Opinion · District Court, N.D. California
In re Salesforce Customers Security Incident Litigation
In re Salesforce Customers Sec. Incident Litig., No. 3:25-cv-07232, UP11441529 (District Court, N.D. California Sept. 14, 2026)
- Type
- Opinion
- Court
- District Court, N.D. California
- Jurisdiction
- California
- Date
- 2026-09-14
- Topic
- litigation
1 2 3 4 UNITED STATES DISTRICT COURT 5 NORTHERN DISTRICT OF CALIFORNIA 6 7 In re Salesforce Customers Security Incident Case No. 25-cv-07232-JSC Litigation 8 ORDER RE: DEFENDANT’S MOTION 9 TO DISMISS 10 Re: Dkt. No. 86 11 12 13 Plaintiffs, on behalf of themselves and putative classes, bring various claims against 14 Defendants arising from an alleged data breach which compromised Plaintiffs’ personal 15 information. (Dkt. No. 81.)1 Defendant Salesforce, Inc. moves to dismiss Plaintiffs’ consolidated 16 complaint, arguing Plaintiffs do not plausibly allege they have Article III standing and Plaintiffs 17 do not state claims for negligence under California law or for violations of California, Illinois, and 18 Washington state statutes. (Dkt.
Citator
UpLaw has not yet analyzed In re Salesforce Customers Security Incident Litigation. The absence of a flag is not a finding that it is good law.
1
2
3
4 UNITED STATES DISTRICT COURT
5 NORTHERN DISTRICT OF CALIFORNIA
6
7 In re Salesforce Customers Security Incident Case No. 25-cv-07232-JSC
Litigation
8
ORDER RE: DEFENDANT’S MOTION
9 TO DISMISS
10 Re: Dkt. No. 86
11
12
13 Plaintiffs, on behalf of themselves and putative classes, bring various claims against
14 Defendants arising from an alleged data breach which compromised Plaintiffs’ personal
15 information. (Dkt. No. 81.)1 Defendant Salesforce, Inc. moves to dismiss Plaintiffs’ consolidated
16 complaint, arguing Plaintiffs do not plausibly allege they have Article III standing and Plaintiffs
17 do not state claims for negligence under California law or for violations of California, Illinois, and
18 Washington state statutes. (Dkt. No. 86.) Having carefully considered the parties’ written
19 submissions and having had the benefit of oral argument on September 10, 2026, the Court
20 GRANTS in part and DENIES in part Defendant’s motion for the reasons set forth below.
21 GENERAL FACTUAL ALLEGATIONS
22 Defendant Salesforce, Inc. is a publicly traded company which provides a software,
23 Salesforce, “the world’s largest customer relationship management (‘CRM’) platform[.]” (Dkt.
24 No. 81 ¶¶ 2, 10.) “Salesforce’s clients use the Salesforce CRM platform to store the information
25 they collect about their customers and employees (e.g., Plaintiffs and Class Members), including
26 on cloud servers maintained by Salesforce.” (Id. ¶ 2.) “Salesforce manages the servers that hold
27
1 the information provided by its clients” and “Salesforce accepts responsibility for securing the
2 overall ‘infrastructure’ of the Salesforce CRM and platform.” (Id. ¶¶ 6, 42.) “As a condition of
3 doing business, Salesforce requires that its clients entrust it with highly sensitive [personal
4 identifying information (‘PII’)] belonging to their customers[.]” (Id. ¶ 3.)
5 Plaintiffs are customers and employees of three companies “which used Salesforce’s
6 platform to collect, organize, store, and maintain Plaintiffs’ and Class Members’ sensitive data.”
7 (Id. ¶ 15.) Those three companies are: Allianz Life Insurance Company of North America
8 (“Allianz”), Farmers Group, Inc. (“Farmers”), and TransUnion, LLC (“TransUnion”). (Id. ¶¶ 12-
9 14.) Eight named plaintiffs are Allianz customers or employees, two are Farmers customers or
10 employees, and eight are TransUnion customers or employees. (Id. ¶¶ 18-35.)
11 Since late 2024, a group named “SLH” began hacking into the Salesforce platform by
12 “exploit[ing …] a mechanism built into” the platform known as “OAuth tokens.” (Id. ¶¶ 48, 50.)
13 “Salesforce issues” those OAuth tokens “[w]hen a company connects” a third-party application “to
14 its Salesforce account.” (Id.) Essentially, a third-party application uses OAuth tokens in lieu of a
15 traditional username and password and a token “functions like an all-access keycard: it allows the
16 third-party application to read, export, and in some cases modify data inside Salesforce whenever
17 it needs to, without the user ever having to log in again.” (See id. ¶¶ 48, 50.)
18 Salesforce had “lax security of OAuth tokens.” (Id. ¶ 49.) Specifically, Salesforce “failed
19 to adequately vet” and “audit[]” third-party applications and did not implement “three
20 straightforward” measures which are “standard practice on comparable cloud platforms” and
21 would have made “OAuth tokens more secure.” (Id. ¶¶ 53, 54.) “By designing its platform to be
22 easily accessible to numerous unverified third-party vendors, Salesforce became a target of
23 cybercriminals: a platform with millions of sensitive records and its doors wide open.” (Id. ¶ 49.)
24 The SLH group “recognized that Salesforce had weak access controls related to OAuth
25 tokens” and began “targeting organizations” like Allianz, Farmers, and TransUnion that “used
26 Salesforce as their CRM platform.” (Id. ¶¶ 47, 48.) In broad strokes, SLH’s hack worked as
27 follows. SLH first used a “malicious application” to generate an 8-character code which could
1 “employee by phone, posing as a member of the target company’s IT department or help desk, and
2 instructed the employee to navigate to Salesforce’s verification page and enter the code.” (Id.) If
3 the employee complied and entered the code, the Salesforce platform “issued an access token (i.e.,
4 a key) to the attacker[]” which gave the attacker “access to the victim organization’s Salesforce
5 environment with all of the permissions the employee had configured[.]” (Id. ¶ 51.) Ultimately,
6 SLH’s method of exploiting employees and OAuth tokens “bypassed multi-factor authentication
7 entirely,” “established persistent access” to victim organizations’ data, and allowed cybercriminals
8 to “conduct bulk data exports of dozens of Salesforce’s clients data held on Salesforce’s platform”
9 “from approximately March 2025 through at least August 2025[.]” (Id. ¶¶ 51, 52.)
10 “The Data Breach compromised millions of people’s PII.” (Id. ¶ 60.) After bulk
11 downloading data from Salesforce’s clients such as Allianz, Farmers, and TransUnion, SLH
12 “posted dozens of samples or full datasets” of stolen data on the Internet. (Id. ¶ 61.) Allianz,
13 Farmers, and TransUnion have “admitted” the data compromised includes various forms of PII,
14 including Social Security Numbers (“SSN”), names, addresses, dates of birth, and driver’s license
15 numbers. (Id. ¶ 64.)
16 Plaintiffs allege various harms flowing from the data breach. All named plaintiffs allege
17 they (1) received a “data breach Notice Letter from” one of the three hacked companies; (2) are
18 now subject to a “present and continuing risk of fraud, identify theft, and misuse resulting from”
19 the data breach; and (3) to mitigate those risks, they “invested” varying degrees of “time,
20 resources, and energy to safeguard their identities, information, and accounts, and will need to
21 continue to do so for years to come.” (See generally id. ¶¶ 68, 105-209.) Some Plaintiffs allege
22 suspicious, fraudulent, and/or attempted fraudulent activity has occurred on their bank accounts or
23 credit cards, and some allege they were “forced” to get a new credit card. (See, e.g., id. ¶¶ 108,
24 140-42, 162-164, 168-172, 176-178.) Additionally, Plaintiffs have monitored and mitigated those
25 risks of harm in various ways. Every named plaintiff alleges they have spent time “reviewing
26 financial accounts and credit reports for instances of fraud,” while some allege efforts like
27 “placing a credit freeze,” “changing passwords,” and “setting up virtual cards to replace use of
1 of time they have spent on monitoring and mitigation efforts, and the estimates range anywhere
2 from “over three hours” total to “ten hours per week.” (See, e.g., id. ¶¶ 109, 140, 182.)
3 DISCUSSION
4 Defendant moves to dismiss Plaintiffs’ complaint under Federal Rules of Civil Procedure
5 12(b)(1) and (b)(6). Defendant asserts Plaintiffs have not plausibly alleged they have Article III
6 standing or claims for negligence or for violations of California’s Consumer Privacy Act, Illinois’
7 Consumer Fraud Act, and Washington’s Consumer Protection Act.2
8 I. Article III Standing
9 Article III standing requires Plaintiffs allege (1) they suffered an “injury in fact,” (2) “a
10 causal connection between the injury and the conduct complained of,” and (3) the injury will
11 “likely … be redressed by a favorable decision.” Lujan v. Defenders of Wildlife, 504 U.S. 555
, 12 560–61 (1992) (cleaned up). An injury-in-fact must be “concrete and particularized” and “actual 13 or imminent, not conjectural or hypothetical.”Id. at 560
(cleaned up). Additionally, to satisfy the 14 causation prong, the alleged injury must be “fairly … trace[able] to the challenged action of the 15 defendant, and not th[e] result [of] the independent of some third party not before the court.”Id.
16 at 560–61 (quoting Simon v. Eastern Ky. Welfare Rts. Org.,426 U.S. 26
, 41–42 (1976)). 17 So, Defendant’s burden is to show drawing all reasonable inferences in Plaintiffs’ favor 18 from the complaint, Plaintiffs’ allegations do not support an inference the elements of Article III 19 standing are met. Defendant asserts Plaintiffs’ allegations about a risk of future harm are too 20 speculative to satisfy the injury-in-fact requirement and Plaintiffs’ injuries are not fairly traceable 21 to Salesforce’s conduct. The Court disagrees. 22 A. Plaintiffs Plausibly Allege an Injury-In-Fact 23 “To establish Article III standing, an injury must be ‘concrete, particularized, and actual or 24 imminent[.]’” Clapper v. Amnesty Int’l USA,568 U.S. 398, 409
(2013) (quoting Monsanto Co. v. 25 Geertson Seed Farms,561 U.S. 139, 149
(2010)). Here, every plaintiff alleges the data breach has
26
27
2 Plaintiffs withdrew their claims for violations of the California Customer Records Act, the
1 subjected them to a “present and continuing risk of fraud, identify theft, and misuse” of their
2 personal information and to mitigate those risks, they “invested” varying amounts of “time,
3 resources, and energy to safeguard their identities, information, and accounts, and will need to
4 continue to do so for years to come.” (See generally Dkt. No. 81 ¶¶ 68, 105-209.) In other words,
5 Plaintiffs allege a risk of future harm and they have incurred costs to monitor and mitigate those
6 risks.
7 Plaintiffs allege various facts to support the allegation they are at risk of identity theft and
8 fraud. Every named plaintiff alleges they “received a data breach Notice Letter from” one of the
9 three Salesforce client companies between July 2025 and September 2025. (Id. ¶¶ 105-209.) As
10 relevant here, the Notice Letter from Allianz states:
11 What Happened? On July 16, 2025, a malicious threat actor gained
access to a cloud-based system used by Allianz Life. The threat actor
12 was able to obtain certain personal information related to Allianz Life
customers, financial professionals, and select Allianz Life employees.
13 We took immediate action to contain and mitigate the issue. Based on
our investigation to-date, there is no evidence the Allianz Life
14 network or other company systems were accessed. […]
15 What Information Was Involved? The affected data may have
included your name, address, date of birth and Social Security
16 number.
17 (Dkt. No. 87 at 1, citing https://oag.ca.gov/system/files/ELN-
18 24798%20Allianz%20Life%20Ins%20Adult%20CM%2024M%20CA%20r2prf.pdf.) And the
19 Notice Letter from Farmers states:
20 WHAT HAPPENED? On May 30, 2025, one of Farmers’ third-party
vendors alerted Farmers to suspicious activity involving an
21 unauthorized actor accessing one of the vendor’s databases
containing Farmers customer information (the “Incident”). […] After
22 learning of the activity, Farmers immediately launched a
comprehensive investigation to determine the nature and scope of the
23 Incident[. …] The in-depth investigation determined that an
unauthorized actor accessed the vendor’s database on May 29, 2025,
24 and acquired certain data. With the assistance of a third-party data-
review expert, Farmers conducted a comprehensive review to
25 determine what data had been accessed and acquired, whether the data
contained personal information, and to whom the personal
26 information belonged. On July 24, 2025, the review determined that
some of your personal information was subject to unauthorized access
27 and acquisition.
of your personal information were involved: [redaction]
1
2 (Id., citing
3 https://oag.ca.gov/system/files/FIE%20Sample%20Notification%20Letter_All%20States_0.pdf.)
4 “Based on the Notice Letter” they received, eight plaintiffs allege they “reasonably
5 believe[]” their “name, address, date of birth, and SSN were compromised in the Data Breach[.]”
6 (Id. ¶¶ 105, 111, 117, 122, 132, 137, 143, 154.) By contrast, nine named plaintiffs3 do not allege
7 they “reasonably believe[]” their information was compromised, and instead allege they received a
8 Notice Letter which “informed” them or “informed [them] unequivocally” that certain categories
9 of information “were compromised in the Data Breach.” (Id. ¶¶ 148, 159, 165, 173, 179, 185,
10 192, 198, 204.) Of the plaintiffs who “reasonably believe[]” their information was compromised,
11 seven4 do not specifically allege examples of their information being misused as other plaintiffs
12 allege, e.g., their information was “exposed on the dark web,” “unauthorized charges” on their
13 credit card, or “attempted fraudulent activity.” (Id. ¶¶ 105, 111, 117, 122, 132, 137, 143, 154; see,
14 e.g., id. ¶¶ 152, 163, 169.) Six of those seven plaintiffs received a letter from Allianz; the seventh
15 plaintiff received a letter from Farmers.
16 Defendant argues Plaintiffs do not plausibly allege an injury-in-fact because they rely on
17 “speculative allegations about a ‘risk’ of potential future harm[.]” (Dkt. No. 86 at 12.) Separately,
18 Defendant asserts seven plaintiffs in particular “fail to allege any injury at all.” (Id. at 17.)
19 Defendant singles out the seven plaintiffs who do not allege examples of misuse, and instead
20 allege they “reasonably believe[]” their information was compromised based on the Notice Letter
21 they received from Allianz or Farmers. Defendant emphasizes the letters do not “confirm[] that
22 any specific information was stolen, let alone misused” because the letters use phrases like “the
23
3 Ten plaintiffs use the phrase “informed” or “informed […] unequivocally.” Those plaintiffs are
24
Mr. Garcia, Ms. Dean, Mr. Doyle, Mr. Gilhooly, Mr. Koplitz, Mr. Keith, Ms. Lovell, Mr.
Pettersen, Ms. Tomas, and Mr. Zurawskyj. One of these ten plaintiffs, Mr. Koplitz, alleges both
25
“the Notice Letter informed” him that certain information was “compromised” and he “reasonably
believes” that information was compromised “[b]ased on the Notice Letter.” (Dkt. No. 81 ¶ 132.)
26
4 These seven plaintiffs are Mr. Carter, Ms. Goldstein, Ms. Hansch, Ms. LaMarre, Mr. Kim, Mr.
Koplitz, and Ms. Taylor. Another named plaintiff, Mr. Stockton, alleges he “reasonably believes”
27
his information was compromised and “he received a notice from his bank, Chase, that attempted
1 affected data may have included …” and “your personal information was subject to unauthorized
2 access[.]” (Id. at 19 (emphasis in motion).) The Court disagrees on all points.
3 i. All Plaintiffs Plausibly Allege a Sufficient Risk of Harm
4 The Ninth Circuit has twice held allegations of a risk of future identity theft are sufficient
5 to confer Article III standing. First, in Krottner v. Starbucks Corp., 628 F.3d 1139
(9th Cir. 2010), 6 someone stole a laptop containing roughly 97,000 Starbucks employees’ “unencrypted names, 7 addresses, and social security numbers.” Id. at 1140. “Starbucks sent a letter to […] affected 8 employees alerting them to the theft and stating that Starbucks had ‘no indication that the private 9 information ha[d] been misused.’” Id. at 1140–41. The Ninth Circuit held the plaintiffs’ 10 “increased risk of future identity theft” “sufficiently alleged an injury-in-fact for purposes of 11 Article III standing” because the alleged risk constituted a “‘credible threat of harm’ […] that is 12 ‘both real and immediate, not conjectural or hypothetical.’” Id. at 1142–43 (quoting Cent. Delta 13 Water Agency v. United States,306 F.3d 938
, 950 (9th Cir. 2002) and City of Los Angeles v. 14 Lyons,461 U.S. 95, 102
(1983)). 15 Subsequently, In re Zappos.com, Inc.,888 F.3d 1020
(9th Cir. 2018) held plaintiffs 16 satisfied the injury-in-fact requirement when they alleged a “data breach put them at risk of 17 identity theft.”Id. at 1023
. There, “hackers breached the servers” of a company and “stole 18 [customers’] names, account numbers, passwords, email addresses, […] addresses, telephone 19 numbers, and credit and debit card information,” then the company “sent an email to its customers, 20 notifying them of the theft of their PII.”Id.
The Ninth Circuit held Krottner “remains binding” 21 after the Supreme Court’s decision in Clapper, “Krottner control[led] the result” of the case, and 22 the plaintiffs “sufficiently alleged an injury in fact under Krottner […] based on a substantial risk 23 that the […] hackers will commit identity fraud or identity theft.”Id.
at 1026–27, 29. 24 Applying Krottner and Zappos.com here, drawing inferences in Plaintiffs’ favor, Plaintiffs’ 25 allegations plausibly support an inference they have suffered a “substantial risk” of identity fraud 26 or identity theft.Id. at 1029
. Every plaintiff alleges they received a notice from Allianz, Farmers, 27 or TransUnion describing the data breach. (See generally Dkt. No. 81 ¶¶ 64, 68, 105-209.) 1 information” and “[t]he affected data may have included your name, address, date or birth, and 2 Social Security number.” (Id. ¶ 64 & n.34; Dkt. No. 87 at 1.) Farmers’ letter explained “an 3 unauthorized actor […] acquired certain data” and Farmers “determined that some of your 4 personal information was subject to unauthorized access and acquisition.” (Id.) Although the 5 publicly available version of Farmers’ letter is redacted, Plaintiffs allege the Farmers hack 6 compromised their “[n]ames, addresses, dates of birth, driver’s license numbers, and the last four 7 digits of SSNs.” (Dkt. No. 81 ¶ 64.) And while Plaintiffs do not link to or attach TransUnion’s 8 letter as an exhibit, all TransUnion Plaintiffs allege the letter “informed [them] unequivocally that 9 [their] date of birth and SSN were compromised in the Data Breach.” (Id. ¶¶ 159, 165, 173, 179, 10 185, 192, 198, 204.) Drawing inferences in Plaintiffs’ favor, that each company sent a letter to 11 Plaintiffs describing the data breach and specific types of sensitive information disclosed supports 12 an inference Plaintiffs are at risk of future identity theft and fraud. 13 Additionally, drawing inferences in Plaintiffs’ favor, Plaintiffs plausibly allege facts 14 supporting an inference the risk of identity theft and fraud is a “credible threat of harm […] that is 15 both real and immediate, not conjectural or hypothetical.” Krottner, 628 F.3d at 1142–43 (cleaned 16 up). Plaintiffs specifically allege how SSNs and driver’s license numbers are used to commit 17 identity theft and fraud. (See Dkt. No. 81 ¶¶ 65, 66.) Plaintiffs also allege the SLH group “posted 18 samples of data stolen from Salesforce,” demanded “Salesforce pay a ransom,” then “posted 19 dozens of samples or full data sets […] on the Internet” in a way that is “available for 20 download[.]” (Id. ¶ 61.) Several plaintiffs, including two Allianz plaintiffs and nearly every 21 TransUnion plaintiff, also allege examples of actual or attempted misuse of their personal 22 information after the data breach, e.g., they “received notice” of “unauthorized charges” on their 23 credit card, “attempted fraudulent activity,” or “an unauthorized inquiry […] made in [their] name 24 for a new credit card.” (Id. ¶¶ 105, 141, 169-170, 177, 190, 196, 202, 208.) Four plaintiffs– 25 including Mr. Garcia, a Farmers plaintiff, and three TransUnion plaintiffs–expressly allege their 26 personal information has been found in the dark web, where there is a “thriving market” for 27 “stolen PII.” (Id. ¶¶ 71, 152 (“Plaintiff Garcia was told by a monitoring service that his SSN was 1 discovered that her confidential information was on the dark web.”); 183 (“Plaintiff [Keith] 2 learned through Nord NVP that his PII was published on the dark web.”) 189 (“Plaintiff Lovell[’s 3 …] credit monitoring service […] discovered her confidential information on the dark web.”)) 4 Drawing inferences in Plaintiffs’ favor, these facts are sufficient to support an inference the risk of 5 identity theft and fraud is “real and immediate, not conjectural or hypothetical.” Krottner, 628 6 F.3d at 1142–43 (cleaned up). 7 Defendant contends under TransUnion LLC v. Ramirez,594 U.S. 413
(2021), Plaintiffs’ 8 alleged risk of future injury is not sufficiently “concrete” for any named plaintiff to seek damages. 9 Not so. Here, every plaintiff alleges they have spent time, energy, and resources monitoring and 10 mitigating the risks of identity theft and fraud. Therefore, unlike TransUnion, Plaintiffs allege 11 they are “independently harmed by their exposure to the risk itself—that is, that they suffered 12 some other injury […] from the mere risk” of future injury.Id. at 437
. 13 Clapper, too, is inapposite. There, the plaintiffs asserted they suffered an injury-in-fact 14 based on a threat of future surveillance and costs incurred as a reaction to the risk of surveillance, 15 and the Court rejected both theories because plaintiffs’ evidence “amount[ed] to mere speculation” 16 that the asserted future injury would occur. 568 U.S. at 410–14; seeid. at 416
(rejecting the 17 plaintiffs’ theory regarding costs “[b]ecause” future harm was not sufficiently imminent.) Clapper 18 is therefore distinguishable because as explained above, Plaintiffs’ allegations permit an inference 19 the risk of future identity fraud and theft is “real and immediate,” not speculative. Krottner, 628 20 F.3d at 1142–43 (cleaned up). So, because Plaintiffs allege they incurred monitoring and 21 mitigation costs as a reaction to a real and immediate risk, Plaintiffs allege “sufficiently concrete” 22 harms for injury-in-fact purposes “even if” the risk itself has not yet resulted in, for example, 23 Plaintiffs becoming victims of a successful identity fraud scheme. Monsanto,561 U.S. at 155
; see 24 also Clapper,568 U.S. at 420
(distinguishing Monsanto on the ground “respondents in the present 25 case present no concrete evidence to substantiate their fears, but instead rest on mere conjecture 26 about possible governmental actions.”) And, after Clapper was decided, the Ninth Circuit held 27 Knotter “remains binding” and “controls the result” of a case where plaintiffs alleged a future risk 1 ii. The Seven Identified Plaintiffs Plausibly Allege a Sufficient Risk of 2 Harm 3 Drawing inferences in Plaintiffs’ favor, those risks are “real and immediate” even for seven 4 plaintiffs who do not allege misuse of their personal information. As noted above, one of those 5 plaintiffs is a Farmers customer, Mr. Muro. Six are Allianz plaintiffs. Allianz’s letter told these 6 plaintiffs “a malicious threat actor […] was able to obtain […] personal information” and “[t]he 7 affected data may have included your name, address, date or birth, and Social Security number.” 8 (Id. ¶ 64 & n.34; Dkt. No. 87 at 1 (emphasis added).) Plaintiffs allege how that affected data can 9 be used to commit identity fraud, and two other Allianz plaintiffs allege “attempted fraudulent 10 activity” following the data breach which “forced” them to get a new credit card or credit card 11 number.” (Dkt. No. 81 ¶¶ 108, 141.) Therefore, drawing inferences in Plaintiffs’ favor, Plaintiffs’ 12 allegations are sufficient to support an inference all Allianz plaintiffs have a “real and immediate” 13 risk of identity theft and fraud. 14 The same is true of the seventh plaintiff, Mr. Muro, a Farmers customer. As noted above, 15 Farmers’ Notice Letter informed Mr. Muro “an unauthorized actor […] acquired certain data” and 16 Farmers “determined that some of your personal information was subject to unauthorized access 17 and acquisition.” (Dkt. No. 87 at 1.) Plaintiffs separately allege that information includes 18 “[n]ames, addresses, dates of birth, driver’s license numbers, and the last four digits of SSNs.” 19 (Dkt. No. 81 ¶ 64.) Moreover, the only other Farmers plaintiff, Mr. Garcia, alleges he “was told 20 by a monitoring service that his SSN was exposed on the dark web.” (Id. ¶ 152.) Drawing 21 inferences in Plaintiffs’ favor, Mr. Muro’s highly sensitive personal information was acquired by 22 the bad actors. Further, that Mr. Garcia’s SSN was exposed on the dark web is sufficient to 23 support an inference Mr. Muro is at risk of identity theft because Plaintiffs specifically allege “[i]n 24 similar breach cases involving a centralized repository of data affecting multiple customers who 25 use the repository, when information from one customer appears on the dark web, breached data 26 from other customers has typically followed or has already been sold” and “given that the dark 27 web is designed to conceal users’ activities, the task of detecting, monitoring, and redressing 1 information appears on the dark web following a data breach (i.e., Garcia’s SSN, stolen from 2 Farmers), that “typically” means data belonging to other victims of the same data breach (i.e., Mr. 3 Muro) will be, or has already been sold, on the dark web. (See id.) Accepting that allegation as 4 true, and drawing inferences in Plaintiffs’ favor, Plaintiffs allege facts sufficient to support an 5 inference Mr. Muro’s risk of identity theft and fraud is “real and immediate, not conjectural or 6 hypothetical.” Krottner, 628 F.3d at 1142–43 (cleaned up). 7 Defendant’s argument the Allianz and Farmers letters do not “confirm[] that any specific 8 information was stolen, let alone misused” (Dkt. No. 86 at 19) is unavailing. Defendant urges the 9 Allianz letter used the phrase “the affected data may have included …” and the Farmers letter 10 stated “some” “personal information was subject to unauthorized access and acquisition[.]” (Dkt. 11 No. 86 at 19 (first and third emphasis in motion).) The Allianz letter specifically states 12 cybercriminals were “able to obtain personal information.” (Dkt. No. 81 ¶ 64 & n.34; Dkt. No. 87 13 at 1.) Therefore, the letter’s subsequent phrasing regarding what types of personal information 14 that “may” include does not compel the inference the Allianz plaintiffs do not face a real and 15 immediate risk of identity fraud; rather, drawing inferences in Plaintiffs’ favor, the word “may” 16 supports an inference each Allianz plaintiff’s sensitive information was stolen from Allianz. 17 Similarly, the Farmers letter’s use of the phrases “some” and “subject to” does not defeat an 18 inference Mr. Muro faces a real and immediate risk of identity fraud because Mr. Muro 19 specifically alleges he “provided” “his driver’s license number and address […] to Farmers,” the 20 letter says threat actors “acquired certain data,” Mr. Garcia (the only other Farmers plaintiff) 21 alleges his SSN was exposed on the dark web, and Plaintiffs essentially allege the exposure of Mr. 22 Garcia’s information “typically” means Mr. Muro’s information is or will be on the dark web. 23 (See Dkt. No. 81 ¶¶ 63, 64 & n.34, 152, 154; Dkt. No. 87 at 1.) 24 Defendant’s reliance on Greenstein v. Noblr Reciprocal Exchange,2024 WL 3886977
(9th
25 Cir. Aug. 21, 2024) is misplaced. Defendant cites Greenstein to essentially argue Allianz’s and
26 Farmers’ letters do not support an inference sensitive information was stolen from the six Allianz
27 plaintiffs and Mr. Muro. There, the court held two plaintiffs did not allege an injury-in-fact
1 information was actually stolen” in a data breach. Id. at *2. The court explained the plaintiffs’
2 allegations rely heavily on a notice Noblr sent to 97,633 individuals—
including Plaintiffs—several months after the attack. But the
3 description of the attack provided in the Notice, which accounts for
the bulk of the factual allegations included in the complaint, is
4 ultimately insufficient to establish that Plaintiffs’ driver's license
numbers were stolen.
5
While the Notice does confirm that “the attackers were able to access
6 driver's license numbers,” it stops short of confirming that any
individual recipient of the Notice had his or her driver's license
7 number stolen. It does not confirm which or how many driver's license
numbers were accessed, nor does it confirm whether the driver's
8 license numbers of all 97,633 recipients of the Notice were taken from
Noblr’s website. Instead, in explaining “[w]hat [i]nformation [w]as
9 [i]nvolved,” the Notice states only that each recipient’s “name,
driver’s license number, and address may have been accessed.”
10 (emphasis added). After reading the Notice, all that a reasonable
reader would know for certain is that Noblr suffered a cyberattack,
11 some driver's license numbers were taken as a result, and his own
driver's license number may (or may not) have been among those
12 stolen. Aside from the factual allegations pulled from the Notice,
Plaintiffs provide no additional allegations that might provide a
13 credible basis to conclude their driver’s license numbers were taken.
14 Id. at *1-2.
15 Greenstein is unpublished and distinguishable in two respects. First, unlike the Greenstein
16 Notice, the Allianz and Farmers letters supply a “credible basis to conclude” those seven plaintiffs
17 sensitive information “w[as] taken.” Id. at *2. Whereas Greenstein’s Notice stated “each
18 recipient’s ‘name, driver’s license number, and address may have been accessed,’” id. (first
19 emphasis in original), Allianz’s letter says hackers were actually “able to obtain personal
20 information” and Farmers’ letter explains “personal information was subject to unauthorized
21 access and acquisition” then specifies the “types of your personal information” which “were
22 involved.” (Dkt. No. 81 ¶ 64 & n.34; Dkt. No. 87 at 1 (emphasis added).) Second, Plaintiffs rely
23 on more than just “allegations pulled from the Notice[s]” to allege their sensitive information was
24 among the information stolen. Greenstein, 2024 WL 3886977
, at *2. For instance, Plaintiffs 25 specifically allege hackers downloaded “bulk data,” as opposed to merely “accessed” data, and 26 cite numerous news articles describing the cyberattack and the information stolen. (See Dkt. No. 27 81 ¶¶ 52, 91; see generallyid.
¶¶ 61-64 & n. 29-36.) 1 B. Plaintiffs Plausibly Allege Injuries Fairly Traceable to Defendant’s Conduct 2 “To survive a motion to dismiss for lack of constitutional standing, plaintiffs must 3 establish a ‘line of causation’ between defendant[’s] action and their alleged harm that is more 4 than ‘attenuated.’” Maya v. Centex Corp.,658 F.3d 1060, 1070
(9th Cir. 2011) (quoting Allen v.5 Wright, 468
U.S. 737, 757 (1984)). “A causation chain does not fail simply because it has several 6 ‘links,’ provided those links are ‘not hypothetical or tenuous’ and remain ‘plausib[le].’”Id.
7 (quoting Nat’l Audobon Soc., Inc. v. Davis,304 F.3d 835, 849
(9th Cir. 2002)). Here, Defendant 8 argues Plaintiffs’ injuries are not fairly traceable to Defendant’s conduct because “every alleged 9 injury depends on acts by third parties,” namely cybercriminals, Salesforce’s customers who 10 hosted Plaintiffs’ data, and employees of those customers who were tricked by cybercriminals. 11 (Dkt. No. 86 at 17.) The Court disagrees. 12 Drawing inferences in Plaintiffs’ favor, Plaintiffs’ allegations support a plausible inference 13 there is a “‘line of causation’ between defendant[’s] action and their alleged harm that is more than 14 ‘attenuated.’” Maya,658 F.3d at 1070
(quoting Allen, 468 U.S. at 757). The alleged line of 15 causation is fairly straightforward: Salesforce “failed to” take specific steps to make “OAuth 16 tokens more secure,” making “its platform […] easily accessible to numerous unverified third- 17 party vendors[.]” (Dkt. No. 81 ¶¶ 49, 53, 54.) Three actions which Salesforce failed to take are 18 allegedly “standard practice.” (Id.) Consequently, cybercriminals “recognized” Salesforce’s “lax 19 security” and began “targeting organizations that used Salesforce as their CRM platform,” which 20 caused the data breach and Plaintiffs’ injuries. (Id. ¶¶ 47-49.) 21 That third parties like cybercriminals and Salesforce’s clients’ employees are part of the 22 causal chain does not mean the links in the causal chain are too attenuated to confer Article III 23 standing because Plaintiffs’ allegations support an inference Salesforce’ “lax security” with OAuth 24 tokens is the enabling, underlying cause of the data breach. In that sense, drawing inferences in 25 Plaintiffs’ favor, Plaintiffs’ injuries are fairly traceable to Salesforce’s conduct. Relatedly, 26 Defendant’s argument “Plaintiffs do not allege that cybercriminals bypassed Salesforce security 27 controls or exploited Salesforce systems to access Plaintiffs’ PII” (Dkt. No. 86 at 18) is plainly 1 into” the Salesforce platform, “Salesforce issues” those tokens, and the SLH group’s exploitation 2 of OAuth tokens “bypassed multi-factor authentication entirely[.]” (Dkt. No. 81 ¶¶ 48-51.) 3 Accepting those allegations as true, and drawing inferences in Plaintiffs’ favor, Plaintiffs have 4 plausibly alleged a sufficiently strong causal chain between Plaintiffs’ injuries and Defendant’s 5 failure to implement steps to make OAuth tokens more secure. 6 Defendant’s cited cases do not persuade. Of Defendant’s cited cases addressing Article 7 III’s causation requirement, only two are binding authority. The first, WildEarth Guardians v. 8 United States Forest Serv.,70 F.4th 1212
(9th Cir. 2023), is inapposite because it applied rules 9 specific to government-agency defendants. Seeid.
at 1216–17;id.
at 1217–18 (applying cases 10 “[w]here an essential element of standing depends on the reaction of a third party to the requested 11 government action or inaction”) (cleaned up) (emphasis added). The second case, Simon, is also 12 inapposite because it held the plaintiffs’ injuries were not fairly traceable to the defendants’ 13 conduct because the alleged connection required “[s]peculative inferences.”426 U.S. at 45
. But 14 here, the connection between Plaintiffs’ injuries and Salesforce’s conduct does not require 15 speculative inferences. Rather, as explained above, Plaintiffs allege a line of causation where each 16 causal link is plausible and not attenuated. 17 Defendant’s remaining cases–Williams v. Sisolak,2024 WL 194180
(9th Cir. Jan. 18, 18 2024) and Al-Sadhan v. Twitter Inc.,2024 WL 536311
(N.D. Cal. Feb. 9, 2024)–fare no better. 19 Defendant cites both cases for the argument Article III’s causation requirement is not satisfied 20 when there are “numerous third parties whose independent decisions collectively have a 21 significant effect on plaintiffs’ injuries.” (Dkt. No. 86 at 16 (cleaned up).) Neither case applied 22 that rule to a data breach. Nor does Defendant cite a case applying that rule to a theory analogous 23 to Plaintiffs’ here: Salesforce’s “lax security” was the enabling, underlying cause of Plaintiffs’ 24 injuries. Rather, Williams addressed “claims based on government action or inaction” and held the 25 plaintiffs did not allege Article III standing under WildEarth.2024 WL 194180
at *1-2. And Al- 26 Sadhan held a plaintiff’s own “decisions, undertaken on her own volition, effected her injuries and 27 broke the chain of causation” between her injuries and the defendant’s conduct.2024 WL 536311
1 Accordingly, Defendant has not met its burden to show drawing all inferences in Plaintiffs’ 2 favor, Plaintiffs’ allegations do not permit an inference Plaintiffs’ injuries are fairly traceable to 3 Defendant’s conduct. 4 II. Negligence (Count I) 5 Defendant moves to dismiss Plaintiffs’ California-state-law negligence claim.5 Under 6 California law, “[t]o establish a cause of action for negligence, the plaintiff must show that the 7 defendant had a duty to use due care, that he breached that duty, and that the breach was the 8 proximate or legal cause of the resulting injury.” Brown v. USA Taekwondo,11 Cal. 5th 204
, 213 9 (2021) (cleaned up). Defendant asserts Plaintiffs do not plausibly allege the elements of duty, 10 breach, causation, and damages. 11 A. Duty 12 Under California law, the “‘general rule’ governing duty is set forth in Civil Code section 13 1714,” which “establishes the default rule that each person has a duty to exercise, in his or her 14 activities, reasonable care for the safety of others.”Id.
at 213–14 (cleaned up). Section 1714
15 “imposes a general duty of care on a defendant only when it is the defendant who has created a
16 risk of harm to the plaintiff, including when the defendant is responsible for making the plaintiff’s
17 position worse.” Id. at 214 (cleaned up).
18 A separate rule, the so-called “no-duty-to-protect rule,” provides “one owes no duty to
19 control the conduct of another, nor to warn those endangered by such conduct.” Id. at 214–15.
20 For example, “a person who stumbles upon someone drowning generally has no legal duty to help
21 the victim. The same rule applies to a person who stumbles upon a mugging, for as a general
22 matter, there is no duty to act to protect others from the conduct of third parties.” Id. (cleaned up).
23 So, summarizing these two general rules, Brown held “[w]here the defendant has neither
24
25
5 Defendant also argues California law does not govern the non-California Plaintiffs’ negligence
claims under California’s three-step “governmental interest” test. See McCann v. Foster Wheeler
26
LLC, 48 Cal. 4th 68
, 87–88 (2010). The Court defers the choice-of-law question to a later stage,
given the parties’ briefing on California’s governmental-interest test is supposed to compare the
27
relevant substantive law and interests of four states, is short and insufficient. (See Dkt. No. 86 at
1 performed an act that increases the risk of injury to the plaintiff nor sits in a relation to the parties
2 that creates an affirmative duty to protect the plaintiff from harm, […] our cases have uniformly
3 held the defendant owes no legal duty to the plaintiff.” Id. at 216
. 4 Here, Plaintiffs assert Salesforce owed them a duty of care because Salesforce’s conduct 5 created a foreseeable risk of harm with respect to Plaintiffs’ personal information, and, “[i]n the 6 alternative, Salesforce had a duty of care given its special relationship with Plaintiffs[.]” (Dkt. No. 7 81 ¶ 92; Dkt. No. 92 at 14-15.) Defendant argues Plaintiffs have not alleged a duty of care 8 because “Brown does not eliminate the special relationship requirement to impose liability from 9 third-party conduct.” (Dkt. No. 96 at 7.) In other words, Defendant’s motion is premised on the 10 idea Plaintiffs must “allege [a] special relationship […] to plead a duty” under California law. 11 (Id.) 12 That premise is incorrect. “[A]ll persons are required to use ordinary care to prevent others 13 from being injured as the result of their conduct.” Weirum v. RKO Gen., Inc.,15 Cal. 3d 40
, 46 14 (1975). In Weirum, the California Supreme Court held a radio broadcaster breached that duty by 15 essentially encouraging listeners to race around Los Angeles, which caused a listener to get in a 16 car crash and kill someone.Id.
at 43–47. The court reasoned the broadcaster owed a duty of care 17 to the decedent with respect to “the foreseeable consequences of his acts,” which included 18 “reckless conduct by youthful [listeners] stimulated by defendant’s broadcast.”Id. at 47
. The 19 broadcaster argued it “owed no duty of care to [the] decedent,” urging “absent a special 20 relationship, an actor is under no duty to control the conduct of third parties,” but the court 21 rejected that argument, explaining “this rule has no application if the plaintiff’s complaint […] is 22 grounded upon an affirmative act which created an undue risk of harm.”Id. at 48
. Defendant’s
23 Reply brief does not address Weirum’s clear statement of California law: the “special relationship
24 […] rule has no application if the plaintiff’s complaint […] is grounded upon an affirmative act
25 which created an undue risk of harm.”6 Id.; (Dkt. No. 96 at 7-8.)
26
6 Defendant’s sole rejoinder is “liability rested on the broadcaster’s creation of ‘an undue risk of
27
harm’ to members of the public, not merely the foreseeability of third-party criminal or negligent
1 So, here, given Plaintiffs allege Salesforce’s “affirmative act[s]” in designing its platform
2 “created an undue risk of harm,” Plaintiffs are not required to allege they had a special relationship
3 with Salesforce to plead a duty. Weirum, 15 Cal. 3d at 48
. Rather, under California law, Plaintiffs
4 may–and do–plead a duty under the theory Salesforce’s conduct created a foreseeable risk of harm
5 by third parties. Accordingly, the Court denies Defendant’s motion on the ground Plaintiffs must
6 allege a special relationship.
7 B. Breach
8 Broadly speaking, Defendant contends Plaintiffs do not plausibly allege a breach because
9 Plaintiffs do not explain “what Salesforce did wrong and how that conduct caused the alleged
10 harm.” (Dkt. No. 86 at 24.) Specifically, Defendant argues (1) “Plaintiffs do not identify any
11 specific vulnerability in Salesforce’s systems that the cybercriminals allegedly exploited” and
12 instead Plaintiffs allege “cybercriminals gained access through […] social engineering,” (2)
13 “Plaintiffs’ vague, conclusory allegations that Salesforce ‘failed to adequately’ protect their
14 information […] rely on generalized allegations of inadequate data security,” (3) “Plaintiffs fail to
15 identify any non-conclusory actions Salesforce—as opposed to [Salesforce’s] Customers—
16 supposedly should have or could have taken to secure Plaintiffs’ data or explain how any such
17 action could have prevented the social engineering attacks,” and (4) “Plaintiffs cannot point to any
18 communication or notice from Salesforce to support a finding of any breach by Salesforce.” (Id.
19 at 25.) The Court disagrees on all four points.
20 Drawing inferences in Plaintiffs’ favor, Plaintiffs’ allegations support a plausible inference
21 Defendant breached a duty of care with respect to Plaintiffs’ personal information. Plaintiffs
22
23
Customers’ employees into authorizing a malicious application.” (See Dkt. No. 96 at 7 (quoting
Weirum, 15 Cal. 3d at 48
).) Defendant’s argument is unclear. To the extent Defendant argues
24
Plaintiffs have not alleged an “undue risk of harm” like the risk in Weirum, the Court disagrees
because drawing inferences in Plaintiffs’ favor, Plaintiffs’ allegations permit an inference the risk
25
of identity theft, fraud, and misuse resulting from a data breach is undue. See Weirum, 15 Cal. 3d at 47
(“Liability is imposed only if the risk of harm resulting from the act is deemed
26
unreasonable—i.e., if the gravity and likelihood of the danger outweigh the utility of the conduct
involved.”); (see, e.g., Dkt. No. 81 ¶¶ 65-80 (explaining how identity theft and fraud occurs, the
27
difficulties in redressing identity theft, and many ways threat actors can misuse victims’ sensitive
1 allege cybercriminals gained access to sensitive data by “exploit[ing] Salesforce’s lax security of
2 OAuth tokens.” (Dkt. No. 81 ¶ 49.) Plaintiffs allege many technical details behind how OAuth
3 tokens work, including how these tokens are “a mechanism built into” the Salesforce platform,
4 “Salesforce issues” the tokens to “third-party applications,” and a token “allows the third-party
5 application to read, export, and in some cases modify data inside Salesforce […] without the user
6 ever having to log in again.” (Id. ¶¶ 48, 50.) Consistent with these technical details, Plaintiffs
7 allege Defendant breached its duty of care by “failing to adequately vet” and “audit[]” third-party
8 applications and “by failing to implement any of three straightforward options for making its
9 OAuth tokens more secure, each of which is standard practice on comparable cloud platforms[.]”
10 (Id. ¶ 53.) Then, in three separate paragraphs, Plaintiffs detail those “straightforward options,”
11 namely “Salesforce could have made tokens expire automatically,” “required tokens to rotate
12 automatically,” and/or “tied tokens to specific devices.” (Id. ¶ 53(a)-(c).)
13 Given the sheer level of detail of Plaintiffs’ allegations, Defendant’s arguments do not
14 persuade. First, Plaintiffs do, in fact, “identify a[] specific vulnerability” in Salesforce’s systems.
15 (Dkt. No. 86 at 25.) The alleged vulnerability is OAuth tokens. That this vulnerability was
16 exploited in tandem with social engineering tactics to work does not mean Salesforce did not
17 breach a duty of care. Second, Plaintiffs’ detailed allegations about the ways Salesforce could
18 have made OAuth tokens more secure are not “vague, conclusory,” or “generalized.” (Id.) Third,
19 Plaintiffs expressly allege “Salesforce issues” OAuth tokens and “Salesforce could have” taken
20 “any of” the three options “for making its OAuth tokens more secure.” (Dkt. No. 81 ¶¶ 48, 50, 53,
21 53(a)-(c) (emphasis added).) Therefore, Defendant’s suggestion “Plaintiffs fail to identify […]
22 actions Salesforce—as opposed to [Salesforce’s] Customers—supposedly should have or could
23 have taken to secure Plaintiffs’ data” (Dkt. No. 86 at 25) is without merit. Relatedly, Plaintiffs’
24 allegations about those three options support an inference Salesforce’s implementation of those
25 steps would have made OAuth tokens more secure. (See, e.g., Dkt. No. 81 ¶ 52(b) (“Salesforce
26 could have required tokens to rotate automatically. […] Had it done so, a stolen token would have
27 become worthless the first time the legitimate application used it, because Salesforce would have
1 (“Salesforce could have tied tokens to specific devices. […] Every time the token is used, the
2 holder must prove it still possesses the matching private key. An attacker who steals the token
3 itself gets nothing: without the private key from the original device, the token cannot be used
4 anywhere else.”)) Finally, given these detailed allegations are sufficient to support an inference
5 Defendant breached its duty of care, Plaintiffs need not rely on a specific “communication or
6 notice” to support an inference of breach. (Dkt. No. 86 at 25.)
7 Accordingly, the Court denies Defendant’s motion on these grounds.
8 C. Causation
9 Defendant argues Plaintiffs do not allege Salesforce’s conduct proximately caused their
10 injuries because the hacks into Salesforce’s clients were “carried out by […] using social
11 engineering” tactics. (Dkt. No. 86 at 26.) Not so. Under California law,
12 [a]n actor may be liable if the actor’s negligence is a substantial factor
in causing an injury, and the actor is not relieved of liability because
13 of the intervening act of a third person if [the] act was reasonably
foreseeable at the time of the original negligent conduct. The
14 foreseeability required is of the risk of harm, not of the particular
intervening act.
15
Rosencrans v. Domer Images, Ltd., 192 Cal. App. 4th 1072, 1087
(2024) (emphasis added)
16
(cleaned up). As explained above, Plaintiffs’ alleged causal connection is fairly straightforward:
17
Salesforce failed to vet third-party applications and failed to take three steps which would have
18
made OAuth tokens more secure, cybercriminals recognized and exploited that lax security, and
19
Plaintiffs’ injuries ensued. That the cybercriminals exploited that lax security in tandem with
20
another tactic like social engineering does not defeat an inference Salesforce’s actions were a
21
substantial factor in causing Plaintiffs’ injuries because drawing inferences in Plaintiffs’ favor,
22
Plaintiffs allege facts sufficient to support an inference the risk of a data breach by third parties
23
was foreseeable. (See, e.g., Dkt. No. 81 ¶¶ 81 (citing reports stating “60% of the world’s
24
corporate data is stored in the cloud, which makes the cloud a very attractive target for hackers”
25
and “[i]n 2023, over 80% of data breaches involved data stored in the cloud[]”), 82 (citing recent
26
examples of industry data breaches)); Rosencrans, 192 Cal. App. 4th at 1087
(“The foreseeability
27
required is of the risk of harm, not of the particular intervening act.’”) (cleaned up); Baton v.
1 Ledger SAS, 740 F. Supp. 3d 847
, 910 (N.D. Cal. Jul. 16, 2024) (collecting “data breaches cases[] 2 where users’ data was stolen by hackers” and the court held “causation exists when protections are 3 inadequate”). 4 D. Damages 5 Defendant contends seven plaintiffs “(Goldstein, Hansch, LaMarre, Kim, Koplitz, Taylor, 6 and Muro) fail to sufficiently plead any cognizable injury” because they merely allege an 7 increased risk of future harm and that they have undertaken monitoring and mitigation efforts. 8 (Dkt. No. 86 at 26.) For example, unlike the other named plaintiffs, these seven plaintiffs do not 9 allege they have seen unauthorized charges or suspicious or fraudulent activity on their bank 10 accounts following the data breach. (See Dkt. No. 81 ¶¶ 111-136, 143-147, 154-158.) 11 As the Ninth Circuit has summarized in an unpublished opinion, “California courts have 12 not considered whether time and money spent on credit monitoring as the result of the theft of 13 personal information are damages sufficient to support a negligence claim.” Ruiz v. Gap, Inc., 38014 F. App’x 689
, 691 (9th Cir. 2010).
15 California has long held that “[i]t is fundamental that a negligent act
is not actionable unless it results in injury to another.” California also
16 holds that “[n]ominal damages, to vindicate a technical right, cannot
be recovered in a negligence action, where no actual loss has
17 occurred.” In addition, in different contexts, the California courts
have indicated that the mere threat of future harm is insufficient.
18
Id.
(internal citations omitted). The court noted, however, “California has recognized monitoring
19
costs as sufficient to state a negligence claim in the context of exposure to toxic chemicals.” Id.
at
20
691 & n.1. So, the court assumed without deciding “such damages are cognizable” and held the
21
plaintiff “failed to establish a genuine issue of material fact on whether he suffered damages
22
because he offered no evidence on the amount of time and money he spent on the credit
23
monitoring[.]” Id. at 691.
24
Defendant cites various federal district court cases relying on Ruiz and applying similar
25
reasoning. For example, Holly v. Alta Newport Hosp., Inc., 612 F. Supp. 3d 1017
(C.D. Cal. Apr.
26
10, 2020) held “negligence claims do require actual damages,” then dismissed the plaintiff’s
27
negligence claims because she did not “allege[] how any credit monitoring was reasonable and
1 necessary” and her allegations of emotional distress, damages, and increased risk of identity theft
2 were “conclusory,” “vague,” and “too speculative.” Id.
at 1026–27. For those holdings, Holly’s 3 only citation to California law was to the portion of Ruiz (quoted above) which cited a 1958 case 4 holding nominal damages are not cognizable under negligence claims. Seeid.
Similarly, Castillo 5 v. Seagate Tech., LLC,2016 WL 9280242
(N.D. Cal. Sep. 14, 2016) held “[n]egligence claims 6 […] require […] a cognizable, nonspeculative harm” and dismissed claims by plaintiffs who were 7 “merely considering purchasing” identity protection services and “who claim only that they may 8 incur expenses in the future[.]” Id. at *4. Castillo cited only one California case for this holding, 9 Jordache Enterprises Inc. v. Brobeck, Pheger & Harrison,18 Cal. 4th 739
(1998). That case, 10 which Ruiz cited, held “nominal damages, speculative harm, and the mere threat of future harm are 11 not actual injury” as the term “actual injury” was used in a statute of limitations for legal 12 malpractice claims.Id.
at 742–43. 13 The Court denies Defendant’s motion on this basis. On a motion to dismiss, it is 14 Defendant’s burden to show Plaintiffs do not state a negligence claim as a matter of law. Yet 15 Defendant’s cited cases do not show, as a matter of California law, the seven identified Plaintiffs’ 16 injuries are not cognizable in negligence claims. Even assuming California law requires Plaintiffs 17 to allege a non-speculative risk of future harm to state a negligence claim, as explained above, 18 drawing inferences in Plaintiffs’ favor, Plaintiffs allege facts sufficient to support an inference 19 these seven plaintiffs’ risk of future identity theft, fraud, and misuse is not speculative. 20 III. California Consumer Privacy Act (“CCPA”) Claim (Count II) 21 Plaintiffs’ second cause of action alleges Salesforce violated the CCPA, which provides a 22 cause of action for “any consumer whose […] personal information […] is subject to an 23 unauthorized access and exfiltration, theft, or disclosure as a result of [a] business’ violation of the 24 duty to implement and maintain reasonable security procedures and practices” regarding the 25 personal information.Cal. Civ. Code § 1798.150
(a)(1). 26 Defendant argues it is not a “business” under the CCPA. As relevant here, the statute 27 applies to a “business” which (1) “collects consumers’ personal information,” and (2) “alone, or 1 information[.]”Id.
§ 1798.140(d)(1). The CCPA defines “collects” as, among other things, 2 “obtaining, receiving, or accessing any personal information pertaining to a consumer by any 3 means. This includes receiving information from the consumer, either actively or passively[.]” Id. 4 § 1798.140(f). And the statute further defines “processing” personal information as “any 5 operation or set of operations that are performed on personal information […] whether or not by 6 automated means.” Id. § 1798.140(y). 7 Defendant contends (1) it does not “directly collect consumers’ personal information” and 8 (2) “does not make decisions” about the “purposes and means of processing” that information. 9 (Dkt. No. 86 at 29; Dkt. No. 96 at 12-13 (emphasis added).) The Court disagrees. 10 A. Collects Personal Information 11 Drawing inferences in Plaintiffs’ favor, Plaintiffs allege facts sufficient to support an 12 inference Salesforce “collects” Plaintiffs’ personal information. Plaintiffs allege Salesforce 13 “requires that its clients” provide it with sensitive data, and “Salesforce manages the servers that 14 hold the information provided by its clients.” (Dkt. No. 81 ¶¶ 3, 42.) That alone is sufficient to 15 support an inference Salesforce collects Plaintiffs’ personal information. Defendant’s insistence it 16 did not “directly collect” that information from Plaintiffs’ is unavailing because the CCPA does 17 not require a business “directly” collect information. Rather the CCPA’s definition of “collects” 18 includes “passively” receiving the information and “obtaining, receiving, or accessing [Plaintiffs’] 19 personal information […] by any means.”Cal. Civ. Code § 1798.140
(f) (emphasis added). 20 B. Determines the Purposes and Means of Processing 21 Drawing inferences in Plaintiffs’ favor, Plaintiffs also allege facts sufficient to support an 22 inference Salesforce “alone, or jointly with others, determines the purposes and means of 23 processing consumers’ personal information.”Id.
§ 1798.140(d)(1). Defendant’s argument 24 requires piecing together two parts of the CCPA: the phrase “determines the purposes and means 25 of processing” personal information and the definition of “processing.” So, Defendant’s burden is 26 to show drawing inferences in Plaintiffs’ favor, Plaintiffs’ allegations do not support an inference 27 Salesforce either “alone, or jointly with others, determines the purposes and means” of “any 1 Defendant has not met that burden. Plaintiffs allege Salesforce uses a “shared 2 responsibility model to protect sensitive data.” (Dkt. No. 81 ¶ 6 (cleaned up).) Under that model, 3 “Salesforce determines how that sensitive data is managed and processed, recommends ways to 4 leverage it through the company’s [AI] tools, […] uses it to advance Salesforce’s own […] 5 business objectives.” (Id. ¶ 3.) For example, Plaintiffs quote Salesforce’s website as saying the 6 company uses “predictive AI, generative AI, and agentic AI across the Customer 360 service” in 7 support of the allegation Salesforce “determines […] the manner in which the PII belonging to its 8 corporate clients’ consumers and employees […] is managed, processed, and stored.” (Id. ¶ 44.) 9 Plaintiffs also quote Salesforce’s “Main Services Agreement with its clients” which “obligates 10 Salesforce to,” among other things, “maintain appropriate administrative, physical, and technical 11 safeguards” for customers’ data. (Id. ¶ 45.) 12 These allegations are sufficient to support an inference Salesforce either “alone, or jointly 13 with others, determines the purposes and means” of “any operation […] performed on personal 14 information.”Cal. Civ. Code §§ 1798.140
(d)(1), (y). To begin, the phrase “any operation […] 15 performed on personal information” is broad.Id.
§ 1798.140(y). Plaintiffs plausibly allege 16 Salesforce “perform[s]” many “operation[s]” on personal information, including “manag[ing]” 17 data, “stor[ing]” data, “leverag[ing]” data through three types of AI, and making various 18 “safeguards” for customers’ data. (Dkt. No. 81 ¶¶ 3, 44-45.) Next, Plaintiffs plausibly allege 19 Salesforce “determines the purposes and means of” those operations.Cal. Civ. Code § 20
1798.140(d)(1). For example, the allegation Salesforce “uses” and “leverages” AI “tools” to 21 “determine[ …] the manner in which PII […] is managed, processed and stored” (Dkt. No. 81 ¶¶ 22 3, 44) plausibly supports an inference Salesforce determines the “means” of operations such as 23 storage and management. And the allegation Salesforce “design[ed] and administer[ed] its 24 platform infrastructure” (id. ¶ 6) plausibly supports an inference Salesforce determined the means 25 and purposes of various “safeguards” for data. Finally, that Salesforce created the platform 26 infrastructure, coupled with allegations of a “shared responsibility model,” plausibly supports an 27 inference Salesforce made these determinations either “alone, or jointly with others[.]” Cal. Civ. 1 Defendant’s sole cited case, In re Accellion, Inc. Data Breach Litigation,713 F. Supp. 3d 2
623 (N.D. Cal. Jan. 29, 2024), is unpersuasive. There, the court held allegations a company 3 “developed, marketed, and sold a file sharing transfer software product […] does not indicate that 4 [the company] would be making decisions about […] data” because “[t]he relevant CCPA inquiry 5 is […] whether Accellion determined how and why Plaintiffs’ PII was transmitted.”Id.
at 641 6 (cleaned up). In re Accellion’s interpretation of the CCPA is unpersuasive. The question is not 7 whether Salesforce made choices about why information was “transmitted” because transmitting is 8 just one type of “operation” which can be “performed on personal information.”Cal. Civ. Code § 9
1798.140(y). Rather, the question is whether drawing all inferences in Plaintiffs’ favor, Salesforce 10 determined how and why “any operation or set of operations” was “performed on personal 11 information[.]” Seeid.
§§ 1798.140(d)(1), (y) (emphasis added). Defendant has not met its 12 burden of showing the answer to that question is “no,” because it does not engage with the 13 CCPA’s broad definition of “processing” personal information. 14 Accordingly, the Court denies Defendant’s motion as to Plaintiffs’ CCPA claim.7 15 IV. Illinois Consumer Fraud Act Claim (Count V) 16 Four named plaintiffs are Illinois citizens and allege violations of the Illinois Consumer 17 Fraud and Deceptive Business Practices Act (“ICFA”). The ICFA prohibits “unfair or deceptive 18 acts or practices, including but not limited to the use or employment of any deception fraud, false 19 pretense, false promise, [and] misrepresentation” or “concealment” of “any material fact.”815 Ill. 20
Comp. Stat § 505/2. Although Plaintiffs’ complaint expressly alleges “Illinois Plaintiffs […] were
21 misled by misrepresentations or omissions,” (Dkt. No. 81 ¶¶ 285-287), Plaintiffs’ Opposition
22 confirms “the gravamen of Plaintiffs’ allegations is Salesforce’s unfair and unlawful failure to
23 secure their PII, not deceptive practices” or fraud. (Dkt. No. 91 at 23.) So, to the extent Plaintiffs’
24 complaint alleges ICFA fraud-based claims, the Court grants Defendant’s motion as to those
25 claims.
26
27
7 Defendant moves to dismiss Plaintiffs’ negligence per se claim based on deficiencies in
1 Separately, Defendant briefly asserts Plaintiffs’ ICFA claim must be dismissed because
2 Plaintiffs’ claim does not have a sufficient connection to Illinois under Avery v. State Farm Mut.
3 Auto Ins. Co., 216 Ill. 2d 100
(2005). There, the Illinois Supreme Court held ICFA does not 4 “apply to fraudulent transactions which take place outside Illinois.”Id. at 185
. As the court
5 explained:
6 a plaintiff may pursue a private cause of action under the Consumer
Fraud Act if the circumstances that relate to the disputed transaction
7 occur primarily and substantially in Illinois. In adopting this holding,
we recognize that there is no single formula or bright-line test for
8 determining whether a transaction occurs within this state. Rather,
each case must be decided on its own facts.
9
10 Id. at 187
. In ascertaining the state in which a transaction took place for ICFA purposes, courts 11 may consider “where a company policy is created,” the plaintiff’s state of residence, where the 12 plaintiff’s relevant actions occurred, where the “[d]amage to” the plaintiff occurred, “the 13 defendant’s principal place of business,” and where “[t]he alleged deception […] occurred.” See 14id.
at 187–90. 15 Here, drawing all inferences in Plaintiffs’ favor, Plaintiffs’ allegations permit an inference 16 the relevant “circumstances that relate to the dispute[ …] occur[red] primarily and substantially in 17 Illinois.”Id. at 187
. Four named plaintiffs allege they are Illinois citizens. (Dkt. No. 81 ¶¶ 22, 18 28, 30, 33.) Additionally, Plaintiffs allege TransUnion’s “principal place of business [is] in 19 Chicago, Illinois.” (See id. ¶¶ 14, 28-35.) So, for the four named plaintiffs who bring ICFA 20 claims, an Illinois resident provided their personal information to an Illinois company. And given 21 Plaintiffs allege TransUnion’s principal place of business is in Chicago, Plaintiffs’ allegations 22 permit an inference the company’s decisions relevant to Plaintiffs’ claims occurred in Illinois. 23 Although Defendant is correct Salesforce’s conduct did not allegedly occur in Illinois, that “there 24 is no single formula or bright-line test” means Defendant’s conduct is not dispositive. See Avery, 25216 Ill. 2d at 187
; see alsoid. at 186
(cautioning “focusing solely on [one] fact can create 26 questionable results.”) So, Defendant has not shown, drawing inferences in Plaintiffs’ favor, the 27 relevant circumstances did not occur “primarily and substantially in Illinois” such that Plaintiffs’ 1 Accordingly, the Court grants Defendant’s motion as to Plaintiffs’ fraud-based ICFA 2 claims, but otherwise denies the motion as to the ICFA claims. 3 V. Washington Consumer Protection Act (“WCPA”) Claims (Count VII) 4 Two named plaintiffs, Ms. Taylor and Mr. Carter, are Washington citizens and allege 5 violations of the WCPA, which prohibits “[u]nfair methods of competition and unfair or deceptive 6 acts or practices in the conduct of any trade or commerce[.]” RCW 19.86.020. A WCPA claim 7 requires Plaintiffs to “establish five distinct elements: (1) unfair or deceptive act or practice; (2) 8 occurring in trade or commerce; (3) public interest impact; (4) injury to plaintiff in his or her 9 business or property; [and] (5) causation.” Hangman Ridge Training Stables, Inc. v. Safeco Title 10 Ins. Co.,105 Wash. 2d 778, 780
(1986).
11 Regarding the “injury to […] business or property” element, the Washington Supreme
12 Court has explained:
13 Personal injuries, as opposed to injuries to “business or property,” are
not compensable and do not satisfy the injury requirement. Thus,
14 damages for mental distress, embarrassment, and inconvenience are
not recoverable under the CPA. However, the injury requirement is
15 met upon proof the plaintiff’s property interest or money is
diminished because of the unlawful conduct even if the expenses
16 caused by the statutory violation are minimal. Pecuniary losses
occasioned by inconvenience may be recoverable as actual damages.
17
Panag v. Farmers Ins. Co. of Washington, 166 Wash. 2d 27
, 57–58 (2009) (internal citations
18
omitted). Additionally, “injury is distinct from damages. Monetary damages need not be proved;
19
unquantifiable damages may suffice,” including unquantifiable harms arising from “loss of
20
frequent flier miles,” “loss of goodwill,” “damage to professional reputation,” and “injury by delay
21
in refund of money.” Id. at 58
(cleaned up).
22
As relevant here, Plaintiffs’ WCPA claims allege Salesforce’s conduct caused various
23
injuries, including
24
(i) invasion of privacy; (ii) theft of their PII; (iii) uncompensated
25 value of their PII; (iv) lost time associated with attempting to mitigate
the actual consequences of the Data Breach; (v) lost opportunity costs
26 associated with attempting to mitigate the actual consequences of the
Data Breach; (vi) actual misuse of the compromised data; (vii)
27 nominal damages; and (viii) the continued risk to their PII, which
is subject to further unauthorized disclosures so long as Salesforce
1 fails to undertake appropriate and adequate measures to protect their
PII.
2
3 (Dkt. No. 81 ¶ 239.) Defendant moves to dismiss the WCPA claims, asserting three of those
4 injuries–“invasion of privacy” and “lost time” and “opportunity costs” from mitigating harms of
5 the data breach–are “not recoverable” under the WCPA.8 (Dkt. No. 86 at 34.) Additionally,
6 Defendant contends Plaintiffs do not sufficiently allege Salesforce’s conduct caused those three
7 injuries because Ms. Taylor “does not allege any theft or misuse or that she was informed that her
8 information was actually compromised instead, her injuries arise from her assumption that her PII
9 was compromised and her decision to take mitigation efforts,” and Mr. Carter “vaguely alleges
10 attempted fraudulent activity without linking it to Salesforce’s actions. (Id. at 34-35 (cleaned up).)
11 The Court agrees, in part, and grants Defendant’s motion as to Plaintiffs’ “invasion of
12 privacy” injury. Plaintiffs’ Opposition does not discuss the “invasion of privacy” injury. (See
13 generally Dkt. No. 91.) As one district court explained, “an invasion of privacy is a ‘personal’
14 injury, rather than a ‘business or property’ injury […] because the concept of privacy by its very
15 nature is inherently personal, not pecuniary.” Gragg v. Orange Cab Co., 942 F. Supp. 2d 1111
, 16 1118–19 (W.D. Wash. 2013) (quoting Panag,166 Wash. 2d at 57
). So, Defendant has met its
17 burden to show, drawing all inferences in Plaintiffs’ favor, Plaintiffs’ allegations do not plausibly
18 support an inference an “invasion of privacy” injury is cognizable under the WCPA as a matter of
19 law.
20 However, the Court denies Defendant’s motion as to Plaintiffs’ “lost time” and “lost
21 opportunity cost” injuries. Defendant’s motion relies solely on Gragg’s holding an “alleged injury
22 of ‘aggravation and annoyance’ does not support a [W]CPA claim” because “[t]hose feelings are
23 plainly personal injuries, not business or property injuries.” Id. at 1119. But that portion of Gragg
24 is inapposite; Plaintiffs’ allegation they “lost time” and “opportunity cost[s]” mitigating the risks
25 of a data breach are not “feelings” like “aggravation and annoyance.” Id. If anything, the time,
26
8 Defendant’s motion does not mention Plaintiffs’ other injuries. In Reply, Defendant argues, for
27
the first time, Plaintiffs’ “other alleged damages are either unrecoverable or lack sufficient detail
1 resources, and energy spent mitigating risks like identity theft, fraud, and misuse of one’s personal
2 information are akin to pecuniary injuries or “unquantifiable damages.” See Panag, 166 Wash. 2d 3
at 58 (collecting cases where such damages “may suffice,” including allegations of “deceptive
4 brokerage of frequent flier miles” and “injury by delay in refund of money”). So, Defendant has
5 not met its burden to show, drawing inferences in Plaintiffs’ favor, Plaintiffs’ alleged “lost time”
6 and “lost opportunity cost” injuries are not cognizable as a matter of law.
7 Nor has Defendant shown, drawing inferences in Plaintiffs’ favor, Ms. Taylor and Mr.
8 Carter do not plausibly allege Salesforce’s conduct caused their mitigation-related injuries. As
9 explained above, Plaintiffs’ allegations plausibly support an inference Salesforce’s conduct caused
10 the data breach into Allianz, Farmer, and TransUnion. Mr. Carter alleges he “received a data
11 breach Notice Letter from Allianz in or around July 2025” and, based on the letter, he “reasonably
12 believes that his name, address, date of birth, and SSN were compromised in the Data Breach (all
13 of which he had provided to Allianz).” (Dkt. No. 81 ¶ 105.) Ms. Taylor’s allegations are almost
14 identical, except she received her letter from Allianz a month later. (Id. ¶ 143.) Therefore,
15 Defendant’s insistence Ms. Taylor does not plausibly allege causation because her “injuries arise
16 from her assumption that her PII was compromised” does not persuade; the allegation she received
17 a notice letter following the data breach plausibly supports an inference Salesforce’s conduct
18 caused her mitigation-related injuries. Similarly, although Mr. Taylor does not directly state the
19 attempted fraudulent activity on his account was caused by Salesforce’s data breach, that the
20 activity occurred after the data breach supports an inference of causation. Therefore, drawing
21 inferences in both plaintiffs’ favor, Ms. Taylor and Mr. Carter allege facts sufficient to support an
22 inference Salesforce’s conduct caused them to lose time and opportunity costs in attempting to
23 mitigate the harms of the data breach.
24 So, the Court grants Defendant’s motion as to Plaintiffs’ WCPA claims to the extent they
25 rely on an “invasion of privacy” injury, but otherwise denies Defendant’s motion as to Plaintiffs’
26 WCPA claims.
27 CONCLUSION
] the extent they are based on fraud and Plaintiffs’ WCPA claims to the extent they are based on an
2 || “invasion of privacy” injury. The Court otherwise denies the motion.
3 This Order disposes of Docket No. 86.
4 IT IS SO ORDERED.
5 || Dated: September 14, 2026
6
7 ne
ACQUELINE SCOTT CORLE
8 United States District Judge
9
10
1]
a 12
13
14
15
16
17
Z 18
19
20
21
22
23
24
25
26
27
28