William Gottlieb Management Co, LLC v. Carlin

                                                  USDC  SDNY 
                                                  DOCUMENT 
                                                  ELECTRONICALLY FILED 
UNITED  STATES  DISTRICT  COURT                    DOC #: 
SOUTHERN  DISTRICT  OF  NEW  YORK                   DATE FILED:   3/26/24 
WILLIAM  GOTTLIEB  MANAGEMENT  CO.,  LLC, 
                                                  20  Civ.  08907  (VM) 
                        Plaintiff, 
                                                  DECISION  AND  ORDER 
                —-  against  - 
ALLAN  H.  CARLIN, 
                        Defendant. 

VICTOR  MARRERO,  United  States  District  Judge. 
      Plaintiff  William  Gottlieb  Management  Co.,   LLC   (“WGM”) 
alleges  that  Defendant  Allan  H.  Carlin  (“Carlin”)  improperly 
interfered  with  WGM’s  computer  files.  WGM  brings  claims  for 
violations  of  the  Computer  Fraud  and  Abuse  Act   (“CFAA”),   

18 U.S.C. § 1030

,  and  the  Stored  Communications  Act  (“SCA”),  

18 U.S.C. § 2701

  et  seg.,  as  well  as  claims  under  New  York  common 
law  for  trespass  to  chattels  and  negligence.  Carlin  moves  to 
dismiss   these   claims   pursuant   to   Federal   Rule   of   Civil 
Procedure   12 (b)  (6)    (“Rule   12(b)(6)%).   For   the   following 
reasons,  the  Court  GRANTS  the  motion  to  dismiss  the  CFAA  and 
trespass  to  chattels  claims  and  DENIES  the  motion  to  dismiss 
the  SCA  and  negligence  claims. 

                     I.   BACKGROUND1                               
    Carlin, a New York-barred attorney, worked at times as          
outside legal counsel for WGM. (See Complaint, Dkt. No. 1,           
¶ 8  [hereinafter  “Compl.”].)  Around  September  2017,  WGM        
provided Carlin with individual login credentials to WGM’s           

organizational  account  on  the  cloud-based   file-sharing         
platform Dropbox (the “WGM Dropbox Professional account”).           
(See id.) WGM terminated Carlin around October 24, 2018, after       
which personnel at WGM “noticed that Defendant Carlin had            
been regularly accessing the WGM Dropbox Professional account        
since the date of his termination.” (Id. ¶¶ 10, 12.)                 
    WGM then retained “a licensed private investigation firm        
specializing in digital forensics,” nonparty NGH Group, Inc.         
(“NGH”), “to investigate the scope and nature of Carlin’s            
unauthorized access to the WGM Dropbox Professional account.”        
(Id. ¶ 13.) NGH provided “confirmation” that Carlin accessed         
the  account.  (Id.  ¶ 15.)  Carlin  purportedly  “accessed,         

viewed,  added,  edited,  and/or  deleted  files  and  folders       
within  the  WGM  Dropbox  Professional  Account”  on  eleven        
occasions.  (Id.  ¶  14.)  After  NGH’s  “confirmation,”  Carlin     
continued to access the account “after being notified that he        

1 Except as otherwise noted, the following background derives from the 
Complaint. The Court takes all facts alleged therein as true and construes 
all justifiable inferences arising therefrom in the light most favorable 
to the plaintiff, as required under the standard set forth in Section II 
below.                                                               
was committing computer trespass.” (Id. ¶ 15.) WGM alleges           
that Carlin’s conduct caused “monetary loss” exceeding $5,000        
“in internal effort and to engage contractors to investigate         
the  scope  of  breach,  unauthorized  access,  potential  risks     
deriving from the conduct, and installing heightened measures        

to prevent access.” (Id. ¶¶ 2, 16.)                                  
    WGM filed its Complaint against Carlin on October 23,           
2020. (See Compl.) On March 22, 2021, the Clerk of the Court         
entered a certificate of default against Carlin. (See Dkt.           
No. 8.) While this action was pending before Judge Paul A.           
Crotty, the Court entered a default judgement on May 10, 2021.       
(See Dkt. No. 9.) On December 20, 2022, the Court granted            
Carlin’s motion to set aside the certificate of default and          
default judgment. (See Dkt. No. 28.)                                 
    After the default judgment was set aside, Carlin moved          
to dismiss all four claims pursuant to Rule 12(b)(6) (see            
Dkt. No. 49 [hereinafter the “Motion”]) and filed a memorandum       

of law in support of the Motion (see Dkt. No. 51 [hereinafter        
the “Memorandum” or “Mem.”]). WGM timely filed a memorandum          
of  law  in  opposition  to  the  Motion  (see  Dkt.  No.  52        
[hereinafter the “Opposition” or “Opp.”]), and Carlin timely         
filed  a  memorandum  of  law  in  reply  (see  Dkt.  No.  53        
[hereinafter the “Reply”]).                                          
                   II.  LEGAL STANDARD                              
    Carlin  moves  to  dismiss  the  Complaint  under  Rule         
12(b)(6). To survive such a motion, “a complaint must contain        
sufficient factual matter, accepted as true, to ‘state a claim       
to relief that is plausible on its face.’” Ashcroft v. Iqbal,        

556 U.S. 662, 678

 (2009) (quoting Bell Atl. Corp. v. Twombly,        

550 U.S. 544, 570

 (2007)). This standard is satisfied “when          
the plaintiff pleads factual content that allows the court to        
draw the reasonable inference that the defendant is liable           
for the misconduct alleged.” 

Id.

 Put differently, a complaint        
should  not  be  dismissed  when  the  plaintiff's  allegations      
sufficiently “raise a right to relief above the speculative          
level.” Twombly, 

550 U.S. at 555

. However, “the tenet that a         
court must accept as true all of the allegations contained in        
a complaint is inapplicable to legal conclusions.” Iqbal, 

556 U.S. at 678

.                                                         
    A  Rule  12(b)(6)  motion  challenges  only  the  legal         

feasibility of the complaint, and courts adjudicating such           
motions  “take[]  no  account  of  the  complaint’s  ‘basis  in      
evidence.’” Nunes v. NBCUniversal Media, LLC, 

643 F. Supp. 3d 403

, 411 (S.D.N.Y. 2022) (quoting Goel v. Bunge, Ltd., 

820 F.3d 554, 559

 (2d Cir. 2016)). “Generally, courts do not look        
beyond facts stated on the face of the complaint, documents          
incorporated  in  the  complaint,  matters  of  which  judicial      
notice may be taken and documents that are ‘integral’ to the         
complaint.” 

Id.

 (quoting Goel, 

820 F.3d at 559

). At the same         
time,  the  Rule  12(b)(6)  standard  instructs  the  Court  to      
construe the complaint “liberally.” In re Inclusive Access           
Course Materials Antitrust Litig., 

544 F. Supp. 3d 420

, 431          

(S.D.N.Y.  2021)  (quoting  Coal.  for  Competitive  Elec.  v.       
Zibelman, 

906 F.3d 41

, 48–49 (2d Cir. 2018)).                        
                     III.  DISCUSSION                               
A.   EXHIBITS EXTRANEOUS TO THE COMPLAINT                            
    In support of his motion to dismiss, Carlin has submitted       
a declaration with thirteen attached exhibits. (See Decl. of         
Allan H. Carlin, Dkt. No. 50; see also Exs. A–M to Decl. of          
Allan H. Carlin, Dkt. Nos. 50-1 to 50-13.) The exhibits can          
be grouped into three categories: (1) memoranda of law and           
letters filed in a related state court action between the            
parties; (2) information and correspondence from Dropbox; and        
(3) two affidavits of WGM’s forensic expert filed in the state       

court action. (See Dkt. No. 50 ¶ 3.) These documents would be        
appropriate to consider on the motion to dismiss only if they        
are  “documents   that  are  attached   to  the   complaint,         
incorporated in it by reference, integral to the complaint,          
or the proper subject of judicial notice.” United States v.          
Strock,  

982 F.3d 51, 63

  (2d  Cir.  2020)  (quotation  marks     
omitted).                                                            
    If  the  documents  do  not  fall  into  any  of  those         
categories,  then  the  Court  may  consider  them  only  if  it     
converts  the  motion  to  dismiss  into  a  motion  for  summary    

judgment governed by Rule 56. See Fed. R. Civ. P. 12(d). Prior       
to  converting  the  motion,  “[a]ll  parties  must  be  given  a    
reasonable opportunity to present all the material that is           
pertinent to the motion.” 

Id.

                                        
    The Court concludes that the Carlin declaration and its         
exhibits are not appropriate to consider at this stage. None         
is attached to or explicitly incorporated by reference in the        
Complaint. See, e.g., Madu, Edozie & Madu, P.C. v. SocketWorks       
Ltd. Nigeria, 

265 F.R.D. 106, 123

 (S.D.N.Y. 2010) (“A clear          
and definite reference to extraneous submissions not attached        
to the complaint is necessary . . . .” (brackets omitted)).          
Though the Court may take judicial notice that the state-            

court documents exist, the Court cannot take judicial notice         
that the contents of those documents are true. See Kramer v.         
Time Warner Inc., 

937 F.2d 767, 774

 (2d Cir. 1991). Further,         
the Complaint does not “rel[y] heavily upon [the documents’]         
terms and effect” such that the Court could fairly describe          
them as “integral” to the Complaint.2 Goel, 

820 F.3d at 559

.         
    Finally, the Court will not convert the motion to dismiss       
into a motion for summary judgment to consider the exhibits          
pursuant to Rule 12(d). Summary judgment before completing           

discovery is appropriate “only in the rarest of cases” because       
the parties must ordinarily be afforded an opportunity to            
develop the factual record. Great Wall De Venezuela C.A. v.          
Interaudi  Bank,  

117 F. Supp. 3d 474, 492

  (S.D.N.Y.  2015)    
(quoting Hellstrom v. U.S. Dep’t of Veterans Affairs, 

201 F.3d 94

, 97 (2d Cir. 2000)); see also Fed. R. Civ. P. 12(d).         
Especially because this case is still at the pleading stage          
and because the parties sharply disagree on the underlying           
circumstances  and  effects  of  Carlin’s  access  to  the  WGM      


2 WGM’s expert’s affidavits (see Dkt. No. 50-11; Dkt. No. 50-12) do present 
a  close  call  as  to  whether  they  may  be  considered  integral  to  the 
Complaint. Ultimately, the Court finds that it would be inappropriate to 
consider the contents of those affidavits on this Motion. The Complaint’s 
mere reference to NGH’s forensic work (Compl. ¶ 15) is insufficient to 
render the affidavits integral because the Complaint does not rely heavily 
on  the  affidavits  themselves,  only  the  underlying  events  that  the 
affidavits describe. See Goel, 820 F.3d at 559–60. In Goel, the Second 
Circuit determined that a district court deciding a Rule 12(b)(6) motion 
had abused its discretion when it considered a plaintiff’s deposition 
testimony from a related state court action. Id. at 560. Even though the 
complaint in Goel referenced “sworn testimony” and the plaintiffs learned 
a “substantial portion of the facts” from the state court litigation, 
that testimony was not integral to the complaint because the complaint 
did not allege that the “terms and effect of [the plaintiff’s] testimony” 
amounted to wrongdoing. Id. at 559-60. Similarly, here, WGM’s expert’s 
testimony in state court may discuss relevant matters, but the Complaint 
is not about the way the affidavits were written, or the legal effect of 
the affidavits themselves. The affidavits therefore cannot properly be 
labeled “integral” to WGM’s Complaint. Id.                           
Dropbox Professional account, there is no reason to bypass           
discovery and decide the instant motion as one for summary           
judgment.                                                            
B.   COMPUTER FRAUD AND ABUSE ACT                                    
    WGM alleges that Carlin’s unauthorized access of WGM’s          

computer  system  violated  the  CFAA.  (Compl.  ¶  21.)  Carlin     
contends that this claim should be dismissed because WGM has         
not  sufficiently  alleged  the  type  of  damage  or  loss  the     
statute seeks to prevent. (Mem. at 10–16.)                           
    The  CFAA  is  a  “federal  computer-crime  statute,”  Van      
Buren v. United States, 

141 S. Ct. 1648, 1652

 (2021), that           
authorizes civil actions against anyone who “intentionally           
accesses a protected computer without authorization, and as          
a result of such conduct, recklessly causes damage.” 

18 U.S.C. § 1030

(a)(5)(B); see 

id.

 § 1030(g). To bring a civil action,         
the plaintiff must also allege “loss to 1 or more persons            
during any 1-year period . . . aggregating at least $5,000 in        

value.” Id. § 1030(c)(4)(A)(i)(I); see id. § 1030(g). Though         
“loss” and “damage” represent different legal concepts, both         
terms “focus on technological harms — such as the corruption         
of files — of the type unauthorized users cause to computer          
systems and data.” Van Buren, 

141 S. Ct. at 1660

. The Court          
finds that WGM has not pleaded the existence of either “loss”        
or “damage” under the CFAA.                                          
    The Court’s analysis begins with “loss,” which is “any          
reasonable  cost  to  any  victim,  including  the  cost  of         
responding to an offense, conducting a damage assessment, and        
restoring the data, program, system, or information to its           
condition prior to the offense, and any revenue lost, cost           

incurred, or other consequential damages incurred because of         
interruption  of  service.”   

18 U.S.C. § 1030

(e)(11).  A          
plaintiff must plead that their “loss” exceeded $5,000 to            
state    a    civil    claim    under    the    CFAA.   

Id.

          
§ 1030(c)(4)(A)(i)(I);  LivePerson,  Inc.  v.  24/7  Customer,       
Inc., 

83 F. Supp. 3d 501, 514

 (S.D.N.Y. 2015) (granting a            
motion to dismiss where plaintiff failed to “quantify the            
loss it alleges”).                                                   
    WGM’s  allegations  are  insufficient  to  allege  “loss”       
under  this  definition.  As  a  general  rule,  remedial  loss      
incurred  to  investigate  computer  damage  constitutes  loss       
under the statute. See, e.g., Tyco Int’l (US) Inc. v. John           

Does 1-3, No. 01 Civ. 3856, 

2003 WL 21638205

, at *1 (S.D.N.Y.        
July 11, 2003) (limiting loss to “those costs necessary to           
assess  the  damage  caused  to  the  plaintiff’s   computer         
system”). However, general investigatory costs do not amount         
to loss in every case. See Nexans Wires S.A. v. Sark-USA,            
Inc., 

319 F. Supp. 2d 468, 477

 (S.D.N.Y. 2004) (holding that         
travel expenses necessary to meet to discuss the information         
stolen by a former employee did not constitute loss), aff’d,         

166 F. App’x 559

 (2d Cir. 2006). Courts in this District have        
held plaintiffs to the burden of alleging how the “costs of          
responding to an offense” are linked “to situations involving        
damage to or impairment of the protected computer.” Better           

Holdco, Inc. v. Beeline Loans, Inc., No. 20 Civ. 8686, 

2021 WL 3173736

, at *3 (collecting cases); see Nanobeak Biotech           
Inc. v. Barbera, No. 20 Civ. 07080, 

2021 WL 1393457

, at *4           
(S.D.N.Y. Apr. 13, 2021) (granting motion to dismiss where           
there were “no specific allegations connecting the alleged           
‘investigative expenses’ to any effort to investigate damage         
done to the computer systems”); Van Buren, 

141 S. Ct. at 1660

        
(emphasizing  that  “loss”  must  relate  to  “technological         
harms”).                                                             
    As Carlin points out, the Complaint alleges that NGH’s          
investigation only confirmed what WGM already knew — i.e.,           
that Carlin accessed its data — rather than analyzing the            

effect of Carlin’s access on WGM’s computer systems. (See            
Compl.  ¶ 12  (“WGM’s  IT  personnel  noticed  that  Defendant       
Carlin  had  been   regularly  accessing  the  WGM   Dropbox         
Professional account since the date of his termination[.]”);         
id.  ¶ 15  (stating  that  NGH  provided  “confirmation  of          
Defendant  Carlin’s  unauthorized  access  to  WGM’s  Dropbox        
Professional account” (emphasis added)); id. ¶ 13 (stating           
that NGH “investigate[d] the scope and nature of Carlin’s            
unauthorized access to the WGM Dropbox Professional account”         
(emphasis added)).) These allegations do not even support the        
inference that NGH’s investigation was helpful to reveal the         
infringing conduct given that NGH provided only confirmation         

of what WGM already knew. See Tyco, 

2003 WL 21638205

, at *2          
(holding  that  because  the  defendant’s  conduct  “would  have     
been immediately apparent,” the cost of the investigation was        
limited to locating the defendant and collecting information         
about him, which is not compensable loss). WGM’s response to         
this argument does not cite a single case to support that its        
allegations regarding loss are sufficient to state a claim           
under the CFAA.                                                      
    Next, distinct from the concept of “loss” under the CFAA,       
“damage” is “any impairment to the integrity or availability         
of  data,   a  program,  a   system,  or  information.”  

18 U.S.C. § 1030

(e)(8).  WGM’s  allegations  are  deficient  with       

respect to “damage” as defined by the CFAA. The Complaint            
never  states  how  Carlin’s  conduct  “impaired”  or  otherwise     
affected WGM’s computers, data, or files. See Better Holdco,         

2021 WL 3173736

, at *4 (granting motion to dismiss where the         
plaintiff did “not allege that it lost service or access to          
its  data,  or  that  its  systems  were  otherwise  harmed”).       
Carlin’s mere access to and use of information obtained from         
a computer system does not equate to damage to the computer          
redressable by the CFAA. See Register.com, Inc. v. Verio,            
Inc.,  

126 F. Supp. 2d 238

,  252  n.12  (S.D.N.Y.  2000)         
(concluding that whether or not the extracted data was used          
to obtain a competitive advantage “has no bearing” on whether        

the data or computer systems were impaired), aff’d, 

356 F.3d 393

 (2d Cir. 2004).                                                  
    WGM’s argument that Carlin must have caused “damage” by         
editing or deleting files on the WGM Professional Dropbox            
account is not persuasive. Even editing or deleting a file           
does not in every case amount to “impairment to the integrity”       
of  data,  a  program,  a  system,  or  information.  

18 U.S.C. § 1030

(e)(8); cf. Opp. at 4–7. The Complaint is barren as to         
the significance of the documents that were allegedly edited         
or deleted, or how WGM was impacted in any way by Carlin’s           
actions. In other words, if Carlin’s actions did impair data,        
a program, a system, or information, the Complaint does not          

state how or why. See 

18 U.S.C. § 1030

(e)(8). Indeed, WGM’s          
allegations  in  this  respect  are  conclusory,  lack  factual      
context, and parrot the law. See Compl. ¶¶ 16, 22–23. WGM has        
thus failed to allege damage under the CFAA.                         
    Accordingly, Carlin’s motion to dismiss the CFAA claim          
is GRANTED.                                                          
C.   STORED COMMUNICATIONS ACT                                       
    Civil  liability  under  the  SCA  extends  to  whoever         
“(1) intentionally accesses without authorization a facility         
through  which  an   electronic  communication  service  is          
provided; or (2) intentionally exceeds an authorization to           

access  that  facility;  and  thereby  obtains,  alters,  or         
prevents  authorized   access  to  a   wire  or   electronic         
communication  while  it  is  in  electronic  storage  in  such      
system.”  

18 U.S.C. § 2701

(a);  see   also  

id.

  §   2707(a)         
(expressly permitting any “person aggrieved by any violation         
of [the SCA]” to bring a civil action against the “person or         
entity” that engaged in such violation).                             
    Carlin argues that WGM’s SCA claim rests on a conclusory        
allegation  that  his  access  to  the  Dropbox  account  was        
unauthorized. (See Mem. at 18-19.) In support, Carlin cites          
In re DoubleClick Inc. Privacy Litigation, where the court           
dismissed an SCA claim because the plaintiffs relied “solely         

on  the  naked   allegation  that  defendant’s  access  was          
‘unauthorized.’” 

154 F. Supp. 2d 497, 510

 (S.D.N.Y. 2001).           
However, in DoubleClick, the court was bound to reject the           
plaintiff’s  “bare  assertion  that  [defendant’s]  access  was      
unauthorized”  because  “every  fact  [plaintiffs]  do  allege       
supports the inference that the [plaintiffs] did authorize           
[defendants’] access.” 

Id.

                                           
    Here, WGM has met its burden of pleading that Carlin’s          
access  to   the  WGM  Dropbox   Professional  account  was          
unauthorized. Unlike in DoubleClick, the facts pleaded in the        
Complaint  here  plausibly  support  WGM’s  conclusions  that        
Carlin exceeded the scope of his authorized access to the WGM        

Dropbox Professional account. It is reasonable to infer that         
once  Carlin’s  professional  relationship  with  WGM  ended,        
Carlin did not continue to have authorization to continue to         
use WGM’s computer systems or view WGM’s files. (See Compl.          
¶¶ 8, 10, 15.) Allegations that one has exceeded the scope of        
his or her permitted access are sufficient to survive a motion       
to dismiss. See, e.g., Penrose Comput. Marketgroup, Inc. v.          
Camin, 

682 F. Supp. 2d 202, 210

 (N.D.N.Y. 2010) (“Accepting,         
arguendo, that Defendant had full access to the Plaintiff’s          
computer system, this does not support the conclusion that           
Defendant  had  authorization  to  access  another  employee’s       
email account.”); Monson v. Whitby Sch., Inc., No. 3:09 Civ.         

1096, 

2010 WL 3023873

, at *5 (D. Conn. Aug. 2, 2010) (denying        
motion to dismiss where complaint sufficiently alleged the           
employee exceeded the scope of her access to the school’s            
computer  system);  cf.  Van  Buren,  

141 S. Ct. at 1662

         
(interpreting “exceeds authorized access” in context of the          
CFAA  to   mean  “when  [one]   accesses  a  computer  with          
authorization  but  then  obtains  information  located  in          
particular areas of the computer — such as files, folders, or        
databases — that are off limits to him”).                            
    Carlin’s  other  SCA  arguments  relate  to  two  statutory     
exceptions to liability. (See Mem. at 18–19 (discussing 

18 U.S.C. § 2701

(c)  exceptions).)  Because  Carlin’s  arguments      

hinge on facts not raised on the face of the Complaint, they         
are not properly before the Court on this motion to dismiss.         
See Pani v. Empire Blue Cross Blue Shield, 

152 F.3d 67, 74

           
(2d Cir. 1998) (“An affirmative defense may be raised by a           
pre-answer  motion  to  dismiss  under  Rule  12(b)(6),  without     
resort to summary judgment procedure, if the defense appears         
on the face of the complaint.”); see also Wright & Miller,           
5 Fed. Prac. & Proc. Civ. § 1277 (4th ed.) (“Since the facts         
necessary to establish an affirmative defense generally must         
be  shown  by  matter  outside  the  complaint,  the  defense        
technically  cannot  be  adjudicated  on  a  motion  under  Rule     
12.”);  id.  (“[M]otions  to  dismiss . . .  only  can  attack       

matters  appearing  on  the  face  of  the  complaint.”);  cf.       
DoubleClick, 

154 F. Supp. 2d at 508

 (dismissing an SCA claim         
pursuant to statutory exceptions grounded on “on the face of         
the pleadings”). Accordingly, Carlin’s motion to dismiss the         
SCA claim is DENIED.                                                 
D.   STATE LAW CLAIMS                                                
    WGM brings two claims under New York common law: trespass       
to chattels and negligence. Carlin moves to dismiss these            
claims on the basis that WGM has not sufficiently alleged            
damage to its data or computer system. (See Mem. at 20.)             

    1.   Trespass to Chattels                                       
    WGM alleges that Carlin committed trespass to chattels          
when Carlin accessed WGM’s Dropbox account without consent           
and WGM “suffered damages, financially and otherwise.” (See          
Compl. ¶¶ 33–34.) To bring a claim for trespass to chattels,         
a plaintiff must allege that the defendant “intentionally,           
and without justification or consent, physically interfered          
with  the  use   and  enjoyment  of  personal  property  in          
[plaintiff’s] possession” in a manner that causes harm to the        
property.  Jackie’s  Enterprises,  Inc.  v.  Belleville,  

87 N.Y.S.3d 124

, 130–31 (N.Y. App. Div. 3d Dep’t 2018).                 
    “The ‘harm’ at issue is ‘harm to the condition, quality         

or material value of the chattels at issue’ and the showing          
of such harm is ‘an essential element’ in pleading trespass          
to chattels.” Fischkoff v. Iovance Biotherapeutics, Inc., 

339 F. Supp. 3d 408, 416

 (S.D.N.Y. 2018) (quoting J. Doe No. 1 v.        
CBS Broad. Inc., 

806 N.Y.S.2d 38, 39

 (N.Y. App. Div. 1st Dep’t       
2005)).                                                              
    WGM fails to allege how Carlin harmed the condition,            
quality, or value of WGM’s files or computer. It offers only         
conclusory  allegations  that  WGM  “suffered  damages.”  (See       
Compl. ¶ 34.) Without more, WGM has failed to state a claim          
for trespass to chattels. See, e.g., Twin Sec., Inc. v. Advoc.       

& Lichtenstein, LLP, 

980 N.Y.S.2d 18

, 19 (N.Y. App. Div. 1st         
Dep’t 2014) (dismissing trespass to chattels claim because           
“there is no indication that the condition, quality or value         
of the computer, its hard drive, or any of the information on        
the  computer  was  diminished  as  a  result  of  defendants’       
duplication of the hard drive”); Hecht v. Components Int’l,          
Inc., 

867 N.Y.S.2d 889

, 899 (N.Y. Sup. Ct. Nassau Cnty. 2008)        
(“Since the emails were stored in Hecht’s Outlook Express            
folder, Components has not shown that Hecht’s deletion of the        
emails was anything other than harmless intermeddling with           
the computer system.”); Fischkoff, 

339 F. Supp. 3d at 417

            
(collecting  cases   requiring  allegations  of   diminished         

capacity  or  harm  to  the  integrity  of  the   computer).         
Accordingly, the motion to dismiss this claim is GRANTED.            
    2.   Negligence                                                 
    WGM  next  alleges  that  Carlin  was  negligent  when  he      
breached  his  duty  of  refraining  from  using  WGM’s  Dropbox     
account after his termination. (See Compl. ¶¶ 38–39.) WGM            
alleges that his breach of that duty caused WGM to be “injured       
financially.” Id. ¶ 40.                                              
    “It  is  well-settled  that  to  establish  a  claim  of        
negligence,  a  plaintiff  must  prove:  a  duty  owed  to  the      
plaintiff by the defendant, a breach of that duty, and injury        

proximately resulting therefrom.” Moore Charitable Found. v.         
PJT Partners, Inc., 

217 N.E.3d 8

, 14 (N.Y. 2023). Carlin moves       
to dismiss only on the basis that WGM has failed to allege an        
injury resulting from the alleged breach of duty.                    
    The  Court  disagrees.  WGM  alleges  that  it  retained  a     
private  investigation  firm  “to  investigate  the  scope  and      
nature of Carlin’s unauthorized access” in response to WGM’s         
IT personnel observing Carlin access the WGM Dropbox. (Compl.        
¶¶ 12–13.) WGM incurred over $5,000 in costs to investigate          
the scope of Carlin’s breach. (See 

id. ¶ 2

.) Those allegations       
are sufficient to allege injury in the context of Carlin’s           
purported  breach  (despite  not  being  sufficient  to  allege      

“loss” under the CFAA for the reasons previously discussed).         
See, e.g., Sackin v. TransPerfect Glob., Inc., 

278 F. Supp. 3d 739, 749

 (S.D.N.Y. 2017) (allegations that plaintiffs had         
“to take reasonable steps to mitigate the consequences of the        
data breach” were sufficient to allege injury for negligence         
claim); Rudolph v. Hudson’s Bay Co., No. 18 Civ. 8472, 

2019 WL 2023713

, at *9 (S.D.N.Y. May 7, 2019) (alleging injury            
based  on  the  expenses   incurred  when  plaintiff  “drove  to  a 
Bank  of  America  branch  to  obtain  a  new  debit  card,  as  well  as 
time   expended   to   retrieve   the   card   and   update   account 
records”).  Accordingly,   the  motion  to  dismiss  this  claim  is 
DENIED. 
                              IV.   ORDER 
     For  the  reasons  stated  above,  it  is  hereby 
     ORDERED  that  the  motion  (Dkt.  No.  49)  filed  by  defendant 
Allan  H.  Carlin  (“Carlin”)  to  dismiss  the  Complaint  (Dkt.  No. 
1),  pursuant  to  Federal  Rule  of  Civil  Procedure  Rule  12 (b) (6) 
(“Rule  12(b)  (6)”)  is  GRANTED  in  part  and  DENIED  in  part;  and 
it  is  further 
     ORDERED  that  Carlin  shall  respond  to  those  portions  of 
the  Complaint  that  have  not  been  dismissed  no  later  than  21 
days  after  the  date  of  this  Order. 
SO  ORDERED. 
Dated:      New  York,  New  York 
           March  26,  2024                                   

                                                 U.S.D.J. 

                                  19