninth Circuit, 2011)
United States v. William R. Wilson
7 F.3d 828 (Ninth Circuit, 1993)
Manzarek v. St. Paul Fire & Marine Insurance
519 F.3d 1025 (Ninth Circuit, 2008)
Douglas Leite v. Crane Company
749 F.3d 1117 (Ninth Circuit, 2014)
Margie Daniel v. Ford Motor Company
806 F.3d 1217 (Ninth Circuit, 2015)
Robert Pepper v. Apple, Inc.
846 F.3d 313 (Ninth Circuit, 2017)
G and G Productions LLC v. Rita Rusic
902 F.3d 940 (Ninth Circuit, 2018)
TransUnion LLC v. Ramirez
594 U.S. 413 (Supreme Court, 2021)
Adams v. Johnson
355 F.3d 1179 (Ninth Circuit, 2004)
Safe Air for Everyone v. Meyer
373 F.3d 1035 (Ninth Circuit, 2004)

Cite This Page — Counsel Stack

Bluebook (online)
Riordan v. Western Digital Corporation, Counsel Stack Legal Research, https://law.counselstack.com/opinion/riordan-v-western-digital-corporation-cand-2024.