CHARLES R. BREYER, UNITED STATES DISTRICT JUDGE

ORDER GRANTING PRELIMINARY INJUNCTION

CHARLES R. BREYER, UNITED STATES DISTRICT JUDGE

Plaintiff Chegg Inc. (“Chegg”) renews its motion for preliminary injunction and alternative service, which the Court previously denied. See Renewed Mot. (dkt. 48); see Order Denying Mot. (dkt. 40). Because Chegg's newly presented factual evidence demonstrates: (1) a likelihood of success on all its claims and (2) irreparable harm due to Defendants' continued unauthorized access of Chegg's content, the Court GRANTS Chegg's renewed motion for a preliminary injunction. Further, the Court permits Chegg to serve Victor Swami under Federal Rule of Civil Procedure 4(f)(3), though rejects its request to do the same for John Does 1-3.

I. BACKGROUND

A. Factual Background

Chegg is an online learning platform that offers Chegg Study, a service that provides step-by-step solutions to problems in commonly used textbooks for high school and college students. Am. Compl. (dkt. 46) ¶ 29. Such solutions are hidden behind a paywall: a Chegg user must create an account, agree to Chegg's terms of use, and, after a free trial period, pay a subscription fee to see Chegg's solutions. Id. ¶¶ 30, 34. Defendants are several individuals who allegedly run a website called Homeworkify, see Renewed Mot. at 6-7; Hudson Decl. ¶¶ 9-15, which advertises itself as a “non-profit organization” with the goal of “providing] free and unrestricted access to knowledge,” see Homeworkify Home Page, https://homeworkify.eu/mirror-1/ (last visited October 24, 2023). On Homeworkify's website, students can “view the answers” they need from various homework help websites “at no cost.” Id.

Chegg alleges that Defendants have been stealing its content and posting it on Homeworkify. See Renewed Mot. at 16. Students thus no longer need to pay for a Chegg subscription to access the site's propriety materials; instead, they can view those materials for free on Homeworkify. See id. Chegg believes that Homeworkify's theft has resulted in significant losses of current and prospective customers, numbering over one hundred thousand for 2023 alone. See Huang Decl. ¶ 10.

To steal Chegg's content, Defendants have purportedly used various methods. Id. at 8. During summer 2022, Defendants apparently made free trial accounts on Chegg.com and then used automated means to steal large amounts of Chegg solutions at once. See Mot. at 3-4. Defendants have also allegedly used-and continue to use-stolen credentials to log in to individual subscribers' accounts, again giving them the ability to steal Chegg's complete library. See Heasman Decl. ¶¶ 31-40. When Chegg tried to stop Defendants from stealing its content, Defendants retaliated with a cyberattack that caused an outage on Chegg.com. See Heasman Decl. ¶¶ 32, 42-44.

Based on the Defendants' conduct, Chegg brings claims for violation of the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030; the California Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502 (“Section 502”); California's Unfair Competition Law (“UCL”), Cal. Bus. & Prof. Code § 17200; breach of contract; and trademark infringement under the Lanham Act. See Am. Compl. ¶¶ 11, 85-127. Chegg brought these claims in its first complaint (which formed the basis for Chegg's initial preliminary injunction motion), except for the newly-added UCL claim. Cf. Compl. (dkt. 1) ¶¶ 49-82.

B. Procedural History

Chegg filed its initial motion for preliminary injunction on June 3, 2023, which the Court held hearing on later that month. See Mot.; Dkt. 39, Minute Entry. Chegg requested a preliminary injunction that would, among other things, enjoin Defendants from operating Homeworkify's website. Mot. at 23. In addition, Chegg requested to serve Defendants by alternative means pursuant to Federal Rule of Civil Procedure 4(f)(3). Id. at 21-22.

The Court issued an order denying Chegg's requests on both fronts. See Order Denying Mot. On the preliminary injunction motion, the Court agreed that many factors tilt in Chegg's favor: the balance of the equities, the public interest, and the likelihood of success on Chegg's breach of contract and Lanham Act claims. Id. at 7-8, 10-11. But the Court ultimately concluded that Chegg fell short on the remaining issues. The Court found that Chegg did not establish a likelihood of success on its CFAA and Section 502 claims because Chegg failed to show unauthorized access. Id. at 4-7. The Court also explained that Chegg failed to demonstrate irreparable harm because there was no evidence that Chegg's loss of customers to Homeworkify “threatened] the possibility of Chegg's ‘extinction.'” Id. at 9.

The Court similarly rejected Chegg's request for alternative service. Id. at 11-12. While acknowledging that Chegg had undertaken substantial efforts to try to unmask the individual(s) operating Homeworkify, the Court concluded that Chegg had failed to actually do so. Id. Chegg, therefore, had no idea whether the individuals operating Homeworkify were even outside the United States. Without evidence that the operators were indeed foreign, the Court determined that service under Rule 4(f)(3) would not be appropriate.

That brings us to the motion at issue. Chegg renews its motion for a preliminary injunction and alternative service, armed with a more developed factual record and a newly amended complaint. In its renewed motion, Chegg only contests those issues for which the Court previously ruled against it. Specifically, Chegg presents new evidence to attempt to establish the following: likelihood of success on its CFAA, Section 502, and UCL claims; irreparable harm; that Defendants are based outside the United States.

Chegg seeks the same relief as in its initial motion. It requests that Court enter a preliminary injunction that enjoins Defendants from “(1) accessing Chegg's website without authorization, (2) downloading, scraping, using, or disseminating Chegg Content, (3) operating the Homeworkify and/or the Redirect Sites, and (4) using and infringing Chegg's trademarks.” Renewed Mot. at 3. To effectuate this injunction, Chegg seeks a Court order “requiring and/or requesting that Homeworkify's hosting providers seize its domains and transfer them to Chegg.” Id. at 3-4. Chegg also requests that the Court order alternative service under Federal Rule of Civil Procedure 4(f)(3). Id.

The Court addresses the Rule 4(f)(3) service issue first. Then, the Court addresses the preliminary injunction issues in the order in which Chegg raises them.

II. ALTERNATIVE SERVICE

A. Legal Standard

Federal Rule of Civil Procedure 4(f) provides methods for serving an individual in a foreign country. See Fed.R.Civ.P. 4(f). Pursuant to Rule 4(f)(3), unless federal law provides otherwise, “an individual . . . may be served at a place not within any judicial district of the United States: . . . (3) by other means not prohibited by international agreement, as the court orders.” Fed.R.Civ.P. 4(f)(3). Service of process under Rule 4(f)(3) is “neither a ‘last resort' nor ‘extraordinary relief,'” but rather “one means among several which enables service of process on an international defendant.” Rio Properties, Inc. v. Rio Int'l Interlink, 284 F.3d 1007, 1016 (9th Cir. 2002). Therefore, a plaintiff need not attempt service by another method before seeking leave from the Court to serve defendant pursuant to Rule 4(f)(3); the plaintiff need only “demonstrate that the facts and circumstances of the present case necessitate[] the district court's intervention.” Id.

As the Court explained in its prior order, service under Rule 4(f)(3) is appropriate once there is sufficient evidence that a defendant is foreign. See Rio Properties, Inc. v. Rio Int'l Interlink, 284 F.3d 1007, 1013, 1018-19 (9th Cir. 2002) (allowing the plaintiff to serve process by email on a Costa Rican entity with an unknown address); Elsevier, Inc. v. Siew Yee Chew, 287 F.Supp.3d 374, 377, 380 (S.D.N.Y. 2018) (service by email on defendants that plaintiff learned were based out of China and Malaysia but whose location could not otherwise be determined); Assef v. Does, 1-10, No. 15-CV-01960-MEJ, 2016 WL 1191683, at *3-4 (N.D. Cal. Mar. 28, 2016) (allowing alternative service under Rule 4(f)(3) in part because “plaintiff's have learned that Defendants are likely based in either Singapore or Australia”). A defendant's precise address need not be known, but the party seeking alternative service must provide enough evidence to show that defendant likely resides outside the United States. See Assef, 2016 WL 1191683, at *3-4.

B. Discussion

Chegg seeks an order allowing it to serve Defendants Swami and John Does 1-3 via alternative methods, pursuant to Federal Rule of Civil Procedure 4(f)(3). See Renewed Mot. at 5. The Court previously denied this request because, at that time, Chegg was “unsure who is behind Homeworkify, and whether they are based inside or outside the United States.” See Order Denying Mot. at 11-12. And Chegg cited no case that supported Rule 4(f)(3) being “used to serve an entirely unknown defendant without any evidence that that defendant is foreign.” Id. at 12.

This time, Chegg argues that alternative service under Rule 4(f)(3) is appropriate because it has compelling evidence that Defendants are in India. See Renewed Mot. at 58. First, Chegg claims that it has evidence that a specific individual, Vikasa Swami, runs Homeworkify and is “unequivocal[ly]” based in India. Id. at 5. Second, Chegg submits evidence that three other individuals who it has yet to identify, John Does 1-3 (the “Doe Defendants”), likely reside in India too. The Court analyzes Chegg's evidence for Vikasa Swami and the Doe Defendants in turn.

1. Vikasa Swami

After long and arduous efforts, Chegg has identified one of the individuals running Homeworkify: Vikasa Swami. See Hudson Decl. ¶¶ 11-12. In June 2023, Chegg hired a cyber threat intelligence investigation firm to help it identify the individuals behind Homeworkify. Id. ¶ 9. As part of the investigation, investigators from that firm joined the following Telegram groups: “Homeworkify.net,” “Free Chegg Alert,” and “Unblur Chegg Answers.” Id. Posing “as people seeking help obtaining free Chegg content,” the investigators began communicating with the user “who seemed most active in providing free Chegg content.” Id. ¶ 10-11. That user had the username “@theviikash.” Id. Throughout those communications, @theviikash “admitted to running Homeworkify, described himself as a Chegg ‘expert,' and shared a screenshot of a subscriber-only Chegg portal” which he appeared to be logged into. Id. This is compelling evidence that the user behind the @theviikash Telegram account helps to run Homeworkify.

At one point, @theviikash “stated he lives in Rajasthan, India near Bikaner.” Id. The investigators corroborated this statement by sending a hyperlink that, when opened, showed that "theviikash's IP address resolved to a city in Rajasthan. Id. In addition, @theviikash responded “at times consistent with India Standard Time.” Id. The Court finds that, based on this evidence, it is very likely that the user who operates the @theviikash handle resides in India.

The user eventually shared his Instagram handle with investigators, which allowed them to figure out his name, Vikasa Swami, and to find an associated Gmail account: vikasaswami[@]gmail.com. Id. ¶ 12. Defendant Swami later shared another email address with the investigators: vik90571[@]gmail.com. Id.

Pursuant to Rule 4(f)(3), Chegg now seeks to serve Defendant Swami through several email accounts, as well as through the Telegram account with the username @theviikash. See Renewed Mot. at 8 (citing Heasman Decl. ¶ 48). The Court finds that, as to Defendant Swami, Chegg has remedied the shortfalls in its prior motion, and provided sufficient evidence to establish that Defendant Swami likely lives in India. Cf. Assef v. Does, 1-10, 2016 WL 1191683, at *3-4 (permitted alternative service under Rule 4(f)(3) where defendants were “likely based in either Singapore or Australia”).

The Court further concludes that serving Defendant Swami through email and Telegram-including through an email address which he himself provided and a Telegram account which he used to communicate with investigators-is “reasonably calculated under all the circumstances” to appraise Defendant Swami of the pendency of the action and afford him an opportunity to present his objections. See Rio Properties, 284 F.3d at 1016-17 (9th Cir. 2002) (citation omitted). In addition, service by email is not prohibited by international agreement with India, which is a signatory to the Hague Convention on Service Abroad of Judicial and Extrajudicial Documents. See Facebook, Inc. v. Banana Ads, LLC, No. C-11-3619 YGR, 2012 WL 1038752, at *2 (N.D. Cal. Mar. 27, 2012). And the Court is aware of no international agreement with India which forbids the use of service of process through messaging services such as Telegram.

Thus, Chegg can serve Defendant Swami through the following email and Telegram accounts: (1) 8f47b7b0dd3f4d558b03d5e7ad9d127a.protect@withheldforprivacy.com; (2) martinezdaniel432@protonmail.com; (3) @theviikash; (4) vik90571@gmail.com; (5) abuse@meerfarbig.net; (5) abuse@combahton.net. See Heasman Decl. ¶ 48.

2. Doe Defendants

Chegg also seeks to serve the Doe Defendants via alternative methods of service. See Renewed Mot. at 8. However, Chegg's evidence that the Doe Defendants either operate Homeworkify, or reside in India, is much less convincing than for Defendant Swami. As to their location, Chegg relies on two pieces of evidence: (1) that the Telegram channels in which they communicated are in India Standard Time; and (2) that one of the users in the “Unblur Chegg Answers” channel said that “almost all paid Chegg bot channels are Indian.” See Hudson Decl. ¶¶ 13-15. However, the time zone of the channel is not necessarily indicative of the time zone of the users in the channel, including the Doe Defendants. Same thing applies for the general assertion that “almost all paid Chegg bot channels are Indian”: while it might indicate that creators of most channels are in India, it does not speak to these specific users.

Moreover, the cases that Chegg cites in support of service under Rule 4(f)(3) all involved much more concrete evidence that the defendants were in a foreign country. See Rio Properties, Inc., 284 F.3d at 1013 (informed that defendant was in Costa Rica by its related entity); Elsevier, Inc., 287 F.Supp. at 377 (eBay and PayPal accounts traced to Malaysia and China); Assef, 2016 WL 1191683, at *3-4 (IP addresses traced to Singapore). Therefore, the Court concludes that Chegg has not provided sufficient evidence to establish that John Does 1-3 reside in India (or outside the United States at all), so service under Rule 4(f)(3) is still inappropriate as to them.

Even if the evidence did make it likely that the Doe Defendants are in India, the Court still would not permit Chegg to serve them under Rule 4(f)(3). That is because Chegg's proposed service of the Doe Defendants through Homeworkify's registered email address, see Renewed Mot. at 8, does not comport with constitutional notions of due process. There is no compelling evidence that the Doe Defendants directly operate the Homeworkify site: John Doe 1 said he was “not active” in Homeworkify; John Doe 2 denied that he owned Homeworkify and stated he did not know any owners of the website; and there is no allegation that John Doe 3 is involved with running the site at all. See Hudson Decl. ¶¶ 13-15. Therefore, service through Homeworkify's registered email address-as opposed to, for example, the Doe Defendants' Telegram accounts-is not “reasonably calculated under all the circumstances” to appraise the Doe Defendants of the pendency of the action and afford them an opportunity to present their objections. See Rio Properties, 284 F.3d at 1016-17 (9th Cir. 2002). Accordingly, the Court also rejects Chegg's request to use alternative means to serve the Doe Defendants on due process grounds.

III. PRELIMINARY INJUNCTION

A. Legal Standard

A preliminary injunction is an “extraordinary remedy that may only be awarded upon a clear showing that the plaintiff is entitled to such relief.” See Winter v. Natural Res. Def. Council, Inc., 555 U.S. 7, 22 (2008). The party seeking a preliminary injunction must establish: (1) a likelihood of success on the merits; (2) a likelihood of irreparable harm absent preliminary relief; (3) that the balance of equities tips in the plaintiff's favor; and (4) that an injunction is in the public interest. See id. at 20. While the Ninth Circuit employs a sliding scale approach, a plaintiff must still establish every Winter factor. See Alliance for Wild Rockies v. Cottrell, 632 F.3d 1127, 1134-35 (9th Cir. 2011).

B. Discussion

The Court previously found that Chegg established some Winter factors but failed to establish others. As for the factors Chegg met: The Court concluded that the balance of the equities and public interest tipped in Chegg's favor based on Homeworkify's continued theft and use of Chegg's content. See Order Denying Mot. at 10-11. The Court also concluded that Chegg demonstrated a likelihood of success on its breach of contract and Lanham Act claims. See id. at 7-9. On the other hand, the Court found that Chegg failed to demonstrate a likelihood of success on its CFAA or Section 502 claims, as well as that Chegg failed to establish irreparable harm. Id. at 9-10.

Now, Chegg presents new evidence supporting its likelihood of success on its CFAA and Section 502 claims, as well as its UCL claim (which Chegg added in its Amended Complaint). Chegg also submits additional evidence to demonstrate irreparable harm. Because nothing has changed with respect to the elements for which the Court found in Chegg's favor, the Court adopts those previous conclusions. See Order Denying Motion at 7-9, 10-11. The Court therefore only analyzes the elements which Chegg contests in its renewed motion.

1. Likelihood of Success on the Merits

a. CFAA

Under the CFAA, a party may be subject to liability if it “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains . . . information from any protected computer.” 18 U.S.C § 1030(a)(2). A “protected computer” is essentially any computer connected to the Internet. See hiQ Labs, Inc. v. LinkedIn Corp., 31 F.4th 1180, 1195 (9th Cir. 2022).

Chegg previously failed to demonstrate likelihood of success on the merits for its CFAA claim, because it only alleged that Defendants “exceeded authorized access” by making free accounts and taking Chegg's content, in violation of Chegg's terms of service. See Order Denying Mot. at 4-7. As the Court explained, however, a violation of terms of service cannot alone establish liability under the CFAA. Id. (citing Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016)). Further, Chegg's allegation that Homeworkify continued scraping its content after it sent a cease-and-desist letter lacked sufficient facts to establish a likelihood of success. Id. But the Court noted that if Chegg could “persuasively demonstrate that Homeworkify [was] behind the cyberattack” Chegg recently experienced, that could change the outcome on this claim. Id. at 6 n.4.

Chegg points to two new pieces of evidence in support of its CFAA claim: (1) that Defendants have used stolen credentials to log in to subscriber accounts and access Chegg.com without authorization, including after Chegg sent a cease-and-desist letter; (2) that Homeworkify was likely behind the cyberattack it experienced, given that the IP addresses used in the attack are connected to Homeworkify and to Defendant Swami. Id. ¶44

Chegg demonstrates a likelihood of success on the merits under either theory. On the first theory: Chegg submits compelling evidence that, in at least two instances, Defendants obtained Chegg's content by using “stolen” user credentials-i.e., credentials leaked in a data breach-to log in to “legitimate Chegg subscriber accounts” without “the subscribers' or Chegg's authorization.” Heasman Decl. ¶¶ 35-40. In both instances, Defendants obtained and then reposted Chegg's materials onto Homeworkify. Id. This falls comfortably within the type of “unauthorized access” that the CFAA prohibits. Cf. United States v. Nosal, 844 F.3d 1024, 1029 (9th Cir. 2016).

Even if Defendants argue that this access was authorized because the accounts were legitimate subscriber accounts, that claim is undermined by the fact that one of the two instances occurred after Defendants received a cease-and-desist letter from Chegg. Id. ¶¶ 7, 8, 38-40. Among other things, that letter stated that Defendants must “agree never to access Chegg's website, servers, or services again, under any circumstances.” See Heasman Decl., Ex. B. So, even assuming Defendants' use of the legitimate accounts to access Chegg.com was somehow “authorized access” prior to the cease-and-desist letter, Defendants surely accessed the site without authorization once Chegg revoked any and all access to its website in the letter. See Power Ventures, Inc., 844 F.3d at 1068-69 (continuing to access a website's content after a company issued cease-and-desist letter is access “without authorization” under the CFAA).

Therefore, the Court finds that Chegg has established a likelihood of success on its CFAA claim based on Defendants' use of stolen credentials to access and obtain Chegg's materials, including after receiving a cease-and-desist letter, which Defendants thereafter reposted on Homeworkify's website.

Chegg also establishes a likelihood of success on the merits of its CFAA claim based on its second theory: Defendants' involvement in the cyberattack carried out on Chegg's servers, which caused an outage on Chegg.com for other users. Several courts have specifically held that a denial-of-service (“DDoS”) attack, a type of cyberattack, violates the CFAA. See, e.g., Ubisoft, Inc. v. Kruk, No. CV 20-478-DMG (ASX), 2021 WL 3472833, at *4 (C.D. Cal. July 9, 2021) (“[Plaintiff] sufficiently states a claim under 18 U.S.C. section 1030(a)(5)(A) by alleging that Defendants and their customers intentionally launch DDoS attacks on [Plaintiff's] Servers”); Svanaco, Inc. v. Brand, 417 F.Supp.3d 1042, 1059 (N.D. Ill. 2019) (undisputed that “DDoS attacks violated the CFAA”).

There is compelling evidence that Defendants were the ones who launched the DDoS attack on Chegg's servers. To start off, two of the IP addresses used in the DDoS attack are connected to Homeworkify-and one is connected to Defendant Swami specifically. See Heasman Decl. ¶ 44 (explaining that the DDoS attack used the same IP address that Defendants used for its scraping of Chegg's website during summer 2022, and the same IP address that Defendant Swami used to access the hyperlink sent by the investigator). In addition, this cyberattack happened the day after Chegg “sent a letter to the European hosting provider of Homeworkify.net and Homeworkify.eu, asking the provider to take down Homeworkify's domain.” Id. ¶ 43. The timing of this attack, in combination with IP addresses known to be connected to Defendants, is strongly compelling evidence that Defendants were behind the cyberattack.

Therefore, under either basis-whether Defendants' use of stolen credentials to log in to subscriber accounts and access Chegg content, or Defendants' cyberattack on Chegg's system-Chegg has sufficiently demonstrated that it is likely to succeed on the merits of its CFAA claim.

b. Section 502

Section 502, California's counterpart to the CFAA, imposes liability on a person who “[k]nowingly accesses and without permission takes, copies, or makes use of any data from a computer, computer system, or computer network, or takes or copies any supporting documentation, whether existing or residing internal or external to a computer, computer system, or computer network.” Cal. Penal Code § 502(c)(2).

In its prior order, the Court explained that while the CFAA and Section 502 are different, “the analysis under both statutes is similar in the present case” because both claims are based on the same facts. See Order Denying Mot. at 6 (quoting Power Ventures, Inc., 844 F.3d at 1069). So, like for its CFAA claim, Chegg previously failed to demonstrate that it was likely to succeed on the merits of its Section 502 claim, in part because it did not “provide sufficient evidence” that its cease-and-desist letter put Homeworkify “on notice that its access had been revoked.” Id.

For the same reasons that Chegg has now established a likelihood of success on its CFAA claim, Chegg does the same on its Section 502 claim. By allegedly accessing user accounts without authorization to steal Chegg's content, and carrying out cyberattacks on Chegg's systems-thereby “[k]knowingly accessing] and without permission tak[ing]” or “mak[ing] use of” Chegg's data-Chegg has demonstrated a likelihood of success on the merits of its Section 502 claim.

c. UCL

California's unfair competition law (the “UCL”) prohibits “any unlawful, unfair or fraudulent business act or practice.” Cal. Bus. & Prof. Code § 17200; Berryman v. Merit Prop. Mgmt., Inc., 152 Cal.App.4th 1544, 1554 (2007). “The UCL ‘borrow[s] violations of other laws and treats' them as unlawful business practices ‘independently actionable under section 17200.'” Oas v. Rama Cap. Partners, LLC, No. 820-CV01634-(MCS/ADS), 2020 WL 7786546, at *7 (C.D. Cal. Nov. 18, 2020) (quotation omitted). Therefore, a plaintiff can succeed on a UCL claim by establishing that the defendant violated another statute or common law. See Krantz v. BT Visual Images, 89 Cal.App.4th 164, 178 (2001) (UCL claims “stand or fall depending on the fate of the antecedent substantive causes of action”); see also Berryman, 152 Cal.App.4th at 1554 (“[A] violation of another law is a predicate for stating a cause of action under the UCL's unlawful prong.”).

Because Chegg has established a likelihood of success on its CFAA, Section 502, breach of contract, and Lanham Act claims-which, in turn, means a likelihood that Defendants have violated those laws-it is likely to prevail on its UCL claim too.

2. Irreparable Harm

“[M]onetary injury is not normally considered irreparable.” Los Angeles Mem'l Coliseum Comm'n v. Nat'l Football League, 634 F.2d 1197, 1202 (9th Cir. 1980). Rather, to show irreparable harm for an injury to one's business, a plaintiff must show a monetary injury that approximates a threat of “extinction.” See hiQ Labs, 31 F.4th at 1188. Loss of goodwill and the ability to control one's mark can amount to irreparable harm, but a plaintiff must point to actual evidence to demonstrate that “irreparable injury is likely in the absence of an injunction.” Herb Reed Enterprises, LLC v. Fla. Ent. Mgmt., Inc., 736 F.3d 1239, 1249 (9th Cir. 2013) (quoting Winter, 555 U.S. at 22).

Chegg failed to establish irreparable harm in its initial motion because it did not show “a significant threat to its business posed by Homeworkify, or actual evidence of loss of goodwill or reputation as a result of Homeworkify's use of Chegg's marks or solutions.” See Order Denying Mot. at 9.

Here, Chegg asserts newfound bases for irreparable harm: (1) that Defendants' unauthorized access and theft of Chegg's content constitutes irreparable harm; and (2) that Defendants have caused Chegg irreparable harm by causing the company to lose significant numbers of prospective customers. Because the Court finds that Chegg establishes irreparable harm on the first basis, there is no need to determine whether Chegg has put forth sufficient evidence to show a loss of prospective customers or irreparable harm as a result.

“Numerous courts have found that unauthorized access of computers and the acquisition of data in violation of the CFAA constitute irreparable harm.” Power Ventures, 252 F.Supp.3d at 782 (citing cases). That includes courts in this district, which have granted injunctive relief upon a showing that a defendant continued to access a plaintiff's computers, in an unauthorized manner, regardless of attempts to halt the access. See id.; Facebook, Inc. v. Sluchevsky, No. 19-CV-01277-JSC, 2020 WL 5823277 (N.D. Cal. Aug. 28, 2020); Tagged, Inc. v. Does 1 through 10, No. C 09-01713 WHA, 2010 WL 370331, at *12 (N.D. Cal. Jan. 25, 2010). In Power Ventures, the Court explained that “in accessing Facebook's computers without authorization, Defendants [had] interfered with Facebook's right to control access to its own computers and [had] acquired data to which Defendants have no lawful right in violation of the CFAA and § 502.” 252 F.Supp.3d at 782. Therefore, the court concluded that “Facebook ha[d] suffered irreparable harm.” Id.

The Court finds the same true here. Defendants' unauthorized access of Chegg's materials, in violation of the CFAA and Section 502, has continued despite Chegg's attempts to halt the access, including by sending a cease-and-desist letter. This unauthorized access is also likely to continue absent court intervention, particularly in light of Defendants' recent cyberattack on Chegg's servers. Therefore, Chegg has demonstrated that there is a likelihood of irreparable harm absent preliminary relief.

Chegg has established every Winter factor: It is likely that Chegg will succeed on the merits of each of its claims; Chegg will likely experience irreparable harm absent preliminary relief; and the balance of the equities and public interest weighs in favor of Chegg obtaining injunctive relief. Thus, Chegg is entitled to, and Defendants' conduct warrants granting, a preliminary injunction.

3. Scope of the Injunction

Chegg seeks an injunction that both enjoins Defendants from engaging in certain conduct, and which orders third-party hosting providers to take action regarding Homeworkify's domains. As to the injunction for Defendants, Chegg proposes, in part, the following language:

Defendants are temporarily restrained and enjoined from: (1) accessing Chegg's website without authorization; (2) downloading, scraping, using, or disseminating Chegg's proprietary content from Chegg.com; (3) operating the Homeworkify website and related domains; and (4) using and infringing Chegg's trademarks.

Numbers 1, 2, and 4 are especially well-tailored to stopping Defendants' harmful and illegal conduct-in fact, those provisions track language from the CFAA and Lanham Act. Number 3 is broader than the rest, but the Court still finds it appropriate. Because Defendants have already posted significant amounts of Chegg's materials on Homeworkify, continuing to operate the site with that stolen material will result in harm to Chegg.

In addition, Chegg proposes that the Court order the third-party domain registries and registrars responsible for maintaining Homeworkify's domains to transfer those domains to Chegg for 30 days. See Renewed Mot. at 21; see Supp. Br. (dkt. 63) at 2. Chegg's proposed language is as follows:

It is further ordered that, with respect to Homeworkify, the domain registries and registrars identified . . . shall take the following actions: . . . register the Homeworkify and Redirect Site domains in Chegg's name, until further order of the Court. The purpose of this paragraph is to ensure that Chegg has control over the hosting and administration of the Homeworkify and Redirect Site domains . . . .

Chegg argues this transfer remedy will “prevent Defendants from being able to access the Homeworkify sites, and will give Chegg the opportunity to analyze the sites' traffic and identify the vectors from which the stolen property is being directed to the websites.” See Renewed Mot. at 18. At the hearing on October 27, 2023, the Court requested supplemental briefing regarding cases in which courts have imposed this transfer remedy. See Minute Order (dkt. 53).

The Court finds that ordering the hosting providers to transfer Homeworkify's domains to Chegg is consistent with remedies ordered in similar cases, including cases in this district. In Craigslist, Inc. v. Christopher Meyer, et al., 09-cv-04737 MMC (N.D. Cal. Feb. 11, 2011), the court explained that “[w]here it is likely that Defendants will continue to use websites and/or domains to exacerbate the harm to a plaintiff [and not comply with the court's ordered injunctive relief], courts have . . . ordered the transfer of the domain names.” Id. at 7-8. The court concluded that the defendants in that case-who had “persisted in operating their craigslist-related websites”-were likely to ignore an injunction against the use of such domains, and thus ordered that the domains should be transferred. Id.

The defendant's conduct in Craigslist, Inc. is akin to the Defendants' continued unauthorized access of, and their copying and reposting of content from, Chegg.com. The Court also finds it to be likely that, given Defendants' continued harmful conduct after Chegg's cease-and-desist letter, they will ignore this Court's injunction against the use of the Homeworkify site. Accordingly, it is necessary to transfer Homeworkify's domains to Chegg to ensure that Defendants will no longer be able to publicly post anything on, or use, Homeworkify. This remedy also permits Chegg to determine how Defendants are diverting its content, to presumably prevent Defendants from being able to do so in the future. Therefore, the Court finds transferring Homeworkify's domain names to Chegg for 30 days to be reasonably tailored to the harm Chegg is experiencing, as well as necessary to effectuate this Court's other injunctive relief.

Finally, the Court will use its authority under the All Writs Act to order the third-party domain providers to transfer Homeworkify's domains to Chegg. The All Writs Act provides that courts “may issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.” 28 U.S.C. §1651. In appropriate circumstances, courts may direct an order under the All Writs Act to “persons who, though not parties to the original action or engaged in wrongdoing, are in a position to frustrate the implementation of a court order or the proper administration of justice.” Makekau v. State, 943 F.3d 1200, 1205 (9th Cir. 2019).

To determine whether the writ requested is “necessary or appropriate” within the meaning of the Act, courts must consider: (1) whether the writ “unreasonably] burdens” the third party at issue; (2) whether the writ is “necessary” or “essential to the fulfillment of the purpose” of a court order; and (3) whether the third party is “so far removed from the underlying controversy that its assistance could not be permissibly compelled.” United States v. New York Tel. Co., 434 U.S. 159, 172-78 (1977). Ordering third-party hosting providers to transfer Homeworkify's domains is “necessary” and “appropriate” when considering these three factors. Such an order will impose only a minimal burden on the third-party providers; transferring domain names is a routine business function for these companies. This writ is necessary to ensure that Homeworkify cannot continue to use its domain names to market Chegg's content. And these hosting providers are closely connected to the underlying controversy-they host the Homeworkify domains where users access the stolen Chegg content. Because it is necessary and appropriate based on these facts, the Court use its authority under the All Writs Act to issue a writ to the non-party hosting providers.

IV. CONCLUSION

For the foregoing reasons, the Court GRANTS Chegg's request for alternative service as to Defendant Swami and DENIES Chegg's request for alternative service as to John Does 1-3 without prejudice.

The Court also GRANTS Chegg's motion for a preliminary injunction and ORDERS the following:

1) Defendants, Defendants' representatives, and persons who are in active concert or participation with Defendants are temporarily restrained and enjoined from: from (1) accessing the Chegg website without authorization granted under the Chegg Policies, (2) downloading, scraping, using, or disseminating Chegg Content, (3) operating the Homeworkify website, and (4) using and infringing Chegg's trademark.

2) Defendants, Defendants' representatives, and persons who are in active concert or participation with Defendants are temporarily restrained and enjoined from: (1) using and infringing Chegg's trademarks, including specifically Chegg's registered trademark CHEGG and/or other trademarks, trade names, service marks, or Internet Domain addresses or names containing or infringing such trademarks, trade names, or service marks; (2) using in connection with Defendants' activities products or services any false or deceptive designation, representation, or description of Defendants or of Defendants' activities, whether by symbols, words, designs, or statements, which would damage or injure Chegg or give Defendants an unfair competitive advantage or result in deception of consumers; or (3) acting in any other manner which suggests in any way that Defendants' activities, products, or services come from or are somehow sponsored by or affiliated with Chegg, or passing off Defendants' activities, products, or services as Chegg's.

3) With respect to Homeworkify, the domain registries and registrars identified in Appendix A, see Dkt. 53-1, that are located in the United States, shall take the following actions:

a. Within five (5) business days of receipt of this Order, shall unlock and change the registrar of record for the Homeworkify and Redirect Site domains to Markmonitor. Markmonitor is directed to register the Homeworkify and Redirect Site domains in Chegg's name, for a total of 30 days. The purpose of this paragraph is to ensure that Chegg has control over the hosting and administration of the Homeworkify and Redirect Site domains in its registrar account at Markmonitor for a total of 30 days. Chegg shall provide to the domain registry or registrar of record any requested registrar information or account details necessary to effectuate the foregoing.

The WHOIS registrant, administrative, billing and technical contact and identifying information should be the following, or other information as may be specified by Chegg:

Domain Administrator Chegg, Inc.

3990 Freedom Circle Santa Clara, CA 95054

United States

Phone: (408) 855-5700

Email: domainrenewals@chegg.com

b. Prevent transfer, modification or deletion of the domain by Defendants and prevent transfer or control of the domain to the account of any party

other than Chegg; and

c. Take all steps required to propagate to the foregoing changes through the Domain Name System (“DNS”), including domain registrars.

4) With respect to Horneworkify, as to the domain registries identified in Appendix A that are located outside of the United States, the Court respectfully requests, but does not order, that they take the same or substantially similar actions. Defendants, their representatives, and persons who are in active concert or participation with them are ordered to consent to whatever actions are necessary for non-United States registries, registrants, and hosts to effectuate this request.

5) Chegg shall post bond in the amount of $15,000 to be paid into the Court registry.

IT IS SO ORDERED.