1 UNITED STATES DISTRICT COURT

2 DISTRICT OF NEVADA

3 JEHU BRYANT, on behalf of himself and all ) 4 other persons similarly situated, ) ) Case No.: 2:22-cv-00855-GMN-EJY 5 Plaintiff, ) vs. ) ORDER 6 ) 7 MX HOLDINGS US, INC., et al., ) ) 8 Defendants. )

9 10 Pending before the Court is Defendant MX Holdings US, Inc., CFP Fire Protection, Inc., 11 COSCO Fire Protection, Inc., and Firetrol Protection Systems, Inc. (collectively, 12 “Defendants’”) Motion to Dismiss, (ECF No. 17). Plaintiff Jehu Bryant, individually and on 13 behalf of all other similarly situated (“Plaintiff”), filed a Response, (ECF No. 23), and 14 Defendants filed a Reply, (ECF No. 29). 15 For the reasons discussed below, the Court DISMISSES Plaintiff’s Complaint without 16 prejudice for failure to sufficiently allege federal subject matter jurisdiction and DENIES 17 Defendants’ Motion to Dismiss as moot. 18 I. BACKGROUND 19 This case arises from a data breach of Defendants’ network on or around October 28, 20 2021, in which hackers allegedly stole the personally identifiable information (“PII”) of 21 Plaintiff and other similarly situated individuals (“Data Breach”). (Compl. ¶¶ 1–6, ECF No. 1). 22 Plaintiff alleges that thousands of individuals were affected by the Data Breach. (Id. ¶ 42). 23 Specifically, hackers accessed individuals’ names, dates of birth, social security numbers, 24 /// 25 /// 1 driver’s license numbers, passport numbers, financial account numbers, and medical 2 information.1 (Id. ¶ 5). 3 Defendants are corporations that perform building construction, in addition to providing 4 safety and fire protection services. (Id. ¶ 15). Plaintiff alleges that Defendants “failed to 5 comply with industry standards or even implement rudimentary security practices,” which 6 resulted in the Data Breach. (Id. ¶ 25). On May 10, 2022, approximately five months after the 7 Data Breach, Defendants notified Plaintiff in a letter that his PII may have been compromised. 8 (Id. ¶ 26). 9 Plaintiff posits he and similarly situated class members now face a heightened long-term 10 risk of future harm, specifically harm posed by identity theft and fraud. (Id. ¶ 35). Plaintiff 11 alleges that identity thieves often hold onto to PII for “several years before using and/or selling 12 the information to other identity thieves. (Id. ¶ 20). Plaintiff further argues with access to the 13 PII at issue, criminals can open financial accounts, obtain medical services, obtain government 14 benefits, file fraudulent tax returns, and obtain driver’s licenses. (Id. ¶¶ 32–35). Moreover, 15 Plaintiff asserts that the PII leaked in the breach will likely be sold or disseminated on the dark 16 web. (Id. ¶ 30). 17 Plaintiff contends that Defendants failed to reasonably maintain safety and security 18 measures, especially in light of “industry wide warnings” about the risk of cyber-attacks. (Id. ¶ 19 27). Plaintiff argues that industry standards highlight several basic cybersecurity safeguards 20 that can improve cyber resilience including: (a) the proper encryption of PII; (b) educating and 21 training employees on how to protect PII; and (c) correcting the configuration of software and

22 network devices. (Id. ¶ 19). Plaintiff posits that the Data Breach could have been prevented had 23

24 1 Defendants argue that Plaintiff misrepresents that his PII was stolen. (Mot. Dismiss 4:1–13, ECF No. 17). 25 Specifically, Defendants provide a Template Notice Letter they sent to Plaintiff and other consumers following the Data Breach, which states that the Data Breach “may have resulted in the temporary exposure of some of your [PII].” (Template Notice Letter at 1, Ex. A to Mot. Dismiss, ECF No. 17-1) (emphasis added). 1 Defendants remedied the deficiencies in their data security systems and adopted security 2 measures recommended by experts in the industry and the Federal Trade Commission. (Id. ¶¶ 3 22–28). Plaintiff, to mitigate the risk of harm posed by the Data Breach, “review[ed] and 4 monitor[ed] his accounts, enroll[ed] in the free credit monitoring offered, and plac[ed] an alert 5 on his credit with Experian.” (Id. ¶ 54). 6 On May 27, 2022, Plaintiff, individually and on behalf of all others similarly situated, 7 filed the present Complaint, alleging claims for: (1) negligence; (2) invasion of privacy by 8 public disclosure of private facts and intrusion upon seclusion; (3) breach of contract; and (4) 9 breach of implied contract, as well as requesting injunctive relief to require Defendants to 10 update their security protocols. (Id. ¶¶ 54–88). On July 29, 2022, Defendants filed the instant 11 Motion to Dismiss. (See generally Mot. Dismiss (“MTD”), ECF No. 17). 12 II. LEGAL STANDARD 13 “It is to be presumed that a cause lies outside [of federal courts’] limited jurisdiction, 14 and the burden of establishing the contrary rests upon the party asserting jurisdiction.” 15 Kokkonen v. Guardian Life Ins. Co. of Am.,

(1994) (citation omitted). 16 Federal courts are constitutionally required to raise issues related to federal subject matter 17 jurisdiction and may do so sua sponte. Arbaugh v. Y&H Corp.,

(2006). A 18 federal court must satisfy itself of its jurisdiction over the subject matter before proceeding to 19 the merits of the case. Ruhrgas AG v. Marathon Oil Co.,

(1999); Snell 20 v. Cleveland,

(9th Cir. 2002) (“Federal Rule of Civil Procedure 12(h)(3)[ ] 21 provides that a court may raise the question of subject matter jurisdiction, sua sponte, at any

22 time during the pendency of the action . . . .”) (footnote omitted). “A plaintiff suing in a federal 23 court must show in his pleading, affirmatively and distinctly, the existence of whatever is 24 essential to federal jurisdiction, and, if he does not do so, the court, on having the defect called 25 to its attention or on discovering the same, must dismiss the case, unless the defect be corrected 1 by amendment.” Tosco Corp. v. Cmtys. for a Better Env’t,

(9th Cir. 2001) 2 (citation omitted), abrogated on other grounds by Hertz Corp. v. Friend,

, 82-83 3 (2010). 4 III. DISCUSSION 5 By the instant motion, Defendants seek an order dismissing the above-titled action on 6 the grounds that (1) Plaintiff lacks Article III standing, and (2) that Plaintiff has failed to allege 7 facts sufficient to support any of his claims for relief. Before addressing the merits of 8 Plaintiff’s claims, however, the Court must confirm its subject-matter jurisdiction. See Slick v. 9 CableCom, LLC, No. 22-cv-03415,

, *1 (N.D. Cal. Sept. 12, 2022) (noting 10 that a court “cannot decide the motion to dismiss if it lacks subject matter jurisdiction”). 11 Plaintiff asserts that this Court has jurisdiction over this action under the Class Action 12 Fairness Act (“CAFA”),

(d)(2). (Compl. ¶ 11). “CAFA vests the federal 13 courts with ‘original’ diversity jurisdiction over class actions [of 100 or more persons] if: (1) 14 the aggregate amount in controversy exceeds $5,000,000, and (2) any class member is a citizen 15 of a state different from any defendant.” Serrano v. 180 Connect, Inc.,

, 1020–21 16 (9th Cir. 2007) (citing

(d)(2)). The enactment of CAFA did not alter the 17 longstanding rule that the proponent of federal jurisdiction bears the burden of establishing that 18 jurisdiction. Abrego v. Dow Chem. Co.,

(9th Cir. 2006). Here, Plaintiff has 19 not properly pled that CAFA’s amount in controversy requirement is met. 20 Plaintiff’s prayer for relief is silent as to what amount of damages he seeks, (Compl. ¶ 21 88), and the Complaint otherwise fails to calculate or explain how the $5,000,000 bar will be

22 met in light of the injuries alleged. (See generally id.). Further, Plaintiff’s allegations of class 23 numerosity is limited to an assertion that "thousands of Class Members received letters from 24 Defendants notifying them that Defendants learned of suspicious activity that allowed one or 25 more cybercriminals to access their system containing . . . [their PII.]” (Id. ¶ 26). Plaintiff does 1 not provide any basis for the claim that there are thousands of putative class members,2 or that 2 the combined amount in controversy would meet the jurisdictional threshold. 3 Plaintiff’s conclusory allegation that the amount in controversy exceeds $5,000,000 is 4 insufficient, without supporting factual allegations, to establish that the amount in controversy 5 requirement under CAFA has been met. See Ibarra v. Manheim Invs., Inc.,

, 6 1197 (9th Cir. 2015) (explaining that the proponent of federal jurisdiction, “has the burden to 7 put forward evidence showing that the amount in controversy exceeds $5,000,000, to satisfy the 8 requirements of CAFA, and to persuade the court that the estimate of damages in controversy is 9 a reasonable one”); Doe by and through Pope v. Rady Children’s Hospital-San Diego, No. 10 3:21-cv-00114,

, at *2 (S.D. Cal. July 19, 2021) (determining that plaintiff’s 11 complaint in a data breach case involving a proposed class of 19,788 individuals, failed to show 12 that the amount in controversy requirement of CAFA was met by solely relying only on 13 conclusory assertions that damages exceeded $5,000,000). A party seeking federal jurisdiction 14 needs only to put forward a “plausible allegation that the amount in controversy exceeds the 15 jurisdictional threshold,” if their allegation is not challenged by the opposing party or 16 questioned by the court. Dart Cherokee Basin Operating Co., LLC v. Owens,

, 89 17 (2014). Furthermore, a party “is permitted to rely on ‘a chain of reasoning that includes 18 assumptions.’” Arias v. Residence Inn,

(9th Cir. 2019) (quoting Ibarra, 775 19 F.3d at 1199). However, “those assumptions cannot be pulled from thin air but need some 20 reasonable ground underlying them.” Ibarra,

. 21

22 23 2 Plaintiff argues that satisfaction of the numerosity requirement is evidenced by the fact that Defendant submitted its data breach notification to the California Attorney General, thereby indicating that more than 500 24 California residents were impacted. (Resp. 13:20–27, ECF No. 23). According to Plaintiff, California law requires a company to submit a copy of a data breach notification only when more than 500 California residents 25 are impacted by the breach. (Id.). Even assuming this as true, Plaintiff’s evidence of the numerosity requirement fails to aid the Court in determining the amount in controversy requirement. At most, Plaintiff has shown that there are hundreds of class members rather than the thousands they pled in the Complaint. 1 Because the Court has reservations about whether the amount in controversy meets the 2 CAFA threshold, Plaintiff must support his allegations with evidence establishing the amount 3 in controversy. Dart Cherokee, 574 U.S. at 89; see also Petkevicius v. NBTY, Inc., No. 3:14-cv- 4 02616-CAB-(RBB),

, at *4 (S.D. Cal. Mar. 24, 2017) (“[S]imply stating that 5 the amount in controversy exceeds $5,000,000, without any specific factual allegations as to the 6 actual amount sought by the plaintiffs does not constitute a good faith allegation of the amount 7 in controversy any more than an allegation that ‘the parties are diverse’ would be sufficient to 8 establish the requisite diversity absent specific factual allegations of the citizenship of the 9 parties.”). Here, the only support Plaintiff offers to show the amount in controversy 10 requirement is met are past settlements of data breach and privacy cases for over $5,000,000. 11 (Resp. 14:3–25, ECF No. 23). However, “the Court properly considers the amount Plaintiff[] 12 put in controversy through the allegations in [his] Complaint, not what Defendants might 13 ultimately pay in resolving the lawsuit.” Copple v. Arthur J. Gallegher & Co., No. 22-cv-0116, 14

, at *7 (W.D. Wash. Aug. 2, 2022). Although evidence of past settlement 15 amounts are relevant, they do not “resolve the question of the total amount of damages in 16 controversy.”

Indeed, the settlement amounts reflect only negotiated resolutions made prior 17 to trial; they do not show the potential total amount of damages. See Gonzalez v. CarMax Auto 18 Superstores, LLC,

(9th Cir. 2016) (“[T]he amount in controversy [is] the 19 amount at stake in the underlying litigation” which “includes any result of the litigation, 20 excluding interests and costs, that entail[s] a payment by the defendant.”) (cleaned up and 21 citations omitted).

22 Accordingly, Plaintiff’s Complaint is DISMISSED without prejudice. Pursuant to 28

, Plaintiff is granted leave to file an amended complaint to cure the deficiencies 24 identified by this Order. If Plaintiff chooses to file an amended complaint, he must do so no 25 later than January 23, 2022. Any amended complaint must make a plausible showing that 1 CAFA’s jurisdictional threshold regarding the amount in controversy have been met. Failure to 2 file an amended complaint will result in a final order dismissing this civil action either for want 3 of subject matter jurisdiction or for failure to prosecute in compliance with a court order 4 requiring amendment. See Lira v. Herrera,

(9th Cir. 2005) (“If a plaintiff 5 does not take advantage of the opportunity to fix his complaint, a district court may convert the 6 dismissal of the complaint into dismissal of the entire action.”). 7 IV. CONCLUSION 8 IT IS HEREBY ORDERED that Plaintiff’s Complaint, (ECF No. 1), is DISMISSED 9 without prejudice. 10 IT IS FURTHER ORDERED that Defendants’ Motion to Dismiss, (ECF No. 17), is 11 DENIED as moot. 12 DATED this __2_2__ day of December, 2022. 13 14 ___________________________________ Gloria M. Navarro, District Judge 15 UNITED STATES DISTRICT COURT 16 17 18 19 20 21 22 23 24 25