Quinalty v. FocusIT LLC

Filing 34

ORDER: IT IS ORDERED granting Defendant's Motion to Dismiss Plaintiffs' Amended Complaint (Doc. 27 ). IT IS FURTHER ORDERED granting Plaintiffs leave to amend their complaint, should they wish to do so. Plaintiffs shall file any Second Amended Complaint no later than 21 days from the date of this Order. (See attached Order). Signed by Judge John J Tuchi on 1/30/2024. (JAMA)

1

WO

2
3
4
5
6

IN THE UNITED STATES DISTRICT COURT

7

FOR THE DISTRICT OF ARIZONA

8
9

Joshua Quinalty, et al.,
Plaintiffs,

10
11

v.

12

FocusIT LLC,

13

No. CV-23-00207-PHX-JJT
ORDER

Defendant.

14
15

At issue is Defendant FocusIT LLC’s Motion to Dismiss Plaintiff’s Amended Class

16

Action Complaint and Motion to Strike Plaintiff’s Class Allegation (Doc. 27, MTD), to

17

which Plaintiffs Joshua Quinalty and Alene Motta filed a Response (Doc. 29, Resp.) and

18

Defendant filed a Reply (Doc. 30, Reply). The Court has reviewed the parties’ briefs and

19

finds this matter appropriate for decision without oral argument. See LRCiv 7.2(f). For the

20

reasons set forth below, the Court grants Defendant’s Motion to Dismiss and grants

21

Plaintiffs leave to file a Second Amended Complaint.

22

I.

BACKGROUND

23

In the Amended Class Action Complaint for Damages, Injunctive, and Equitable

24

Relief (Doc. 26, Am. Compl.), Plaintiffs allege the following facts. Plaintiff Quinalty and

25

Plaintiff Motta provided Personal Identifying Information (“PII”) to banks and financial

26

institutions. (Am. Compl. ¶¶ 2, 4.) Defendant is a third-party vendor that hosts mortgage

27

origination and loan processing software applications for the banks and financial institutions

28

to whom Plaintiff Quinalty and Plaintiff Motta provided their PII. (Am. Compl. ¶ 2.)

1

On June 1, 2022, Defendant’s system was compromised resulting in PII being

2

available to cybercriminals. (Am. Compl. ¶¶ 38-39.) The PII exposed included names,

3

dates of birth, addresses, and social security numbers of 147,799 individuals. (Am. Compl.

4

¶ 38.) Defendant became aware of the data breach on August 2, 2022, and began notifying

5

affected individuals on September 28, 2022. (Am. Compl. ¶¶ 37, 45.)

6

Plaintiff Quinalty alleges two phones were fraudulently purchased using his PII as

7

a result of the data breach. (Am. Compl. ¶ 65.) Plaintiff Quinalty further alleges that he

8

purchased additional credit monitoring services, experienced an increase in spam phone

9

calls, messages, and targeted advertisements, and spent approximately twelve hours

10

responding to the breach. (Am. Compl. ¶¶ 66, 69.)

11

Plaintiff Motta alleges her PII was also included in the data breach and that she

12

experienced emotional distress as a result. (Am. Compl. ¶¶ 75, 82.) Plaintiff Motta

13

additionally alleges she spent approximately three hours responding to the breach and

14

anticipates spending considerable time and money to mitigate and address the associated

15

harms. (Am. Compl. ¶¶ 79, 83.)

16

On behalf of themselves and a putative nationwide class—consisting of all

17

individuals residing in the United States whose PII was compromised in the data breach

18

(Am. Compl. ¶ 116)—Plaintiffs raise claims of Negligence and Unjust Enrichment.

19

Plaintiffs additionally bring a claim for a putative subclass of Arizona plaintiffs: violation

20

of the Arizona Consumer Fraud Act. (Am. Compl. ¶¶ 165-75.) Defendant filed a Motion

21

to Dismiss for lack of subject matter jurisdiction under Federal Rule of Civil Procedure

22

12(b)(1) and for failure to state a claim upon which relief can be granted under Rule

23

12(b)(6).

24

II.

LEGAL STANDARD

25

A.

26

“A motion to dismiss for lack of subject matter jurisdiction under Rule 12(b)(1) may

27

attack either the allegations of the complaint as insufficient to confer upon the court subject

28

matter jurisdiction, or the existence of subject matter jurisdiction in fact.” Renteria v.

Subject Matter Jurisdiction

-2-

1

United States, 452 F. Supp. 2d 910, 919 (D. Ariz. 2006) (citing Thornhill Publ’g Co. v.

2

Gen. Tel. & Elecs. Corp., 594 F.2d 730, 733 (9th Cir. 1979)). “Where the jurisdictional

3

issue is separable from the merits of the case, the [court] may consider the evidence

4

presented with respect to the jurisdictional issue and rule on that issue, resolving factual

5

disputes if necessary.” Thornhill, 594 F.2d at 733; see also Autery v. United States,

6

424 F.3d 944, 956 (9th Cir. 2005) (“With a 12(b)(1) motion, a court may weigh the

7

evidence to determine whether it has jurisdiction.”). The burden of proof is on the party

8

asserting jurisdiction to show that the court has subject matter jurisdiction. See Indus.

9

Tectonics, Inc. v. Aero Alloy, 912 F.2d 1090, 1092 (9th Cir. 1990).

10

B.

11

Rule 12(b)(6) is designed to “test[] the legal sufficiency of a claim.” Navarro v.

12

Block, 250 F.3d 729, 732 (9th Cir. 2001). A dismissal under Rule 12(b)(6) for failure to

13

state a claim can be based on either: (1) the lack of a cognizable legal theory; or (2) the

14

absence of sufficient factual allegations to support a cognizable legal theory. Balistreri v.

15

Pacifica Police Dep’t, 901 F.2d 696, 699 (9th Cir. 1990). When analyzing a complaint for

16

failure to state a claim, the well-pled factual allegations are taken as true and construed in

17

the light most favorable to the nonmoving party. Cousins v. Lockyer, 568 F.3d 1063, 1067

18

(9th Cir. 2009). A plaintiff must allege “enough facts to state a claim to relief that is

19

plausible on its face.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). “A claim has

20

facial plausibility when the plaintiff pleads factual content that allows the court to draw the

21

reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v.

22

Iqbal, 556 U.S. 662, 678 (2009) (citing Twombly, 550 U.S. at 556). “The plausibility

23

standard is not akin to a ‘probability requirement,’ but it asks for more than a sheer

24

possibility that a defendant has acted unlawfully.” Id.

Failure to State a Claim for Relief

25

“While a complaint attacked by a Rule 12(b)(6) motion does not need detailed

26

factual allegations, a plaintiff’s obligation to provide the grounds of his entitlement to relief

27

requires more than labels and conclusions, and a formulaic recitation of the elements of a

28

cause of action will not do.” Twombly, 550 U.S. at 555 (cleaned up and citations omitted).

-3-

1

Legal conclusions couched as factual allegations are not entitled to the assumption of truth

2

and therefore are insufficient to defeat a motion to dismiss for failure to state a claim. Iqbal,

3

556 U.S. at 679–80. However, “a well-pleaded complaint may proceed even if it strikes a

4

savvy judge that actual proof of those facts is improbable, and that ‘recovery is very remote

5

and unlikely.’” Twombly, 550 U.S. at 556 (quoting Scheuer v. Rhodes, 416 U.S. 232, 236

6

(1974)).

7

III.

ANALYSIS

8

A.

Standing

9

Defendant first argues Plaintiffs’ claims should be dismissed under Rule 12(b)(1)

10

for lack of standing. Article III courts are limited to deciding “cases” and “controversies.”

11

U.S. Const. art. III, § 2. Article III of the Constitution requires that one have “the core

12

component of standing.” Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). To have

13

standing under Article III, a plaintiff must show: (1) an injury in fact that is (a) concrete

14

and particularized and (b) actual or imminent; (2) the injury is fairly traceable to the

15

challenged action of the defendant; and (3) it is likely, not merely speculative, that the

16

injury will be redressed by decision in the plaintiff’s favor. Maya v. Centex Corp., 658 F.3d

17

1060, 1067 (9th Cir. 2011). A complaint that fails to allege facts sufficient to establish

18

standing requires dismissal for lack of subject matter jurisdiction under Rule 12(b)(1). See,

19

e.g., Chandler v. State Farm Mut. Auto. Ins. Co., 598 F.3d 1115, 1123 (9th Cir. 2010).

20

To establish an injury in fact, “a plaintiff must show that he or she suffered an

21

invasion of a legally protected interest that is concrete and particularized and actual or

22

imminent, not conjectural or hypothetical.” Spokeo, Inc. v. Robins, 578 U.S. 330, 339–40

23

(2016) (citation and quotation marks omitted). A “concrete” and “particularized” injury

24

must be “real,” not “abstract,” id., and “must affect the plaintiff in a personal and individual

25

way.” Lujan, 504 U.S. at 560 n.1. To be “actual or imminent,” a threatened injury must be

26

“certainly impending”— “allegations of possible future injury are not sufficient.” Clapper

27

v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (cleaned up).

28

-4-

1

Here, Defendant claims Plaintiffs have not alleged any injuries. Plaintiff Quinalty,

2

however, alleges phones were fraudulently purchased using his PII as a result of the

3

breach.1 Plaintiff Quinalty further alleges he purchased credit monitoring services as a

4

result of the breach. This plausibly constitutes a cognizable injury by way of a reasonable

5

expenditure for harm Plaintiff Quinalty allegedly suffered from the breach. See In re

6

Banner Health Data Breach Litig., No. CV-16-02696-PHX-SRB, 2017 WL 6763548, at

7

*8 (D. Ariz. Dec. 20, 2017) (“A person whose legally protected interests have been

8

endangered by the tortious conduct of another is entitled to recover for expenditures

9

reasonably made or harm suffered in a reasonable effort to avert the harm threatened.”

10

(internal citation omitted)). Accordingly, Plaintiff Quinalty alleges sufficient facts to

11

establish standing.

12

Additionally, Plaintiff Motta alleges she suffered emotional distress because of the

13

data breach. (Am. Compl. ¶ 82.) Specifically, Plaintiff Motta alleges she experienced

14

anxiety and remains “very concerned” about identity theft and fraud. (Am. Compl. ¶ 82.)

15

Emotional distress is a sufficiently concrete injury to establish standing. Goz v. Allied

16

Collection Servs., Inc., 812 F. App’x 544, 545 (9th Cir. 2020).

17

Plaintiff Motta further alleges she is exposed to the future harm that her PII will be

18

disclosed to unauthorized parties and that she could suffer identity theft. (Am. Compl.

19

¶¶ 82, 89.) To establish a future harm as concrete, the exposure to the risk of future harm

20

must cause a separate concrete harm itself. TransUnion LLC v. Ramirez, 594 U.S. 413, 436

21

(2021); Clemens v. ExecuPharm Inc., 48 F.4th 146, 155 (3d Cir. 2022). For example, the

22

Clemens court held that if a plaintiff’s knowledge of the substantial risk of identity theft

23

causes her to presently experience emotional distress, then the plaintiff has alleged a

24

concrete injury. Id. at 156. Here, Plaintiff Motta alleges the data breach exposed her to the

25

future risk of identity theft. She further alleges the exposure to the future risk of identity

26
27
1

28

Although Defendant contends that one of the alleged fraudulent purchases
occurred before Defendant had possession of Plaintiff Quinalty’s data, Defendant does not
dispute that the other alleged fraudulent purchase occurred after Defendant had possession.
-5-

1

theft caused her emotional distress. Therefore, Plaintiff Motta’s alleged exposure to the

2

future risk of identity theft is a sufficient injury in fact to establish standing.

3

Plaintiffs allege the Class, however, has a common injury because their data was

4

included in the breach. (Am. Compl. ¶ 123) (“Plaintiffs’ claims are typical of the claims of

5

other members of the Class in that Plaintiffs like every member of the class had their PII

6

compromised in the Defendant’s Data Breach.”). Exposure to the breach alone is not a

7

sufficiently concrete injury to establish standing. Namely, unlike the unique injuries pled

8

by Plaintiff Quinalty and Plaintiff Motta, Plaintiffs allege the Class only suffered harm

9

because their data was subject to the breach. Plaintiffs do not allege the Class suffered

10

actual identity theft, suffered emotional distress because of the risk of identity theft, or

11

incurred out-of-pocket expenses because of the breach. Therefore, Plaintiffs have not

12

alleged sufficient facts to establish standing for the Class.

13
14
15
16

Accordingly, under Rule 12(b)(1), the Court grants Defendant’s Motion to Dismiss
only as to the Class.
B.

Negligence
1.

Duty and Breach

17

Defendant first argues Plaintiffs fail to adequately plead duty and breach. Defendant

18

specifically argues Plaintiffs fail to allege a relationship that creates a duty because

19

Plaintiffs were not Defendant’s direct customers. (MTD at 9-10.) Plaintiffs, however, argue

20

Defendant had a duty to use reasonable means to secure its systems and networks because

21

Defendant undertook the responsibility to maintain and secure their PII. (Resp. at 10-11.)

22

Plaintiffs further argue that public policy, through 15 U.S.C. § 45, establishes a duty of

23

care. (Resp. at 10-11.)

24

In Arizona, several special relationships can give rise to a duty, including

25

relationships based on contract, familial relations, or conduct undertaken by the defendant.

26

Stanley v. McCarver, 92 P.3d 849, 853 (Ariz. 2004). However, liability based on such an

27

undertaking requires that the defendant undertook conduct directly with or for the plaintiff.

28

-6-

1

Cal-Am Props. v. Edais Eng’g Inc., 509 P.3d 386, 390 (Ariz. 2022) (citing McCarver,

2

92 P.3d at 853).

3

Here, Plaintiffs allege Defendant obtained Plaintiffs’ PII from the banks and

4

financial institutions that Defendant services. (Am. Compl. ¶ 2.) Plaintiffs do not allege,

5

however, that Defendant obtained PII directly from Plaintiffs, or for Plaintiffs’ benefit.

6

Therefore, a duty does not arise based solely on Defendant obtaining Plaintiffs’ PII from

7

financial institutions.

8

Additionally, Arizona generally follows the Restatement (Second) of Torts §§ 323

9

and 324A, which provide in part that one who undertakes gratuitously or for consideration,

10

to render services to another which he should recognize as necessary for the protection of

11

the other’s person or things, or a third person or his things, can be subject to liability for

12

physical harm resulting from his failure to exercise reasonable care to perform his

13

undertaking. Guerra v. State, 348 P.3d 423, 425 (Ariz. 2015). The requirement of physical

14

harm for liability based on negligent undertaking was affirmed by the Arizona Supreme

15

Court in Cal-Am Props. 509 P.3d at 391. (“We decline to extend § 324A’s reach beyond

16

what it expressly contemplates: liability for physical harm to the people or property that

17

the services sought to protect.”). Here, Plaintiffs do not allege any physical harm. A duty

18

to Plaintiffs thus does not arise based on a negligent performance of an undertaking as

19

defined in the Restatement.

20

Further, public policy, through state and federal statutes, can be a source of duty.

21

Cal-Am Props., 509 P.3d at 390. Plaintiffs rely on 15 U.S.C. § 45, which recites that

22

“[u]nfair methods of competition in or affecting commerce, and unfair or deceptive acts or

23

practices in or affecting commerce, are hereby declared unlawful.” 15 U.S.C. § 45(a)(1).

24

Plaintiffs then argue Defendant breached its duty by failing to provide fair computer

25

systems and data security practices to safeguard Plaintiffs’ PII. (Resp. at 11.) Yet, assuming

26

15 U.S.C. § 45 creates a duty, Plaintiffs do not allege any facts explaining how or why

27

Defendant’s data security practices were unfair or deceptive. Although Plaintiffs allege

28

-7-

1

Defendant failed to comply with industry standards, Plaintiffs do not plead any industry

2

standards.

3

Ultimately, Plaintiffs’ broad characterization of Defendant’s conduct as unfair or

4

deceptive is conclusory. Therefore, even if 15 U.S.C. § 45 creates a duty, Plaintiffs fail to

5

allege sufficient facts from which the Court could infer Defendant breached a duty.

6
7

Accordingly, Plaintiffs fail to plead facts sufficient to establish duty and breach in
their negligence claim.

8

2.

Damages

9

Defendant further argues Plaintiffs fail to allege sufficient damages. The Court

10

disagrees as to Plaintiff Quinalty but agrees that Plaintiff Motta does not sufficiently plead

11

damages.

12

Negligence damages must be actual and appreciable, non-speculative, and more

13

than merely the threat of future harm. CDT, Inc. v. Addison, Roberts & Ludwig, 7 P.3d 979,

14

982–83 (Ariz. Ct. App. 2000). Plaintiff Motta alleges damages of time spent responding to

15

the data breach, a diminution in the value of her PII, the likely theft of her PII, imminent

16

and impending injury arising from the increased risk of identity theft and fraud, and

17

emotional distress as a result of the breach. (Am. Compl. ¶ 81.)

18

Generally, lost time alone will not be cognizable as damages. Pruchnicki v. Envision

19

Healthcare Corp., 439 F. Supp. 3d 1226, 1233 (D. Nev. 2020) (“[T]he court finds that

20

tangible, out-of-pocket expenses are required in order for lost time spent monitoring credit

21

to be cognizable as damages.”); Plaintiffs v. MGM Resorts Int’l, 638 F. Supp. 3d 1175,

22

1192 (D. Nev. 2022) (“Lost time alone does not establish compensable damages.”); Griffey

23

v. Magellan Health Inc., 562 F. Supp. 3d 34, 45 (D. Ariz. 2021). Here, Plaintiff Motta does

24

not allege out-of-pocket expenses, or any other tangible harm that supplements her

25

allegation of lost time. Therefore, Plaintiff Motta’s allegation of lost time is insufficient to

26

establish damages.

27

A plaintiff can establish the diminished value of PII as a cognizable injury if the

28

plaintiff shows a “robust market” for the PII and that the plaintiff has been deprived of the

-8-

1

ability to sell personal data on the market. Svenson v. Google Inc., No. 13-cv-04080-BLF,

2

2015 WL 1503429, at 5* (N.D. Cal. Apr. 1, 2015) (citing In re Facebook Privacy Litig.,

3

572 Fed. App’x 494 (9th Cir. 2014)). Here, Plaintiffs allege stolen PII is one of the most

4

valuable commodities on the “criminal information black market.” (Am. Compl. ¶ 90.)

5

Plaintiff Motta, however, does not allege she can no longer sell her personal data on the

6

market, nor does she allege she ever has, intends to, or intended to, sell her personal data.

7

Further, Plaintiffs do not allege any market for their PII other than the “black market.” See

8

Griffey, 562 F. Supp. 3d at 46 (“This Court declines to recognize the ‘dark web’ as a

9

legitimate market by which individuals may sell their information.”). Therefore, Plaintiff

10

Motta’s allegation of diminished PII value is insufficient to establish damages.

11

Also, threats of future harm, such as the likely theft of PII, and imminent and

12

impending injury arising from the increased risk of identity theft and fraud, are not

13

cognizable harms on their own. Griffey, 562 F. Supp. 3d at 46. Plaintiff Motta does not

14

allege that her PII has been stolen, that her identity has been stolen, or that she has

15

experienced identity fraud. Therefore, Plaintiff Motta’s allegations that theft of her PII is

16

likely, and that she is at an increased risk of identity theft and fraud, are insufficient to

17

establish damages.

18

Concerning Plaintiff Motta’s alleged emotional distress, Arizona applies the “zone

19

of danger” test to determine whether damages for negligent infliction of emotional distress

20

are proper. Rodriguez v. Fox News Network, L.L.C., 356 P.3d 322, 325 (Ariz. Ct. App.

21

2015). Such a claim requires the plaintiff to prove that he or she “witnessed an injury to a

22

closely related person, suffered mental anguish manifested as physical injury, and was

23

within the zone of danger so as to be subjected to an unreasonable risk of bodily harm

24

created by the defendant.” Id. Plaintiff Motta does not allege any exposure to physical

25

injury, or any risk of bodily harm created by Defendant. Therefore, Plaintiff Motta’s

26

allegation of emotional distress resulting from the data breach fails to establish damages.

27

Accordingly, the Court grants Defendant’s Motion to Dismiss as to Plaintiff

28

Quinalty’s negligence claim because he fails to adequately allege duty and breach. The

-9-

1

Court also grants Defendant’s motion as to Plaintiff Motta’s negligence claim because she

2

fails to adequately allege duty and breach and further fails to adequately allege damages.

3

C.

4

Next, Defendant argues Plaintiffs have not stated an unjust enrichment claim

5

because the facts pled do not plausibly imply an unjust enrichment on Defendant’s part or

6

an impoverishment on their part. (MTD at 13.) Under Arizona law, “[u]njust enrichment

7

occurs when one party has and retains money or benefits that in justice and equity belong

8

to another.” Loiselle v. Cosas Mgmt. Group, LLC, 228 P.3d 943, 946 (Ariz. Ct. App. 2010).

9

To plead an unjust enrichment claim, a party must allege: “(1) an enrichment, (2) an

10

impoverishment, (3) a connection between the enrichment and the impoverishment, (4) the

11

absence of justification for the enrichment and the impoverishment, and (5) the absence of

12

a remedy provided at law.” Span v. Maricopa Cnty. Treasurer, 437 P.3d 881, 886 (Ariz.

13

Ct. App. 2019).

Unjust Enrichment

14

Here, Plaintiffs allege they were impoverished because they received unreasonable

15

data security from Defendant. (Am. Compl. ¶¶ 160-62.) Plaintiffs specifically argue the

16

data security received was unreasonable because Defendant’s security system was defeated

17

by a phishing scam, credentials of one of Defendant’s employees were available on the

18

dark web, and Defendant had to rely on a third party to identify the breach. (Resp. at 14.)

19

This is conclusory, however. Namely, allegations that Defendant’s system was defeated by

20

a phishing scam and that an employee’s data was on the dark web only indicate that the

21

data breach happened, not that the data security Plaintiffs received was unreasonable.

22

Additionally, Plaintiffs’ allegation that a third party notified Defendant of the breach

23

establishes that a third party identified the breach before Defendant, but not that

24

Defendant’s security was unreasonable. Plaintiffs also allege Defendant failed to comply

25

with industry standards, but do not indicate which industry standards were allegedly

26

violated, or how Defendant failed to comply. See Feins v. Goldwater Bank NA, No. CV-

27

22-00932-PHX-JJT, 2022 WL 17552440, at *7 (D. Ariz. Dec. 9, 2022).

28

- 10 -

1

Accordingly, Plaintiffs fail to adequately plead unjust enrichment because

2

Plaintiffs’ conclusory statements that they received unreasonable data security are

3

insufficient to establish impoverishment. Therefore, Defendant’s motion to dismiss is

4

granted as to Plaintiffs’ claim for unjust enrichment.

5

D.

Arizona Consumer Fraud Act

6

Defendant further alleges Plaintiffs fail to establish a claim for violation of the

7

Arizona Consumer Fraud Act, A.R.S. § 44-1521 et seq. (MTD 14-16.) To succeed on a

8

claim of consumer fraud, a plaintiff must show “1) a false promise or misrepresentation

9

made in connection with the sale or advertisement of “merchandise,” and 2) consequent

10

and proximate injury resulting from the misrepresentation.” Watts v. Medicis Pharm.

11

Corp., 365 P.3d 944, 953 (Ariz. 2016). “[T]he overwhelming authority in Arizona

12

specifically requires proof of actual reliance.” Stratton v. Am. Med. Sec., Inc., 266 F.R.D.

13

340, 349 (D. Ariz. 2009).

14

Here, Plaintiffs allege they “relied on the affirmatively misrepresented and

15

concealed facts and incurred damages as a consequent and proximate result.” (Am. Compl.

16

¶ 174.) Plaintiffs, however, fail to allege any facts indicating they were aware of

17

Defendant’s contracts, website, privacy policy, or advertising at the time they provided

18

their PII to Defendant’s clients. Therefore, the claim under the Arizona Consumer Fraud

19

Act must fail.

20

IV.

CONCLUSION

21

Plaintiff Quinalty and Plaintiff Motta have alleged sufficient injuries to establish

22

standing on behalf of themselves but have failed to allege sufficient injuries to establish

23

standing on behalf of the Class. Also, Plaintiffs fail to state facts that plausibly show

24

independent claims for negligence, unjust enrichment, or violation of the Arizona

25

Consumer Fraud Act. But if a defective complaint can be cured, a plaintiff is entitled to

26

amend the complaint before it is dismissed. See Lopez v. Smith, 203 F.3d 1122, 1127–30

27

(9th Cir. 2000). Because it is possible that Plaintiffs could allege facts to adequately plead

28

their claims or establish standing for the Class, the Court grants leave to file a Second

- 11 -

1

Amended Complaint. See id. If any such amendment fails to cure the defects in Plaintiffs’

2

claims, the Court will dismiss that portion of the Second Amended Complaint with

3

prejudice.

4
5

IT IS THEREFORE ORDERED granting Defendant’s Motion to Dismiss
Plaintiffs’ Amended Complaint (Doc. 27).

6

IT IS FURTHER ORDERED granting Plaintiffs leave to amend their complaint,

7

should they wish to do so. Plaintiffs shall file any Second Amended Complaint no later

8

than 21 days from the date of this Order.

9

Dated this 30th day of January, 2024.

10
11

Honorable John J. Tuchi
United States District Judge

12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

- 12 -