Burns v. Mammoth Media, Inc., CV 20-04855 DDP (SKx)

CONNOR BURNS, Plaintiff, v. MAMMOTH MEDIA, INC., Defendants.

No. CV 20-04855 DDP (SKx)

United States District Court, C.D. California

August 6, 2021

ORDER GRANTING DEFENDANT'S MOTION TO DISMISS [DKT. 19]

DEAN D. PREGERSON UNITED STATES DISTRICT JUDGE.

Presently before the court is Defendant Mammoth Media, Inc. (“Mammoth”)'s Motion to Dismiss. Having considered the submissions of the parties and heard oral argument, the court grants the motion and adopts the following Order.

I. Background

Plaintiff Connor Burns, a citizen of Idaho, downloaded Mammoth's mobile “Wishbone” application (“app”) when he was fourteen years old. (First Amended Complaint (“FAC”) ¶ 2.) To use the app, Plaintiff was required to create an account, select a username and password, and provide his e-mail address. (Id.). Plaintiff deleted the app soon after downloading it, but did not delete his account. (FAC ¶ 3.)

Four years later, Mammoth informed Plaintiff that it had suffered a data breach, and that Wishbone users' “usernames emails, phone numbers, timezone/region, full name, bio gender, hashed [i.e., encrypted, ] passwords, and profile pictures” may have been compromised. (FAC ¶ 4.) Plaintiff also alleges that Mammoth collected and maintained other types of user data that were also compromised, including date of birth, location information, user settings, social media profiles, and “access tokens.” (Id. ¶¶ 15, 25.) Plaintiff further alleges that data pertaining to 40 million Wishbone users was circulated for sale on the dark web, and ultimately released for free. (Id. ¶ 22.)

Plaintiff alleges that, following the Wishbone data breach, his Spotify and Reddit accounts were compromised, forcing him to change his passwords. (FAC ¶¶ 57-58.) Plaintiff also began receiving spam e-mails. (Id.) Plaintiff spent about three hours changing other online passwords, setting up fraud alerts, and reviewing his bank accounts for fraudulent transactions. (Id. ¶ 58.) Plaintiff alleges that the theft of his data will result in identity theft and fraud, lowered credit scores resulting from fraudulent activity, loss of access to online and financial accounts, and the loss of time and enjoyment stemming from efforts to mitigate or prevent identity theft. (Id. ¶ 64.)

The FAC alleges, on behalf of a putative class, five causes of action for negligence, declaratory judgment, breach of confidence, violation of California's Unfair Competition Law (Cal. Bus. & Prof. Code ¶¶ 17220, et seq.), and violations of “data breach statutes” of thirty-eight different states. Defendant Mammoth now seeks to dismiss the FAC pursuant to Federal Rule of Procedure 12(b)(1) and Rule 12(b)(6).

II. Legal Standard

A motion under Rule 12(b)(1) may challenge the court's jurisdiction facially, based on the legal sufficiency of the claim, or factually, based on the legal sufficiency of the jurisdictional facts. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000)(citing 2 James Wm. Moore et al., Moore's Federal Practice 12.30[4], at 12-38 to 12-41 (3d ed.1999)). Where the motion attacks the complaint on its face, the court considers the complaint's allegations to be true, and draws all reasonable inferences in the plaintiff's favor. Doe v. Holy See, 557 F.3d 1066, 1073 (9th Cir. 2009). In a factual challenge, the court is not required to accept the allegations of the complaint as true and may consider additional evidence outside of the pleadings. Maya v. Centex Corp., 658 F.3d 1060, 1067 (9th Cir. 2011). Once the moving party has presented evidence showing a lack of subject-matter jurisdiction, the burden shifts to “the party opposing the motion [to] furnish affidavits or other evidence necessary to satisfy its burden of establishing subject matter jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). If the plaintiff cannot meet its burden of establishing the jurisdiction it seeks to invoke, the court must dismiss the case. Fed.R.Civ.P. 12(h)(3).

When considering a Rule 12(b)(6) motion, a court must “accept as true all allegations of material fact and must construe those facts in the light most favorable to the plaintiff.” Resnick v. Hayes, 213 F.3d 443, 447 (9th Cir. 2000). A complaint will survive a motion to dismiss when it “contain[s] sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009)(quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Although a complaint need not include “detailed factual allegations, ” it must offer “more than an unadorned, the-defendant-unlawfully-harmed-me accusation.” Iqbal, 556 U.S. at 678. Conclusory allegations or allegations that are no more than a statement of a legal conclusion “are not entitled to the assumption of truth.” Id. at 679. In other words, a pleading that merely offers “labels and conclusions, ” a “formulaic recitation of the elements, ” or “naked assertions” will not be sufficient to state a claim upon which relief can be granted. Id. at 678 (citations and internal quotation marks omitted).

“When there are well-pleaded factual allegations, a court should assume their veracity and then determine whether they plausibly give rise to an entitlement of relief.” Iqbal, 556 U.S. at 679. Plaintiffs must allege “plausible grounds to infer” that their claims rise “above the speculative level.” Twombly, 550 U.S. at 555-56. “Determining whether a complaint states a plausible claim for relief” is “a context-specific task that requires the reviewing court to draw on its judicial experience and common sense.” Iqbal, 556 U.S. at 679.

III. Discussion

A party invoking federal jurisdiction bears the burden of demonstrating that he has Article III standing. Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992). To meet that burden, “a plaintiff must show (1) it has suffered an ‘injury in fact' that is. . . actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the challenged action of the defendant; and (3) it is likely, as opposed to merely speculative, that the injury will be redressed by a favorable decision. Friends of the Earth, Inc. v. Laidlaw Env't Servs. (TOC), Inc., 528 U.S. 167, 181 (2000). “Rule 12(b)(1) jurisdictional attacks can be either facial or factual.” White, 227 F.3d at 1242. “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air, 373 F.3d 1035 at 1039. The distinction is important. When considering a facial attack, the court considers all factual allegations to be true and draws all inferences in favor of the plaintiff. Doe, 557 F.3d at 1073. “In resolving a factual attack on jurisdiction, [however], the district court may review evidence beyond the complaint without converting the motion to dismiss into a motion for summary judgment.” Safe Air, 373 F.3d at 1039.

Here, although Mammoth's factual and facial challenges are interwoven to some extent, Mammoth clearly asserts a factual challenge to Plaintiff's standing. (E.g., Memorandum in Support of Motion at 1:20-21 (“Mammoth asserts both a facial and factual attack . . .), 6:24-25 (“Mammoth makes both a facial and a factual challenge here.”) A party making a factual challenge under Rule 12(b)(1) must present affidavits or other evidence. Savage v. Glendale Union High Sch., Dist. No. 205, Maricopa Cty., 343 F.3d 1036, 1039 n.2 (9th Cir. 2003) (citing St. Clair v. City of Chico, 880 F.2d 199, 201 (9th Cir. 1989)). Mammoth supports its factual challenge with the Declaration of Brian DeBoer, Mammoth's Chief Technology Officer. DeBoer states that Plaintiff's compromised information includes “his name, his username for the Wishbone app, his email address, a record of the date he created his Wishbone profile, his gender, the user ID number that Mammoth assigned to him, his encrypted password, his Mammoth assigned access token, an authorization token, a Facebook ID, a url to an image, country, time zone, Apple idfa, stickers left, and the date last updated.” (DeBoer Decl. ¶ 6.) DeBoer further states that Plaintiff's compromised information did not include his birth date, address, social security number, or any financial information. (Id. ¶ 7.) And, critically, DeBoer's declaration states that the nature of Plaintiff's information is such that it cannot be used to access Spotify, Reddit, or any other account.^[1] (Id. ¶¶ 9-14.)

Rather than address these facts directly, Plaintiff contends that the DeBoer declaration is not sufficient to raise a factual challenge because it does not cast doubt on the veracity of any of Plaintiff's allegations. (Response at 4:19-24.) Plaintiff's FAC, however, is premised largely on the allegation that “[a]s a result of Mammoth's failure to protect the [information] it was entrusted with, Plaintiff and class members have been exposed to and/or are at a significant risk of identity theft, financial fraud, and other identity-related fraud into the indefinite future.” (FAC ¶ 8.) The FAC goes on to allege a host of other harms flowing from the data breach, including expenses associated with credit monitoring and protection services, the loss of access to online accounts, lowered credit scores, and loss of time and enjoyment related to mitigation efforts in the wake of fraud and identity theft. (FAC ¶ 64.)^[2] These allegations are impossible to square with DeBoer's declaration that Plaintiff's compromised information is essentially useless. If, as DeBoer's declaration suggests, Plaintiff's allegations as to the likelihood of identity theft and fraud are...