Xat.com Limited v. Hosting Services

Filing 30

MEMORANDUM DECISION AND ORDER granting in part and denying in part #15 Motion to Dismiss. Xats gross negligence and unjust enrichment claims are dismissed. 100TBs motion is denied with respect to Xats remaining claims. Signed by Magistrate Judge Paul M. Warner on 2/2/2017. (las)

IN THE UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF UTAH, CENTRAL DIVISION
XAT.COM LIMITED,
MEMORANDUM DECISION AND
ORDER GRANTING IN PART AND
DENYING IN PART DEFENDANT’S
MOTION TO DISMISS

Plaintiff,
v.
HOSTING SERVICES, INC. a/k/a
100TB.COM,

Case No. 1:16-cv-00092-PMW
Chief Magistrate Judge Paul M. Warner

Defendant.

Pursuant to 28 U.S.C. § 636(c), the parties consented to have Chief United States
Magistrate Judge Paul M. Warner conduct all proceedings in this case, including trial, entry of
final judgment, and all post-judgment proceedings. 1 Defendant Hosting Services, Inc., also
known as 100TB.com (“100TB”), has motioned the court to dismiss the above captioned case
pursuant to Rule 12(b)(1) and Rule 12(b)(6) of the Federal Rules of Civil Procedure. 2
On January 20, 2017, the court heard oral argument on 100TB’s motion. 3 At the hearing,
Plaintiff Xat.com Limited (“Xat”) was represented by Romaine C. Marshall and Engels Tejeda.
100TB was represented by Paul G. Karlsgodt and Patricia W. Christensen. At the conclusion of
the hearing, the court took the motion under advisement. Now being fully advised, the court
renders the following Memorandum Decision and Order.
BACKGROUND
Xat is a social networking website that allows users to exchange instant messages. 4
100TB provides web hosting services. 5 In 2008, Xat utilized 100TB to host Xat’s servers. 6

1

Dkt. No. 11.
Dkt. No. 15.
3
Dkt. No. 29.
4
Dkt. No. 2 at ¶ 6.
2

1

While Xat’s complaint is vague about what 100TB’s hosting services entail, it appears that
100TB’s hosting services involve 100TB ensuring the physical security and stability of Xat’s
servers as well as protecting Xat’s servers from digital invasion from unauthorized third parties.
A. The Master Service Agreement
On October 13, 2008, the parties executed a Master Service Agreement (“MSA”). 7 The
MSA outlines the parties’ rights and obligations governing 100TB’s hosting services. At issue in
100TB’s motion is to what extent 100TB is liable under the terms of the MSA.
The MSA provides several stipulations regarding 100TB’s liability and indemnification
responsibilities. For example, ¶ 9(a) states:
[100TB agrees to] indemnify, defend and hold [Xat], [Xat’s] employees, directors
and officers . . . from any and all third party actions, liability, damages, costs and
expenses (including, but not limited to, those attorneys’ fees and expenses
charged to [100TB]) arising from, or relating to, personal injury or property
damage resulting solely from our gross negligence or willful misconduct . . . . 8
Paragraph 11 states:
NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS MSA, IN
NO EVENT WILL [100TB] BE LIABLE TO [XAT] OR ANY THIRD PARTY
MAKING A CLAIM BASED ON OUR PROVIDING THE SERVICES TO
[XAT] FOR (I) LOST PROFITS; (II) LOSS OF BUSINESS; (III) LOSS OF
REVENUES; (IV) LOSS OF DATA OR INTERRUPTION OR CORRUPTION
OF DATA; (V) ANY CONSEQUENTIAL OR INDIRECT DAMAGES; OR (VI)
ANY INCIDENTAL, SPECIAL, RELIANCE, EXEMPLARY OR PUNITIVE
DAMAGES (IF APPLICABLE) . . . . 9
Paragraph 11 goes on to state that 100TB’s “maximum liability shall be one (1) month’s fees (or
the equivalent thereof) actually received by [100TB] during the month prior to [Xat’s] claim.” 10

5

Id. at ¶ 7.
Id.
7
Id.
8
Dkt. No. 2-1 at ¶ 9(a).
9
Id. at ¶ 11.
10
Id. (capitalization omitted).
6

2

Paragraph 11 further stipulates that 100TB’s “obligation to indemnify” Xat under the terms of ¶
9 is not limited by ¶ 11. 11
Additionally, the MSA establishes certain promises and standards of care governing
100TB’s hosting services. For example, the MSA represents that 100TB has “received ‘Safe
Harbor’ certification under U.S. – EU, and U.S. –Swiss safe harbor frameworks.” 12 Under the
U.S. – EU, and U.S. –Swiss Safe Harbors (collectively “Safe Harbors”), “[o]rganizations
creating, maintaining, using or disseminating personal information must take reasonable
precautions to protect it from loss, misuse and unauthorized access, disclosure, alteration and
destruction.” 13
Moreover, 100TB agreed to utilize “industry standard methods” to secure Xat’s
property. 14 100TB also promised to “[m]onitor the network, physical infrastructure, servers and
applications on a 24x7x365 basis.” 15 Furthermore, 100TB’s Privacy Policy, incorporated in the
MSA, prohibits 100TB from sharing Xat’s user data with third parties unless otherwise permitted
by 100TB’s Privacy Policy. 16
B. Hacking of Xat’s Servers
In 2015, Xat alleges that 100TB allowed an unauthorized third party to access Xat’s
servers. Xat claims that over a ten month period, Xat repeatedly warned 100TB that an
unauthorized third party was attempting to gain access to Xat’s servers through “social
engineering.” 17 Xat asserts that in response to those repeated warnings, 100TB assured Xat that

11

Id. Paragraph 11 refers to ¶ 10 for 100TB’s indemnification responsibilities. Id. However, ¶ 9 governs
100TB’s obligation to indemnify Xat. See id. at ¶ 9.
12
Id. at ¶ 4.
13
Dkt. No. 2 at ¶ 11.
14
Dkt. No. 2-1 at ¶ 13.
15
Id. at ¶ 24(b).
16
Id. at ¶ 2(e); Dkt. No. 2-2 at 7.
17
Id. at ¶¶ 16, 18, 20, 26, 34.

3

access to its servers would be denied and suggested that Xat take certain steps to further secure
its servers. 18 Xat contends that while it complied with 100TB’s instructions, 100TB nevertheless
granted a third party unauthorized access to Xat’s servers.
Specifically, on November 4, 2015, an unknown third party was granted access to Xat’s
servers. 19 The third party allegedly damaged and disabled Xat’s servers and stole Xat’s
proprietary software, including Xat’s main database. 20 Subsequently, Xat requested that 100TB
secure and power down Xat’s servers until it could contain the intrusion. 21 Xat alleges that
100TB did not power down at least three of Xat’s servers, did not turn on 100TB’s two-factor
authentication, and failed to back up the data on Xat’s servers. 22
On November 8, 2015, 100TB again granted a third party access to Xat’s servers. 23
During this second incident, the third party accessed Xat’s proprietary log files, databases, source
code, and software, and erased system log files from Xat’s server. 24
Following the attacks, Xat filed the instant lawsuit asserting claims against 100TB for
gross negligence, breach of the MSA, unjust enrichment, and equitable indemnification. Xat
alleges that it has suffered at least $500,000 in damages as a result of the hacking incidents,
including the cost of containing the cyberattacks, the value of lost, stolen, or deleted data, and
lost revenue and profit. 25 Additionally, Xat alleges that it has incurred costs with reporting the
cyberattack to the United Kingdom’s Information Commissioner’s Office as well as cooperating

18

Id. at ¶¶ 16, 18, 20, 23, 26, 28, 34.
Id.at ¶ 30.
20
Id. at ¶ 31.
21
Id. at ¶ 32.
22
Id. at ¶ 35.
23
Id. at ¶ 36.
24
Id. at ¶ 38.
25
See id. at ¶ 39.
19

4

with the appropriate authorities and governmental agencies investigating the cyberattacks. 26
Furthermore, Xat seeks a court order:
requiring 100TB to indemnify Xat for any claims related to the Cyberattacks
asserted by any third party, including any claims asserted by any regulatory
authority or any individual or entity whose information was or may have been
exposed during the Cyberattacks, and for any costs and attorneys’ fees incurred
by Xat related to any of the foregoing . . . . 27
In response, 100TB filed the instant motion to dismiss.
STANDARDS OF REVIEW
In deciding a motion to dismiss under Rule 12(b)(6) of the Federal Rules of Civil
Procedure, the court presumes the truth of all well-pleaded facts in the complaint, but need not
consider conclusory allegations. Tal v. Hogan, 453 F.3d 1244, 1252 (10th Cir. 2006), cert.
denied, 549 U.S. 1209 (2007). The court is not bound by a complaint’s legal conclusions,
deductions, and opinions couched as facts. Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 565
(2007). Further, although reasonable inferences must be drawn in the non-moving party’s favor,
a complaint will only survive a motion to dismiss if it contains “enough facts to state a claim to
relief that is plausible on its face.” Id. at 570. “A claim has facial plausibility when the plaintiff
pleads factual content that allows the court to draw the reasonable inference that the defendant is
liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009).
Pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure, the court may dismiss
a claim for lack of subject matter jurisdiction. Ripeness and mootness challenges are treated as
motions to dismiss under Rule 12(b)(1). See SK Fin. SA v. La Plata Cty., Bd. of Cty. Comm’rs,
126 F.3d 1272, 1275 (10th Cir. 1997); Chihuahuan Grasslands Alliance v. Kempthorne, 545
F.3d 884, 891 (10th Cir. 2008).
26
27

Id. at ¶¶ 39(c), 60.
Id. at 10.

5

DISCUSSION
It appears to the court that the parties have taken a relatively straightforward motion to
dismiss and beaten a dead horse, so to speak. Following the routine briefing on 100TB’s motion
to dismiss, the court granted Xat’s motion to file a sur-reply. 28 Prior to the court’s ruling, 100TB
responded to Xat’s sur-reply and Xat responded to 100TB’s response to Xat’s sur-reply. 29 The
court routinely grants sur-replies with the expectation that counsel will only use sur-replies in
narrow circumstances to aid the court. The sur-reply and subsequent responses from counsel
were unhelpful and merely rehashed arguments already discussed ad nauseam in the briefing.
The court reminds counsel of their obligation to aid the court in ensuring the “just, speedy, and
inexpensive determination of every action and proceeding.” Fed. R. Civ. P. 1 (emphasis added).
Rehashing arguments for the sake of billable hours and the unmistakable urge to have the last
word are antithetical to achieving the inexpensive resolution of this case.
Turning to the merits of 100TB’s motion, after carefully reviewing Xat’s complaint—
accepting each of Xat’s factual allegations as true—Xat’s gross negligence claim and unjust
enrichment claim are dismissed. Xat’s gross negligence claim and the damages associated with
it are bargained for and governed by the MSA. Accordingly, the economic loss rule precludes
Xat from recovering in tort what it can recover in contract. Likewise, the MSA governs the
dispute between the parties and, therefore, Xat has failed to plead a plausible claim for unjust
enrichment. With respect to Xat’s remaining claims, Xat has alleged sufficient facts to survive a
motion to dismiss.

28
29

Dkt. No. 26.
Dkt. Nos. 24, 25.

6

I. Gross Negligence
100TB argues that Xat’s gross negligence claim seeks “purely economic damages”
which are governed by the MSA and, therefore, barred by the economic loss rule. 30 Xat attempts
to circumvent the application of the economic loss rule in two ways. First, Xat argues that the
Safe Harbors, 100TB’s position as a bailee, and the special relationship between the parties,
create separate tort duties distinct from the MSA. 31 Second, Xat claims that the economic loss
rule does not apply because 100TB’s gross negligence resulted in harm to Xat’s personal
property. 32
For the reasons that follow, Xat’s gross negligence claim is dismissed. The duties alleged
by Xat merely recast 100TB’s contractual duties in terms of tort. Moreover, there are no
allegations before the court that Xat suffered property damage outside the scope of the MSA.
Accordingly, Xat’s gross negligence claim is barred by the economic loss rule.
A. Independent Duty
“The economic loss rule prevents recovery of economic damages under a theory of tort
liability when a contract covers the subject matter of the dispute.” Reighard v. Yates, 2012 UT
45, ¶ 14, 285 P.3d 1168. The purpose underlying the economic loss rule is to mark a
“fundamental boundary between contract law, which protects expectancy interests created
through agreement between the parties, and tort law, which protects individuals and their
property from physical harm by imposing a duty of reasonable care.” Davencourt at Pilgrims
Landing Homeowners Ass’n v. Davencourt at Pilgrims Landing, LC, 2009 UT 65, ¶ 18, 221 P.3d
234 (quotations and citation omitted).

30

Dkt. No. 6 at 6.
Dkt. No. 18 at 10–14.
32
Id. at 14–15.
31

7

The economic loss rule does not apply every time tort and contract claims meet. Under
the independent duty principle, if the plaintiff can point to separate duties—one in contract and
one in tort—the economic loss rule does not bar a plaintiff’s tort claims. See, e.g., Reighard,
2012 UT 45, ¶ 14 (“Whether the economic loss rule applies depends on whether a duty exists
independent of any contractual obligations between the parties.” (quotations and citation
omitted)); Hermansen v. Tasulis, 2002 UT 52, ¶ 17, 48 P.3d 235 (“When an independent duty
exists, the economic loss rule does not bar a tort claim. . . .”). “The independent duty principle is
a means of measuring the reach of the economic loss rule.” Reighard, 2012 UT 45, ¶ 14. Where
the tortious conduct “does not overlap” with the duties “contemplated in contract, ‘the economic
loss rule does not bar a tort claim because the claim is based on a recognized independent duty of
care and thus does not fall within the scope of the rule.’” Id. at ¶ 21 (quoting Hermansen, 2002
UT 52, ¶ 17).
Xat claims that 100TB owes it two duties to Xat that are independent of the MSA. First,
Xat argues that the Safe Harbors and corresponding United Kingdom Data Protection Act of
1998 impose an independent duty on 100TB to take certain steps to protect Xat’s data. 33
Furthermore, Xat argues that the Safe Harbors apply to 100TB regardless of whether or not the
parties executed the MSA. Second, Xat alleges that 100TB, as a bailee of Xat’s property, owed
Xat an independent duty to protect Xat’s data. 34
i. Safe Harbors
Xat’s reliance on the Safe Harbors to create an independent duty is without weight. The
application of the independent duty principle depends on the duties contemplated in the MSA
compared to the duties alleged by Xat. When the duty breached overlaps with a duty
33
34

Dkt. No. 18 at 10.
Id. at 13–14.

8

contemplated by a contract, any breach must be “enforced pursuant to contract law.” Reighard,
2012 UT 45, ¶ 21 (quoting Grynberg v. Questar Pipeline Co., 2003 UT 8, ¶ 43, 70 P.3d 1).
Indeed, the purpose of contract law is to protect “expectancy interests created through agreement
between the parties” Sunridge Dev. Corp. v. RB & G Eng’g, Inc., 2010 UT 6, ¶ 28, 230 P.3d
1000 (citations omitted). Therefore, “[a]ll contract duties, and all breaches of those duties—no
matter how intentional—must be enforced pursuant to contract law.” Grynberg, 2003 UT 8, ¶
43.
In the MSA, 100TB represents that it has “received ‘Safe Harbor’ certification under U.S.
– EU, and U.S. – Swiss safe harbor frameworks.” 35 According to Xat’s allegations, the Safe
Harbors require 100TB to “take reasonable precautions” to protect Xat’s personal user data from
“loss, misuse and unauthorized access, disclosure, alteration and destruction.” 36 By certifying
100TB is compliant with the Safe Harbors, 100TB created an expectancy interest whereby Xat
can seek damages for breach. Indeed, if this representation proves to be false—that 100TB is not
compliant with the Safe Harbors—Xat has a viable breach of contract claim against 100TB.
Furthermore, Xat’s argument that 100TB’s duties under the Safe Harbors would exist regardless
of the MSA is fundamentally flawed. 100TB would not have agreed to host Xat’s servers
without executing the MSA. 37 Accordingly, Xat has failed to demonstrate the Safe Harbors
impose an independent duty not bargained for under the terms of the MSA.

35

Dkt. No. 2-1 at ¶ 4.
Dkt. No. 2 at ¶ 11.
37
Dkt. No. 22 at 6 (“Xat.com would not have been permitted to have its data hosted on 100TB’s servers
without entering into the MSA.”).
36

9

ii. Bailment Relationship
In addition to the Safe Harbors, Xat attempts to create a separate tort claim by arguing
100TB breached its duty as a bailee of Xat’s data. 38 Xat claims that the “special relationship
between the parties” imposes an independent duty of care on 100TB to safeguard Xat’s
property. 39 Xat’s independent duty analysis misses the mark for two reasons.
First, Xat’s bailment argument ignores fundamental principles of bailment law. Xat does
not allege that 100TB had the authority to limit Xat’s access to Xat’s servers. McPherson v.
Belnap, 830 P.2d 302, 304 (Utah Ct. App. 1992) (“The bailor must actually or constructively
deliver the property to the bailee in such a way as to entitle the bailee to exclude others from
possession during the bailment period, including the owner/bailor.”). To the contrary, Xat
routinely had access to its servers during the alleged breaches. Moreover, even if 100TB is a
bailee of Xat’s data, the MSA expressly governs 100TB’s possession of Xat’s property.
Second, the economic loss rule cannot be defeated by merely asserting there is a “special
relationship” between the contracting parties. Whether a duty exists is a “question of law” which
requires the court to understand the “structure and dynamics of the relationship between the
parties” and whether that relationship gives rise to a duty. Yazd v. Woodside Homes Corp., 2006
UT 47, ¶ 15, 143 P.3d 283 (citations omitted). In the context of the economic loss rule, Utah
courts have recognized an independent duty where one contracting party possesses “a high
degree of knowledge and expertise” or where there exists a “disparity in skill and knowledge”
between the contracting parties. Davencourt at Pilgrims Landing Homeowners Ass’n, 2009 UT
65, ¶ 30 (citing Yazd, 2006 UT 47, ¶ 24).

38

Dkt. No. 18 at 13.
Id. at 14 n.7 (“One reason for exempting . . . Xat’s claims from the economic loss rule is the special
relationship between the parties with respect to the property held in trust by100TB.” (citing Hermansen,
2002 UT 52, ¶¶ 20–21)).
39

10

For example, real estate agents owe an independent tort duty to homebuyers to disclose
“known material defects” on the property. Hermansen, 2002 UT 52, ¶¶ 20–23 (“Those who deal
with [real estate agents] do so because of the advantages which they expect to derive from this
special competence.” (quotations and citations omitted)). Likewise, real estate appraisers owe an
independent tort duty to homebuyers, including to non-contracting parties. West v. Inter–Fin.,
Inc., 2006 UT App 222, ¶¶ 24, 29, 139 P.3d 1059 (“[R]eal estate appraisers, like other real estate
professionals, are not shielded by the economic loss rule and have an independent duty to noncontracting parties.”). Indeed, the purpose of the economic loss rule is to “prevent
disproportionate liability and allow parties to allocate risk by contract.” Id. at ¶ 10 (citing SME
Indus. v. Thompson Ventulett, Stainback and Assoc., Inc., 2001 UT 54, ¶ 36, 28 P.3d 669).
Therefore, if one party is at a bargaining disadvantage—whether by lack of knowledge or skill—
Utah courts are willing to impose an independent duty, thus limiting the reach of the economic
loss rule.
Conversely, where parties possess equal bargaining power, the economic loss rule
prohibits recovery in tort to promote allocation of risk through contract. For example, in SME
Industries, steel subcontractors sued an architect and design team for poorly prepared structural
designs and specifications for the renovation of a convention center. 2001 UT 54, ¶ 4. The
subcontractors asserted several claims, including breach of contract, negligence, and negligent
misrepresentation. See id. at ¶¶ 7, 10. The trial court held that the economic loss rule barred the
subcontractors’ tort claims. Id. at ¶ 8. The Utah Supreme Court affirmed, finding, “[p]rotection
against economic losses caused by another’s failure to properly perform, including an architect
or design professional, is but one provision a contractor, subcontractor, or sub-subcontractor may
require in striking his or her bargain.” Id. at ¶ 36. Accordingly, the subcontractors’ negligence

11

claims were “akin to the types of commercial situations to which the economic loss rule was
meant to apply.” Id. (citations omitted).
Furthermore, in rejecting the subcontractors request to impose an independent duty
through the Restatement (Second) of Torts § 552, the court recognized that applying the
Restatement would essentially allow the parties to “sidestep contractual duties by bringing a
cause of action in tort to recover the very benefits they were unable to obtain in contractual
negotiations.” Id. at ¶ 44 (“[W]e hold that when parties have contracted, as in the construction
industry, to protect against economic liability, contract principles override the tort principles
enunciated” in the Restatement.).
Like SME Industries, the transaction between Xat and 100TB is the exact type of
commercial situation to which the economic loss rule was intended to apply. Unlike an unwise
homebuyer relying on the expertise of a real estate agent, Xat and 100TB are sophisticated
parties with the capacity to properly allocate risk through contract. In executing the MSA, Xat
acknowledged that the MSA was “the result of negotiations between equally situated parties.” 40
Xat further agreed that it was afforded the opportunity to “analyze, evaluate, negotiate, edit and
draft the terms of this MSA.” 41 Furthermore, like SME Industries, allowing Xat to pursue a
separate claim in tort would effectively allow Xat to recover benefits it may have been unable to
obtain through contract negotiations. It is axiomatic that the purpose of the economic loss rule is
to prohibit Xat from using tort to expand its recovery beyond the bargained-for risk in the MSA.

40
41

Dkt. No. 2-1 at ¶ 17(i).
Id.

12

B. Other Property Exception
Xat attempts to argue that the economic loss rule does not apply because 100TB caused
damage to Xat’s personal property. 42 Xat’s recitation of the law is inaccurate. The economic
loss rule does not carve out an exception for any and all personal property damage. Rather, the
economic loss rule does not apply to “damage to other property.” Reighard, 2012 UT 45, ¶ 22
(citations omitted) (emphasis in original); see also SME Indus., Inc., 2001 UT 54, ¶ 45; Sunridge
Dev. Corp., 2010 UT 6, ¶ 28. Other property is “property that is outside the scope of a contract
and unaffected by the contract bargain. When property is contemplated in the scope and subject
matter of a contract, the parties to the contract can only recover for damage to that property
through contract remedies.” Reighard, 2012 UT 45, ¶ 22. Conversely, if the “property falls
outside of the scope of a contract, the economic loss rule will not apply and relief may be
available in tort.” Id. Therefore, “the extent to which the economic loss rule applies in any
given case depends on the contract at issue and the scope of the duties and property the contract
covers.” Id.
For example, in Reighard v. Yates, homebuyers purchased a home where the previous
owner had acted as the general contractor. 2012 UT 45, ¶ 4. The parties entered into a standard
real estate purchase contract, which required the contractor to disclose his “actual knowledge
regarding the condition of the property,” including the existence of mold or other moisture
conditions. Id. After moving into the home, the homebuyers discovered mold and sued the
contractor for breach of contract, negligence, and negligent misrepresentation. Id. at ¶ 6. The
Utah Supreme Court held the economic loss rule prevented the homebuyer’s tort recovery
because the real estate purchase contract encompassed the contractor’s failure to disclose mold
42

Dkt. No. 18 at 14 (“[T]he economic loss rule does not apply because Xat alleges that 100TB’s gross
negligence in granting access to Xat’s servers resulted in damage to Xat’s personal property.”).

13

on the property. Id. at ¶ 25. Applying the other property doctrine, the court found, “[t]he subject
of the contract is the house, and the contract itself expressly addresses moisture-related damage
to the house. Any tort duties that [the contractor] owed the [homebuyers] regarding the house
therefore overlap with [the contractor’s] contract duties to the [homebuyers].” Id.
Like Reighard, any tort duties owed by 100TB “overlap” with 100TB’s contractual
duties. Xat’s complaint does not allege any collateral property was damaged during the
cyberattacks. 43 Xat’s complaint alleges that during the first cyberattack, the unknown third party
“damaged one of Xat’s servers, stole proprietary software, and wiped the server so that Xat was
unable to recover data from it.” 44 During the second attack, an unknown third party “accessed
Xat’s proprietary log files, databases and source code, and erased system log files from Xat’s
server.” 45 The damages alleged by Xat relate to a breach of the MSA and, therefore, Xat’s
remedy against 100TB’s alleged gross negligence is governed by the MSA.
Based on the forgoing, Xat’s gross negligence claim is dismissed. But, there is nothing in
this opinion that would prevent Xat from seeking recovery for 100TB’s alleged gross negligence
in contract. As delineated below, the MSA contemplates that Xat may contractually recover for
100TB’s gross negligence. The economic loss rule merely prohibits Xat from seeking recovery
in tort.
II. Breach of Contract
Pursuant to ¶ 11 of the MSA, 100TB asks the court to limit the damages Xat may recover
under the MSA to one month of fees received by 100TB from Xat the month prior to Xat’s
43

At oral argument, Xat’s counsel argued that that property outside the scope of the MSA was damaged
during the cyberattacks. However, where the assertions of counsel contradict the allegations in the
complaint, the allegations in the complaint control. See Chubb v. Brownback, No. 14-CV-03227-DDCDJW, 2016 WL 5410615, at *1 (D. Kan. Sept. 28, 2016) (holding, when deciding a motion to dismiss the
“facts alleged in the plaintiff’s complaint control”).
44
Dkt. No. 2 at ¶ 31.
45
Id. at ¶ 37.

14

claim. 46 Building off of this theory, 100TB argues that Xat’s breach of contract claim is moot
because 100TB has placed $2,715.95 or one month’s fees in the registry of the court. 47
The parties dispute the meaning ¶ 11 of the MSA. Paragraph 11 is entitled “Our Liability
is Limited” and states in relevant part:
NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS MSA, IN
NO EVENT WILL [100TB] BE LIABLE TO [XAT] OR ANY THIRD PARTY
MAKING A CLAIM BASED ON OUR PROVIDING THE SERVICES TO
[XAT] FOR (I) LOST PROFITS; (II) LOSS OF BUSINESS; (III) LOSS OF
REVENUES; (IV) LOSS OF DATA OR INTERRUPTION OR CORRUPTION
OF DATA; (V) ANY CONSEQUENTIAL OR INDIRECT DAMAGES; OR (VI)
ANY INCIDENTAL, SPECIAL, RELIANCE, EXEMPLARY OR PUNITIVE
DAMAGES (IF APPLICABLE) . . . . 48
Paragraph 11 goes on to state that 100TB’s “maximum liability shall be one (1) month’s fees (or
the equivalent thereof) actually received by [100TB] during the month prior to [Xat’s] claim.” 49
100TB argues that ¶ 11 is not a limitation of liability provision “but rather a valid and
enforceable contractual limitation on the amount of economic damages that Xat.com may
recover for any breach of the contract, regardless of whether the conduct underlying that breach
was negligent or even intentional.” 50 Conversely, Xat argues that ¶ 11 is not enforceable
because the law disfavors exemptions that apply to harm willfully inflicted or caused by gross
negligence. 51
“Well-accepted rules of contract interpretation require that [the court] examine the
language of a contract to determine meaning and intent.” Glenn v. Reese, 2009 UT 80, ¶ 10, 225
P.3d 185 (quotations and citation omitted). The court examines each contractual provision “in

46

Dkt. No. 15 at 8.
See Dkt. Nos. 14, 19.
48
Id. at ¶ 11.
49
Id.
50
Dkt. No. 22 at 3 (emphasis in original).
51
Dkt. No. 18 at 4–5. Xat also argues that ¶ 9(a) exempts any damages Xat suffered as the result of
100TB’s gross negligence. Id. at 7.
47

15

relation to all of the others, with a view toward giving effect to all and ignoring none.” WebBank
v. Am. Gen. Annuity Serv. Corp., 2002 UT 88, ¶ 18, 54 P.3d 1139 (quoting Jones v. ERA Brokers
Consol., 2000 UT 61, ¶ 12, 6 P.3d 1129). If the language of the contract is unambiguous, “the
parties’ intentions are determined from the plain meaning of the contractual language, and the
contract may be interpreted as a matter of law.” Glenn, 2009 UT 80, ¶ 10 (citations omitted).
“However, if the language of the contract is ambiguous such that the intentions of the parties
cannot be determined by the plain language of the agreement, extrinsic evidence must be looked
to in order to determine the intentions of the parties.” WebBank., 2002 UT 88, ¶ 19 (quotations
and citation omitted). A contract is ambiguous if it is “capable of more than one reasonable
interpretation because of uncertain meanings of terms, missing terms, or other facial
deficiencies.” SME Indus. Inc., 2001 UT 54, ¶ 14 (quotation and citations omitted).
The court as reviewed the MSA in its entirety and finds that is very poorly drafted. At
best, it is ambiguous. For example, whether ¶ 11 is a limitation of liability provision or merely
places a cap on economic damages is debatable. Paragraph 11 is entitled “Our Liability is
Limited.” 52 Additionally, ¶ 11 repeatedly references 100TB’s obligations to Xat in terms of
“liability.” 53 Furthermore, while 100TB stresses that ¶ 11 merely places a cap on economic
damages, in actuality ¶ 11 limits 100TB’s liability to a ridiculously nominal sum. Conceivably,
limiting 100TB’s liability to a trivial sum is just window dressing for eliminating liability
altogether.
With this backdrop in mind, on a motion to dismiss the court will not limit Xat’s recovery
to one month of fees. Xat has proffered plausible argument that ¶ 11 is ambiguous and may be
unenforceable. Paragraph 11 could be interpreted as a limitation of liability provision that allows
52
53

Dkt. No. 2-1at ¶ 11.
See id.

16

100TB to engage in grossly negligent or willful conduct while leaving Xat with nominal
retribution. Such liability waivers are generally unenforceable. See, e.g., Penunuri v. Sundance
Partners, Ltd., 2011 UT App 183, ¶ 7, 257 P.3d 1049, 1051, aff’d, 2013 UT 22, ¶ 7, 301 P.3d
984 (holding contractual provisions which limit liability for harm willfully inflicted or caused by
gross negligence are invalid as against public policy); Caplin Enterprs., Inc. v. Arrington, 145
So. 3d 608, 616–17 (Miss. 2014) (finding the contract provision unconscionable where the
defendant’s “contractually-limited liability is so nominal that it has the practical effect of
avoiding almost all responsibility for a breach” (quotations and citations omitted)). Additionally,
because the court has declined to limit Xat’s damages, the court will not address 100TB’s
mootness argument.
III. Unjust Enrichment
Xat alleges that “Xat conferred a benefit upon 100TB, which included the purchase of
services from 100TB since October 13, 2008” under circumstances “that make it inequitable for
100TB to retain such benefit without compensating Xat for the damages caused by the
Cyberattacks.” 54 100TB counters that the MSA precludes any claim of unjust enrichment. 55
Absent an enforceable contract, a plaintiff may recover under the equitable doctrine of
unjust enrichment. Jeffs v. Stubbs, 970 P.2d 1234, 1245 (Utah 1996) (“Unjust enrichment law
developed to remedy injustice when other areas of the law could not.”). To establish a claim of
unjust enrichment, a plaintiff must establish:
‘(1) a benefit conferred on one person by another; (2) an appreciation or
knowledge by the conferee of the benefit; and (3) the acceptance or retention by
the conferee of the benefit under such circumstances as to make it inequitable for
the conferee to retain the benefit without payment of its value.’

54
55

Dkt. No. 2 at ¶¶ 56, 58.
Dkt. No. 15 at 9.

17

Espinoza v. Gold Cross Servs., Inc., 2010 UT App 151, ¶ 10, 234 P.3d 156 (citations omitted).
“[A] claim of unjust enrichment cannot arise where there is an express contract governing the
‘subject matter’ of a dispute.” U.S. Fid. v. U.S. Sports Specialty, 2012 UT 3, ¶ 11, 270 P.3d 464,
468 (citing Selvig v. Blockbuster Enters., LC, 2011 UT 39, ¶ 30, 266 P.3d 691). Additionally,
while a plaintiff is entitled to plead alternative theories of recovery, an unjust enrichment claim
cannot survive a motion to dismiss where the plaintiff does not attack the validity of the contract.
Preventive Energy Sols., LLC v. nCap Ventures 5 LLC, No. 2:16-CV-809-PMW, 2017 WL
87028, at *8 (D. Utah Jan. 10, 2017) (citing cases).
Any recovery Xat is entitled to for damage to its data and servers is governed by the
MSA. 56 The benefit Xat conferred on 100TB is governed by the MSA. Moreover, while Xat
may contest the reach of some of the MSA’s provisions, Xat does not allege that the MSA is
unenforceable. Therefore, Xat’s unjust enrichment claim fails as a matter of law.
IV. Equitable Contribution
Xat seeks an order requiring 100TB to indemnify Xat for “any claims related to the
Cyberattacks asserted by any third party.” 57 100TB argues that Xat’s equitable contribution
claim is not ripe because Xat “has not alleged it has incurred any third-party liability in
connection with the alleged Cyberattacks or even that any third-party claims have been raised
against it.” 58 100TB’s self-serving reading of Xat’s complaint is without merit.
Ripeness is a component of Article III standing that limits judicial review to actual cases
or controversies. U.S. Const. art. III, § 2. The ripeness doctrine prohibits federal courts from
engaging in “abstract and premature adjudications.” Discover Prop. & Cas. Ins. Co. v.
Collective Brands, Inc., No. 07-2577-JAR, 2008 WL 2783144, at *3 (D. Kan. July 15, 2008). To
56

See Dkt. No. 2-1 at ¶ 5(a).

57

Dkt. No. 2 at 10.
Dkt. No. 15 at 11.

58

18

determine whether a case is ripe for judicial review, the court must ask two interrelated
questions. First, the court asks “whether the case involves uncertain or contingent future events
that may not occur as anticipated, or indeed may not occur at all.” Morgan v. McCotter, 365
F.3d 882, 890 (10th Cir. 2004) (citations omitted). Second, the court asks “whether the
challenged action creates a direct and immediate dilemma for the parties.” Id.
Xat’s equitable contribution claim is ripe for judicial review. Paragraph 9(a) of the MSA
is broadly written to encompass indemnification for “any and all third party actions.” 59 Xat
alleges that it has “incurred significant costs” as a result of the cyberattack, “including costs of
cooperating with the appropriate authorities and governmental agencies investigating the
Cyberattacks.” 60 There is nothing in the MSA that excludes government investigations from the
MSA’s definition of a third party action. Moreover, Xat seeks an order “requiring 100TB to
indemnify Xat for any claims related to the Cyberattacks asserted by any third party . . . .” 61
There are no unknowns that would affect the outcome of Xat’s claim for equitable contribution.
100TB’s obligation to indemnify Xat turns on whether 100TB breached its obligations under the
MSA. The nature of the future third party actions asserted against Xat will not affect this
analysis. Accordingly, the court finds no Article III impediments to Xat’s claim for equitable
indemnification.

59

Dkt. No. 2-1 at ¶ 9(a).
Dkt. No. 2 at ¶ 60.
61
Id. at 10.
60

19

CONCLUSION
Based on the foregoing, 100TB’s Motion to Dismiss 62 is GRANTED IN PART AND
DENIED IN PART. Xat’s gross negligence and unjust enrichment claims are dismissed.
100TB’s motion is denied with respect to Xat’s remaining claims.
IT IS SO ORDERED.
Dated this 2nd Day of February, 2017.
BY THE COURT:

Paul M. Warner
Chief United States Magistrate Judge

62

Dkt. No. 15.

20