POC USA LLC v. Expeditors International of Washington Inc

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON AT SEATTLE

POC USA, LLC, Case No. C23-1816-RSM Plaintiff, ORDER GRANTING AND DENYING IN PART DEFENDANT’S MOTION FOR v. SUMMARY JUDGMENT EXPEDITORS INTERNATIONAL OF WASHINGTON, INC., Defendant.

I. INTRODUCTION This matter comes before the Court on Defendant Expeditors International of Washington, Inc.’s Motion for Summary Judgment. Dkt. #36. Plaintiff POC USA, LLC, opposes the motion. Dkts. #60 and #62. The Court held oral argument on this Motion on April 15, 2025. Dkt. #98. For the following reasons, the Court GRANTS AND DENIES IN PART Defendant’s Motion.

II. BACKGROUND In March 2016, Plaintiff entered into a Distributor Services Agreement (“DSA” or “the contract”) with Defendant, outlining that Defendant would receive shipments of biking and other sporting products manufactured by Plaintiff, warehouse the products, and ship the products to Plaintiff’s customers. Dkt. #37, Bailey Decl., Ex. C. Defendant would perform these duties using its own computerized distribution management system, and Defendant was required to provide real-time visibility to Plaintiff of its products. This contract was amended in 2019. Id. at Ex. D and Ex. E.

1 Defendant’s service included its “One Global Platform,” which provided real-time visibility of Plaintiff’s orders and goods with “Uptime” of “[o]ver 99.5%.” Id. at Ex. A.

Defendant’s IT infrastructure and software was chosen and provided by Defendant.

In February 2022, Defendant suffered a cyberattack. Dkt. #36 at 1. Instead of paying a ransom, Defendant shut down most of its operating systems. Id. During this shutdown, Defendant attempted to use a manual distribution method to fulfill its services for Plaintiff. Id. However, this shutdown and manual system caused Plaintiff to limit orders, causing customer complaints, cancelled orders, and lost business. Dkt. #68, Coates Decl., at ¶¶ 32-55. “By the time Expeditors was able to resume normal services to POC, the window of opportunity to sell cycling equipment during the still booming 2022 biking season had passed.” Id. at ¶ 51.

Plaintiff filed its Complaint on November 27, 2023. Dkt. #1. On January 25, Defendant filed its Motion to Dismiss, Dkt. #14, which this Court granted and denied in part on April 11, 2024, Dkt. #28. The Court dismissed Plaintiff’s claims for negligence, gross negligence, and bailment. Id. On January 14, 2025, Defendant filed the instant Motion, requesting the Court grant summary judgment on Plaintiff’s remaining claims for breach of contract, breach of implied covenant of good faith and fair dealing, unjust enrichment, and violation of the Washington Consumer Protection Act (“WCPA”). Dkt. #36. On April 15, 2025, the Court held oral argument on this Motion. Dkt. #98.

III. DISCUSSION A. Legal Standard Summary Judgment is appropriate where “the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ. P. 56(a); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247 (1986). Material facts are those which might affect the outcome of the suit under governing law. Anderson, 477 U.S. at 248. In ruling on summary judgment, a court does not weigh evidence to determine the truth of the matter but “only determine[s] whether there is a genuine issue for trial.” Crane v. Conoco, Inc., 41 F.3d 5547, 549 (9th Cir. 1994) (citing Federal Deposit Ins. Corp. v. O’Melveny & Meyers, 969 F.2d 744, 747 (9th Cir. 1992)).

On a motion for summary judgment, the court views the evidence and draws inferences in the light most favorable to the non-moving party. Anderson, 477 U.S. at 255; Sullivan v. U.S. Dep’t of the Navy, 365 F.3d 827, 832 (9th Cir. 2004). The Court must draw all reasonable inferences in favor of the non-moving party. See O’Melveny & Meyers, 969 F.2d at 747, rev’d on other grounds, 512 U.S. 79 (1994). However, the non-moving party must make a “sufficient showing on an essential element of her case with respect to which she has the burden of proof” to survive summary judgment. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986).

B. Analysis Defendant moves for summary judgment dismissal on Plaintiff’s surviving claims: (1) breach of the implied covenant of good faith and fair dealing; (2) breach of contract; (3) violation of the WCPA; and (4) unjust enrichment.

1. Contract and Duty of Good Faith and Fair Dealing Claims Defendant argues that Plaintiff’s good faith and fair dealing claim should be dismissed because Defendant had no cybersecurity obligation, this obligation does not exist in the contract, and Plaintiff’s claim “is one of contractual non-performance, not bad faith.” Dkt. # 36 at 8-9.

Defendant argues that Plaintiff’s claim “is generic, non-specific, and untethered to any contractual provision[,]” which Plaintiff later “morphed its position to argue that the term ‘Standard Security’ in the [contract] . . . created or encompassed some obligation to prevent a cyberattack.” Id. at 7. Defendant points to several of Plaintiff’s witness statements to argue that Plaintiff never discussed cybersecurity with Defendant and could not find a document defining “Standard Security” or an agreed-upon definition. Id. at 7-8. Because the parties’ agreement is governed by a contract with no cybersecurity obligation, Defendant contends, this alleged duty is “abstract” and nonexistent. Id. at 6. Regarding said contract, Defendant argues that Plaintiff’s breach of contract claim fails because the “Standard Security” contract term only covers physical security of goods, not cybersecurity, and the contract precludes Plaintiff’s damages. Id. at 18- 21.

To establish a breach of contract claim, Plaintiff must prove: (1) the existence of a contract, (2) a material breach of that contract, and (3) resulting damage. See St. John Med. Ctr. v. State ex rel. Dep’t of Soc. &Health Servs., 110 Wn. App. 51, 64 (2002). Whether a contract has been formed and/or breached “may be determined as a matter of law if reasonable minds could not differ.” P.E. Sys., LLC v. CPI Corp., 176 Wn.2d 198, 207 (2012). Under Washington law, “extrinsic evidence is admissible to assist the court in ascertaining the parties’ intent and in interpreting the contract.” Spectrum Glass Co., Inc. v. Pub. Util. Dist. No.1 of Snohomish Cnty., 129 Wash. App. 303, 311, 119 P.3d 854, 858 (2005) (citing U.S. Life Credit Life Ins. Co. v. 15 Williams, 129 Wn.2d 565, 569, 919 P.2d 594 (1996)). Courts may consider the contract’s: (1) subject matter and objective; (2) circumstances around its making; (3) the parties’ conduct; (4) reasonableness of the parties’ interpretations; (5) preliminary negotiation party statements; (6) usages of trade; and (7) the parties’ course of dealing. Id. (citing Berg v. Hudesman, 115 Wn.2d 19 657, 666-68, 801 P.2d 222 (1990)). However, the court may not consider extrinsic evidence “to show a party’s unilateral or subjective intent as to the meaning of a contract word or term[.]” Id. (citing Hollis v. Garwall, Inc., 137 Wn.2d 683, 695, 974 P.2d 836 (1999)). “Interpreting a contract provision is a question of law when (1) the interpretation does not depend on the use of extrinsic evidence or (2) only one reasonable inference can be drawn from the extrinsic evidence.” Id. (citing Tanner Elec. Co-op. v. Puget Sound Power Light Co., 128 Wn.2d 656, 674, 911 P.2d 1301 (1996)).

“There is in every contract an implied duty of good faith and fair dealing” that “obligates the parties to cooperate with each other so that each may obtain the full benefit of performance.”

Rekhter v. Dep’t of Soc. & Health Servs., 180 Wn.2d 102, 112, 323 P.3d 1036 (2014) (quoting Badgett v. Sec. State Bank, 116 Wn.2d 563, 569, 807 P.2d 356 (1991)). This implied covenant “cannot add or contradict express contract terms and does not impose a free-floating obligation of good faith on the parties.” Id. at 113. Instead, “the duty arises only in connection with terms agreed to by the parties.” Id. (citations omitted). The duty can arise “when the contract gives one party discretionary authority to determine a contract term.” Id. (quoting Goodyear Tire & Rubber Co. v. Whiteman Tire, Inc., 86 Wn. App. 732, 738, 935 P.2d 628 (1997)).

The Court finds that it cannot interpret the parties’ contract as requested by the moving party or find breach as a matter of law. The term “Standard Security” is undefined in the contract and surrounding documents, and Defendant points to extrinsic evidence such as email to argue that this term does not refer to cybersecurity. See Dkt. #36 at 18. Even considering this evidence, Defendant has failed to show that “only one reasonable inference can be drawn from” it. Tanner Elec. Co-op. at 674. Taking all reasonable inferences in Plaintiff’s favor, the parties’ communications about the physical security of goods do not rule out all reasonable conclusions that cybersecurity fit within the term “Standard Security” or was otherwise included in a contract for services related to a global, cybernetwork. See Dkt. #37, Daily Decl., at ¶¶ 7, 9, 13, 12, 13, 14, 15, Ex. A, Ex. C, and Ex. D.

Furthermore, because a cybersecurity duty could reasonably exist under the contract, the Court finds that Defendant has failed to show that Plaintiff’s claim for breach of the implied duty of good faith and fair dealing is untethered to a contract term or duplicative. Defendant’s reliance on one witness’ statements to argue that Plaintiff’s claim is actually “one of contractual non- performance, not bad faith[,]” is not conclusive and not the only reasonable inference here. Dkt. #36 at 9; see also Dkt. #38, Saeturn Decl., Ex. A. The parties’ competing evidence shows that there are disputes of material fact that cannot be resolved at summary judgment. These factual questions of contract and breach are better left to a fact-finding jury. The Court will not dismiss these claims.

2. WCPA Defendant argues that Plaintiff’s WCPA claim fails because “[t]he undisputed evidence demonstrates that Expeditors made no promise or guarantee to POC regarding any aspect of cybersecurity . . . [and] POC in no way relied on any of these supposed unfair or deceptive statements and, as a matter of law, cannot establish” causation or injury. Dkt. #36 at 15-16.

For a private WCPA action, “a plaintiff must establish five distinct elements: (1) unfair or deceptive act or practice; (2) occurring in trade or commerce; (3) public interest impact; (4) injury to plaintiff in his or her business or property; (5) causation.” Hangman Ridge Training Stables, Inc. v. Safeco Title Ins. Co., 105 Wn.2d 778, 780 (1986). Whether a particular act or practice is “unfair or deceptive” is a question of law. Panag v. Farmers Ins. Co. of Wash., 166 16 Wn.2d 27, 47, 204 P.3d 885 (2009). A plaintiff need not show that the defendant intended to deceive but only that the alleged act had “the capacity to deceive a substantial portion of the public.” Id. “Deception exists ‘if there is a representation, omission[,] or practice that is likely to mislead’ a reasonable consumer.” Id. at 50 (quoting Sw. Sunsites, Inc. v. Fed. Trade Comm’n, 785 F.2d 1431, 1435 (9th Cir. 1986)). But the “universe of ‘unfair’ business practices is broader than, and encompasses, the universe of ‘deceptive’ business practices.” Id. at 51. Thus, a deceptive act is necessarily unfair, but an unfair act is not necessarily deceptive. Acts are “unfair” if they cause substantial injury that is “not outweighed by countervailing benefits to consumers or competitors, and not reasonably avoidable by the consumer.” Id. “Furthermore, as a more general matter, federal courts applying Washington law have consistently found that a ‘failure to employ adequate data security measures’ that ‘result in harm to thousands of customers’ is sufficient to constitute an ‘unfair’ act under the WCPA.” In re Accellion, Inc. Data Breach Litigation, 2024 WL333893, at *18 (N.D. Cal. Jan. 29, 2024) (citing Veridian, 295 F. Supp. 3d at 1162 (W.D. Wash. 2017), Krefting v. Kaye-Smith Enterprises Inc., 2023 WL 4846850, at *8 (W.D. Wash. July 28, 2023), Guy v. Convergent Outsourcing, Inc., 2023 WL 4637318, at *8 (W.D. Wash. July 20, 2023), and Buckley, 2018 WL 1532671, at *4 (W.D. Wash. Mar. 29, 2018).

Defendant contends that Plaintiff has not established that Defendant’s actions were unfair or deceptive. Defendant asserts that this Court should dismiss Plaintiff’s WCPA claim and consistently hold to the Ninth Circuit’s decision in Grey v. Amazon.com Inc., 2024 WL 2206454 (9th Cir. May 16, 2024). There, plaintiffs alleged harm from using Alexa-enabled devices and Amazon’s alleged misrepresentations of using Alexa voice recordings for targeted advertising purposes. See gen. id. The Ninth Circuit affirmed the District Court’s ruling that the “plaintiffs did not adequately allege causation for those [Amazon public] statements [that it was not using voice recordings for targeted advertising] because they made no allegations that they ‘viewed or heard any of those statements or were otherwise aware of them at the time they purchased their Alexa-enabled devices or at any time prior to the filing of this lawsuit.’” Id. at *2. Defendant argues that Plaintiff “was not even aware of what it now claims are ‘unfair or deceptive’ statements until after the cyberattack” and cannot establish causation. Dkt. #36 at 16.

The Court finds that Plaintiff has sufficiently shown that that Defendant could provide cybersecurity and presented this to Plaintiff and the public, which could deceive or mislead a reasonable consumer. Unlike Grey, Plaintiff contends here that Defendant represented its up- to-snuff cybersecurity from the beginning, both to Plaintiff and the public, not that it learned of Defendant’s cybersecurity after the cyberattack. As shown in the parties’ communications, Defendant’s “One Global Platform,” its “Warehouse Management System” providing “‘real time’ visibility . . . accurate up to the second[,]” E-mail deliveries, and the like were all included as part of the contract distribution services. See Dkt. #37, Bailey Decl., Ex. A. As detailed above, the parties have submitted competing evidence on whether cybersecurity was included in the contract and how Defendant presented its cybersecurity capabilities to Plaintiff and the public.

Accordingly, the Court finds there are genuine disputes of material facts regarding this claim, Plaintiff has made a “sufficient showing of essential elements” on this claim, and, drawing all reasonable inferences in Plaintiff’s favor, Defendant is not entitled to judgment as a matter of law.

3. Unjust Enrichment Plaintiff argues that Defendant was unjustly enriched by refusing to pay the ransom demanded by the cyber-attackers and, instead, “made the decision to shift the costs of not paying the ransom to its customers[.]” Dkt. #60 at 7. Defendant contends that the parties’ relationship is governed by a contract, and the supposed “savings” by refusing to pay the ransom do not constitute a “benefit conferred” by Plaintiff on Defendant. Dkts. #36 at 10-12 and #76 at 1-3.

Unjust enrichment exists as a remedy where no contract exists, but a quasi-contract implied in law “arises from an implied duty of the parties not based on a contract, or on any consent or agreement.” Heaton v. Imus, 93 Wn.2d 249, 252 (1980). “Unjust enrichment is the method of recovery for the value of the benefit retained absent any contractual relationship because notions of fairness and justice require it.” Young v. Young, 164 Wn.2d 477, 484 (2008).

To establish a claim for unjust enrichment, a plaintiff must show that: (1) a benefit was conferred on the defendant; (2) the defendant had knowledge or appreciation of the benefit; and (3) the defendant’s retainment of the benefit without payment of its value is inequitable under the circumstances. Id. at 484-85.

Taking all reasonable inferences in Plaintiff’s favor, the parties dispute nevertheless revolves around the terms of their contract and related actions. Moreover, the Court fails to see how refusing to pay criminals a ransom for hijacking a service system constitutes Plaintiff conferring a benefit on Defendant. Plaintiff cites to no cases to support the application of unjust enrichment under these or comparative circumstances. See gen. Dkt. #60. Accordingly, the Court will dismiss this claim.

IV. CONCLUSION Having reviewed the instant Motion, responsive briefings, declarations, and the remainder of the record, the Court hereby finds and ORDERS that Defendant’s Motion for Summary Judgment, Dkt. #36, is GRANTED AND DENIED IN PART. Plaintiff’s unjust enrichment claim is DISMISSED with prejudice. All other claims (for breach of contract, breach of implied covenant of good faith and fair dealing, and Washington Consumer Protection Act violations) REMAIN.

DATED this 6th day of June, 2025.

A RICARDO S. MARTINEZ UNITED STATES DISTRICT JUDGE