Summary
dismissing plaintiff's negligence claim against defendant Yahoo! Inc. where the plaintiff, who was not a registered Yahoo! user and received an email from an unidentified hacker with an email address similar to plaintiff's counsel requesting $281,500 pursuant to a settlement agreement, proposed he was “part of a class of plaintiffs made up of ‘those who deal with' financial professionals whose Yahoo! accounts have been hacked.” The court concluded this class “comprised a multiplicity of types of individuals and business entities,” was boundless, and that the harm caused was “more fortuitous than predictable.”
Summary of this case from Home City Inc. v. Bashian Bros.Opinion
Civ. No. 20-2842
10-02-2020
DR. GABRIEL JASPER, Plaintiff, v. BANK OF AMERICA CORPORATION, a foreign corporation, and YAHOO! INC., a foreign corporation, Defendants.
NOT FOR PUBLICATION
OPINION
THOMPSON, U.S.D.J.
INTRODUCTION
This matter comes before the Court upon the Motion to Dismiss filed by Defendant Oath Holdings Inc. f/k/a Yahoo! Inc. ("Oath Holdings"). (ECF No. 10.) Plaintiff Gabriel Jasper ("Plaintiff") opposes. (ECF No. 12.) The Court has decided the Motion based on the written submissions of the parties and without oral argument, pursuant to Local Civil Rule 78.1(b). For the reasons stated herein, Defendant Oath Holdings' Motion to Dismiss (ECF No. 10) is granted.
BACKGROUND
I. Factual Background
This case arises out of alleged hacking of a Yahoo! e-mail account. In a previous case, Santander Bank, N.A. ("Santander") sued Plaintiff and several companies he controls. (Compl. ¶ 4, Ex. A, ECF No. 1-1.) That case was settled in May 2019. (Id. ¶ 5.) As part of the settlement, Plaintiff and his companies were required to pay Santander an initial installment of $281,500. (Id. ¶ 6.)
In May 2019, Plaintiff's accountant and Chief Financial Officer ("CFO") received an e-mail, purporting to be sent by Plaintiff's counsel, instructing the CFO to deposit the $281,500 owed to Santander into William Hoeflinger's account at Bank of America. (Id. ¶ 7.) Plaintiff now claims that an unidentified hacker sent this e-mail using an e-mail address similar to Plaintiff's counsel's e-mail address. (Id. ¶ 13.) After depositing the funds, the CFO informed Plaintiff's counsel that the funds had been deposited into Hoeflinger's account. (Id. ¶ 9.)
Plaintiff's counsel responded, questioning why the CFO deposited the $281,500. (Id.) The CFO ostensibly never read this response. (Id. ¶ 13.) Upon receipt of Plaintiff's counsel's e-mail, the hacker allegedly responded from the CFO's actual e-mail address, notifying Plaintiff's counsel that there had been a "mix-up" at the bank, the situation was being resolved, and Plaintiff's counsel should ignore the e-mail regarding the deposit. (Id. ¶ 9.)
Nearly two weeks later, Plaintiff's counsel e-mailed the CFO to inform him that the $281,500 should be sent to a different party. (Id. ¶ 10.) The CFO responded that the money had been deposited into Hoeflinger's account, as Plaintiff's counsel had instructed. (Id.) Plaintiff's counsel immediately responded that he had not instructed the CFO to deposit the funds into Hoeflinger's account. (Id. ¶ 11.)
The CFO then informed Defendant Bank of America, N.A. ("BofA") of the alleged hacking. (Id. ¶ 14.) Defendant BofA apparently responded that it refused to act unless Plaintiff agreed to execute an indemnity agreement, but Plaintiff refused to do so. (Id. ¶¶ 14-15.)
Defendant BofA's Answer states that the Complaint improperly names Defendant Bank of America, N.A. as "Bank of America Corporation." (Answer at 1, ECF No. 5.)
II. Procedural History
Plaintiff filed the Complaint in the Superior Court of New Jersey in Ocean County in December 2019. (ECF No. 1-1.) The Complaint alleges seven counts: (1) negligence against Defendant BofA (id. ¶¶ 16-25); (2) breach of the implied covenant of good faith and fair dealing against Defendant BofA (id. ¶¶ 26-30); (3) negligence against Defendant Oath Holdings (id. ¶¶ 31-36); (4) violation of the New Jersey Consumer Fraud Act against Defendant BofA (id. ¶¶ 37-42); (5) breach of fiduciary duty against Defendant BofA (id. ¶¶ 43-48); (6) aiding and abetting fraud against Defendant BofA (id. ¶¶ 49-52); and (7) fraudulent transfer against Defendant BofA (id. ¶¶ 53-57).
Plaintiff's claims are against Yahoo! Inc., but Yahoo! Inc.'s corporate name is now Oath Holdings Inc. (See Mot. at 1, ECF No. 10.)
On March 16, 2020, Defendant Oath Holdings removed this case to federal court. (ECF No. 1.) On March 25, 2020, Defendant BofA filed a Crossclaim against Defendant Oath Holdings. (See Crossclaim at 12, ECF No. 5.) Defendant BofA's Crossclaim includes claims for contribution and indemnification. (Id.) On May 21, 2020, Defendant Oath Holdings filed a Motion to Dismiss. (ECF No. 10.) The Motion seeks to dismiss Count 3 of the Complaint and Defendant BofA's Crossclaim. (Mot. at 1, ECF No. 10.) Plaintiff filed an Opposition (ECF No. 12), and Defendant Oath Holdings filed a Reply (ECF No. 14). The Motion to Dismiss is presently before the Court.
LEGAL STANDARD
To survive dismissal under Rule 12(b)(6) of the Federal Rules of Civil Procedure, "a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face." Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotations omitted). "The defendant bears the burden of showing that no claim has been presented." Hedges v. United States, 404 F.3d 744, 750 (3d Cir. 2005). When considering a Rule 12(b)(6) motion, a district court conducts a three-part analysis. Malleus v. George, 641 F.3d 560, 563 (3d Cir. 2011). "First, the court must 'tak[e] note of the elements a plaintiff must plead to state a claim.'" Id. (quoting Iqbal, 556 U.S. at 675). "Second, the court should identify allegations that, 'because they are no more than conclusions, are not entitled to the assumption of truth.'" Id. (quoting Iqbal, 556 U.S. at 679). The court must accept as true all well-pleaded factual allegations and construe the complaint in the light most favorable to the plaintiff. Fowler v. UPMC Shadyside, 578 F.3d 203, 210 (3d Cir. 2009) (citation omitted). Third, the court must determine whether the facts "plausibly give rise to an entitlement for relief." Malleus, 641 F.3d at 563 (quoting Iqbal, 556 U.S. at 679); see also Fowler, 578 F.3d at 211. A complaint that does not demonstrate more than a "mere possibility of misconduct" must be dismissed. Gelman v. State Farm Mut. Auto. Ins. Co., 583 F.3d 187, 190 (3d Cir. 2009) (quoting Iqbal, 556 U.S. at 679).
DISCUSSION
I. Negligence Claim Against Defendant Oath Holdings
The elements of negligence are (1) duty of care, (2) breach of the duty of care, (3) causation, and (4) damages. Jersey Cent. Power & Light Co. v. Melcar Util. Co., 59 A.3d 561, 571 (N.J. 2013). Plaintiff's negligence claim against Defendant Oath Holdings appears to be two-fold. First, Plaintiff argues that Defendant Oath Holdings had insufficient security systems in place to detect hacking and protect personal identification information. (See Compl. ¶ 34.) Second, Plaintiff argues that Defendant Oath Holdings failed to alert the CFO when his e-mail account was hacked. (Id. ¶ 35.) Defendant Oath Holdings' brief focuses on the elements of duty and breach of duty. (See Oath Holdings' Br. at 8-17, ECF No. 10-1.)
A. Duty of Care Standard
"Whether a duty of care exists is a question of law that must be decided by the court." Jerkins ex rel. Jerkins v. Anderson, 922 A.2d 1279, 1284 (N.J. 2007) (citation omitted). "In making that determination, the court must first consider the foreseeability of harm to a potential plaintiff . . . and then analyze whether accepted fairness and policy considerations support the imposition of a duty . . . ." Id. (citations omitted).
"Foreseeability as it impacts duty determinations refers to 'the knowledge of risk to be apprehended.'" Clohesy v. Food Circus Supermarkets, Inc., 694 A.2d 1017, 1021 (N.J. 1997). Although foreseeability of harm is a "crucial element in determining whether imposition of a duty . . . is appropriate," Carter Lincoln-Mercury, Inc., Leasing Div. v. EMAR Grp., Inc., 638 A.2d 1288, 1294 (N.J. 1994), foreseeability is not dispositive as to whether a duty exists, Clohesy, 694 A.2d at 1020. "Subsumed in the concept of foreseeability are many of the concerns we acknowledge as relevant to the imposition of a duty: the relationship between the plaintiff and the tortfeasor, the nature of the risk, and the ability and opportunity to exercise care." Carter Lincoln-Mercury, 638 A.2d at 1294.
Under New Jersey's economic loss doctrine, in negligence cases alleging economic damages aside from physical injury, a defendant owes a duty of care to plaintiffs "comprising an identifiable class with respect to whom defendant knows or has reason to know are likely to suffer such damages from its conduct." People Express Airlines, Inc. v. Consol. Rail Corp., 495 A.2d 107, 116 (N.J. 1985). "[A]n identifiable class of plaintiffs is not simply a foreseeable class of plaintiffs." Id. An identifiable class does not include plaintiffs whose "presence within an area would be fortuitous" and whose economic injury would be "hopelessly unpredictable and not realistically foreseeable." Id. Rather, the class of plaintiffs must be "particularly foreseeable in terms of the type of persons or entities comprising the class, the certainty or predictability of their presence, the approximate numbers of those in the class, as well as the type of economic expectations disrupted." Id.
In People Express, the New Jersey Supreme Court provided specific examples of such plaintiffs, including "members of the general public, or invitees such as sales and service persons at a particular plaintiff's business premises, or persons travelling on a highway near the scene of a negligently-caused accident . . . who are delayed in the conduct of their affairs and suffer varied economic losses." 495 A.2d at 116.
B. Duty of Care Analysis
Defendant Oath Holdings contends that Plaintiff was "not a [f]oreseeable [c]laimant." (Oath Holdings' Br. at 9.) Defendant Oath Holdings reasons that Plaintiff is merely a "member of the public," not a registered Yahoo! user; Plaintiff has not suggested that Defendant Oath Holdings was aware of Plaintiff's relationship with the CFO; adopting Plaintiff's proposed duty would "impose boundless liability on e-mail service providers"; and the CFO and Defendant BofA were in better positions than Defendant Oath Holdings to verify whether the hacker's request was legitimate. (See id. at 9-11.)
By contrast, Plaintiff asserts that Defendant Oath Holdings "knew that its e-mail accounts were subject to being hacked," "knew that fraudsters especially engaged in the hacking of accountants and chief financial officers," and "had actual knowledge of accounts being hacked in the past." (Id. ¶ 33.) Plaintiff appears to deduce from these assertions that he is part of a class of plaintiffs made up of "those who deal with" financial professionals whose Yahoo! accounts have been hacked. (See Opp'n at 6, ECF No. 12.)
The Court concludes that Plaintiff's proposed class is not "particularly foreseeable" under People Express's multi-factor inquiry. First, the category of potential plaintiffs who "deal with" financial professionals over e-mail is comprised of a multiplicity of types of individuals and business entities. Second, any economic harm caused to others in Plaintiff's position is likely to be more fortuitous than predictable. Third, Plaintiff's proposed class appears to be boundless. Under Plaintiff's theory, Defendant Oath Holdings could be liable to anyone who "deals with" an accountant or financial professional when that accountant or financial professional's Yahoo! e-mail account is hacked. Fourth, the varieties of potential disrupted economic expectations are as numerous as the varieties of business transactions arranged over e-mail. Therefore, Plaintiff's proposed class is not "particularly foreseeable." See Paramount Aviation Corp. v. Agusta, 124 F. App'x 85, 88-90 (3d Cir. 2005) (concluding after a helicopter crash that a helicopter manufacturer did not owe a duty to a helicopter management services company in part because the parties did not have a relationship prior to the accident); cf. People Express, 495 A.2d at 118 (concluding after a tank car accident, which released ethylene oxide and caused a fire requiring evacuation of a one-mile radius surrounding the accident, that it was particularly foreseeable that business operations of an airline operating within the one-mile radius would be interrupted).
Persuasive precedent supports this result. In a 2015 case before a court in this District, secondary purchasers of mortgage-backed securities brought negligent misrepresentation claims against financial institutions. See Prudential Ins. Co. of Am. v. Bank of Am., Nat'l Ass'n, 2015 WL 502039, at *4 (D.N.J. Feb. 5, 2015). At the motion-to-dismiss stage, the court concluded that the secondary purchasers failed to state a negligence claim because "the unlimited class of all potential securities buyers is not particularly foreseeable, within the meaning of People Express." Id. at *6 (characterizing the class as "literally limitless"); see also Eaton v. Tosti, 2010 WL 2483318, at *9 (D.N.J. June 4, 2010) (concluding in a negligence case brought by an antiques dealer against relatives of the individual who sold stolen items to the dealer that "one or more third parties" who could have purchased stolen items did not constitute a "sufficiently ascertainable group of plaintiffs from which to find an 'identifiable class'"). Like the boundaries of the classes in Prudential and Eaton, the boundaries of Plaintiff's proposed class are not clearly delineated or meaningfully limited. Moreover, as in Prudential, Plaintiff's theory of negligence against Defendant Oath Holdings is incongruous with the policy goals of New Jersey's economic loss doctrine: "to circumscribe a defendant's orbit of duty, limit otherwise boundless liability and define an identifiable class of plaintiffs that may recover." See People Express, 495 A.2d at 116. Therefore, the Court dismisses Plaintiff's negligence claim against Defendant Oath Holdings.
Defendant Oath Holdings argues that Plaintiff has not pleaded facts plausibly establishing that it breached any duty of care. (Oath Holdings' Br. at 15-17.) Because the Court has already concluded that Plaintiff has not pleaded facts plausibly establishing the duty-of-care element, the Court will not address Defendant Oath Holdings' arguments regarding the breach element.
II. Defendant Bank of America's Crossclaim
Defendant Oath Holdings argues that Defendant BofA's Crossclaim should be dismissed because, among other things, it fails to satisfy the minimum pleading requirements of Rule 8(a) of the Federal Rules of Civil Procedure. (See Oath Holdings' Br. at 17-18.) The Court agrees.
"Although cross-claims for indemnity and contribution do not need to contain detailed factual allegations, they must allege sufficient facts to raise a plaintiff's right to relief above the speculative level." Davidson v. Cornerstone Bank, 2011 WL 677321, at *5 (D.N.J. Feb. 16, 2011) (citations and internal quotations omitted). "Indemnification and contribution claims must contain allegations averring how or why the defendants were negligent and partially liable." Id. "A mere 'formulaic recitation of the elements' is insufficient." Id. (dismissing a crossclaim because, among other things, it contained conclusory allegations instead of detailing how or why the defendants were jointly liable or identifying any theory of indemnification or contribution).
Defendant BofA's Crossclaim does not satisfy these minimum pleading requirements. Defendant BofA's contribution and indemnification claims each consist of one sentence. Defendant BofA's contribution claim reads, "[Defendant BofA] demands judgment against co-defendant [Defendant Oath Holdings] under the provisions of New Jersey Comparative Negligence Law, N.J.S.A. 2A:15-5.1 et seq." (Crossclaim at 12.) Defendant BofA's indemnification claim states,
While denying liability to Plaintiff, [Defendant BofA] asserts that it is entitled to be indemnified on the ground that the negligence of [Defendant BofA], while denied, would be secondary, passive, technical, vicarious or imputed, and that the negligence of [Defendant Oath Holdings] was primary, active, and direct and, therefore, [Defendant Oath Holdings] should defend, indemnify, and save harmless [Defendant BofA] based on common law, statutory law and contract law.(Id.) Without facts supporting Defendant BofA's contribution and indemnification claims, Defendant BofA's Crossclaim is merely conclusory. A party's "obligation to provide the 'grounds' of his 'entitle[ment] to relief' requires more than labels and conclusions." Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (alterations in original). Therefore, Defendant BofA's Crossclaim is dismissed.
CONCLUSION
For the foregoing reasons, Defendant Oath Holdings' Motion to Dismiss (ECF No. 10) is granted. An appropriate Order will follow. Date: October 2, 2020
/s/ Anne E . Thompson
ANNE E. THOMPSON, U.S.D.J.