Yuille v. Uphold HQ Inc.

686 F.Supp.3d 323

Bruce YUILLE, Plaintiff, v. UPHOLD HQ INC., Defendant.

22-cv-7453 (LJL)

United States District Court, S.D. New York

Signed August 11, 2023

Brian Levin, Levin Law P.A., Miami, FL, Jeffrey Brett Kaplan, Dimond Kaplan & Rothstein, P.A., Miami, FL, Thomas Michael Kenny, Spiro Harrison & Nelson, Montclair, NJ, for Plaintiff.

Benjamin Delalio Bianco, Caitlin R. Trow, Meister Seelig & Fein LLP, New York, NY, for Defendant.

OPINION AND ORDER

LEWIS J. LIMAN, United States District Judge:

Defendant Uphold HQ Inc. ("Defendant" or "Uphold") moves, pursuant to Federal Rule of Civil Procedure 12(b)(6), to dismiss the first, second, third, fourth, sixth, and seventh causes of action of the complaint of plaintiff Bruce Yuille ("Plaintiff" or "Yuille") for failure to state a claim upon which relief can be granted. Dkt. No. 18. For the following reasons, the partial motion to dismiss is granted in part and denied in part.

BACKGROUND

For purposes of this motion, the Court accepts as true the well-pleaded allegations of the complaint, Dkt. No. 3 ("Complaint" or "Compl."), as supplemented by the documents incorporated by reference.

Plaintiff is a 77-year-old retired individual who lives in Clarkston, Oakland County, Michigan. Id. ¶¶ 9, 22. Uphold is a "cryptocurrency exchange and digital money platform" that allows its 1.7 million customers to transfer, purchase, trade, hold, and sell cryptocurrency, equities, precious metals, and fiat currency. Id. ¶¶ 2, 9, 15, 75. Uphold permits its users to convert and process transactions between these various asset classes, offering a "unique 'Anything-to-Anything' trading experience." Id. ¶ 16 (citation omitted). Uphold, whose principal place of business is New York, New York, has processed nearly $6 billion in transactions since its inception. Id. ¶¶ 2, 9, 72.

The allegations in the Complaint focus on an account that Yuille opened at Uphold in August 2021. Id. ¶¶ 22, 24. In or around July 2021, Yuille began to look for a secure cryptocurrency exchange to hold his Bitcoin assets. Id. ¶ 21. The Complaint alleges that Yuille was drawn to Uphold's account in large part because of Uphold's focus on security. See id. ¶¶ 21, 23. Uphold has also made several representations about its efforts to safeguard customer accounts. On its website, Uphold asserts that "[s]ecurity is in our DNA. Our number one priority is to protect you, your money, and your information. Security is built into our systems and culture." Id. ¶¶ 3, 19 (citation omitted). Additionally, Plaintiff alleges that Uphold has made the following representations related to its account security.

• "[O]ur Information Security and Personal Information protection programs . . . are designed to meet or exceed regulatory requirements, establish the highest levels of trust with our members, and prevent bad actors from taking advantage of our systems, members, employees, or brand."

• "We deploy layered defenses to limit the scope and depth of potential attacks, as well as sophisticated encryption."

• "Security professionals routinely conduct security audits and penetration testing of our systems."

• "Bug Bounty Program - to encourage reporting of security vulnerabilities on the platform."

• "The Uphold Security Operations Centre monitors systems year-round and responds immediately to any detected threat."

• "All our providers undergo appropriate due diligence checks. Special attention is paid to integrations incorporating sensitive data."

• "The Uphold team are background checked by an accredited vendor. Mandatory security and privacy training is conducted regularly."

• "We'll [ ] do email verification if we detect anything untoward. If we detect unusual activity, we'll send you an email to verify it is you."

• "Uphold is a pioneer in our space when it comes to the security of our consumers: we are one of the first companies working with digital currencies to become certified to PCI/DSS [the Payment Card Industry Security Standards Council], one of the most stringent security standards in the industry. Being compliant means that we are doing our very best to keep our members' valuable information secure and out of the hands of people who could use that data in a fraudulent way."

Id. ¶ 20 (emphasis in original) (cleaned up). Yuille chose to open an account (the "Account") with Uphold and have his Bitcoin transferred into the account "because of [Uphold's] representations of account security, superlative customer service, [its] purported secure multifactor authentication, and the fact that Uphold claimed to monitor its platform for security threats 24 hours a day and every day of the year." Id. ¶ 21; see also id. ¶ 23 ("Yuille trusted and relied on Uphold's representations that his assets would be safe with Uphold."). According to Yuille's representations to Uphold on August 23, 2021, the purposes of the Account were (1) "to hold BTC," (2) "to sell [BTC] and reduce [BTC] to dollars and transfer dollars to his bank," and (3) "to trade crypto coins like those listed on Uphold." Id. ¶ 7. In August 2021, Yuille deposited 106 Bitcoin into the Account. Id. ¶ 24.

Uphold allegedly did not live up to its representations about its security; within four months of the date when Yuille opened the Account, unauthorized users siphoned approximately 100 Bitcoin from the Account, worth roughly $5 million at the time. Id. ¶¶ 1, 45, 54. The events in question began on December 7, 2021 at 8:01 p.m., when a third party based in Nigeria attempted to log into the Account. Id. ¶ 47. That attempt failed, but between December 7 and December 9, an unauthorized third party tried and failed to change the password associated with Yuille's Account on five separate occasions. Id. ¶¶ 46-47. On December 9, 2021 at 10:48 a.m., an unauthorized party successfully took over Yuille's Account, without Yuille's permission or knowledge, changing his password and then eight minutes later, changing the e-mail associated with the Account. Id. ¶¶ 48-49. The Complaint also alleges that Uphold may have permitted the two-factor authentication of the Account to be turned off, modified, or accessed without Yuille's permission. Id. ¶ 33.

That same day, Yuille attempted to log into his account on three separate occasions but was unable to do so. Id. ¶ 50. At 4:41 p.m., Yuille sent an email to Uphold indicating that he was locked out of his account, which he had previously used on December 7 to sell 0.5 Bitcoin and that he was unable to reset his password despite trying three times. Id. ¶ 51. Yuille requested Uphold's help. Id. Uphold's customer service representative responded, not by recognizing that Yuille's Account had been hacked and freezing the Account, but by recommending that Yuille check his spam folder for the password verification emails. Id. ¶ 52. Beginning approximately eight hours after Yuille emailed Uphold and continuing until 5:00 p.m. on December 11, 2021, approximately $5 million of Bitcoin was transferred out of the Account. Id. ¶ 54. The Complaint alleges that had Uphold locked and restricted access or transfers out of Yuille's account, Yuille would still have access to his Bitcoin. Id. ¶ 56.

The Complaint also alleges that Uphold was on notice of the risk of cyberattacks, hacking, and improper transfers and did not adequately address these risks. Id. ¶ 26. The Complaint cites to Uphold's website, where Uphold acknowledged that there was an increase of fifty times in the activity of "scammers and bad actors" and that its customer service was inadequate to deal with the threats. Id. ¶¶ 28-29. To address this increased activity, Uphold took various steps to improve its customer service response times, including decreasing the number of situations in which Uphold would restrict access to customers' accounts by almost 50%, permitting individuals to change an email address and two-factor authentication through their account instead of through a customer service specialist, and permitting customers to correct account information without risk of account restriction. Id. ¶ 30. These measures may have improved Uphold's customer service response times, but they weakened its account security by reducing the situations in which Uphold would restrict account access and increasing the ability of customers to make changes without the support of customer service. Id. ¶ 32.

Plaintiff alleges that Uphold has a duty to protect its customers' assets and to protect accounts on its platform, but that Uphold failed to discharge its duties, resulting in the withdrawal of $5 million of Bitcoin from the Account without Yuille's authorization. Id. ¶ 57. Specifically, the Complaint alleges that "Uphold failed to provide reasonable and appropriate security to prevent unauthorized access to its customer's account and [Bitcoin] wallet, and the assets stored therein" by, among other things, (1) misrepresenting "the safety and security of" its accounts; (2) failing "to adequately safeguard and protect" the accounts; (3) failing "to use readily available security measures to prevent or limit unauthorized access to customer accounts and to prevent unauthorized transactions from occurring on those accounts"; (4) failing "to suspend user credential after a certain number of unsuccessful access attempts"; (5) lacking appropriate monitoring solutions and failing to monitor accounts for unauthorized access that would have enabled Uphold to detect the intrusion in the Account; (6) failing "to implement defenses to identify unauthorized third parties such as delaying transfers from accounts on which the password was recently changed or simply delaying transfers from accounts to allow for additional verifications from customers"; (7) failing "to implement reasonable means for customers to contact Uphold without undue delay after discovering account security issues"; (8) failing "to promptly act after being notified by a customer that they cannot access their account or suspect an account has been compromised,...