ORDER
This multidistrict litigation case arises out of a security breach of Zappos.com’s customer data. Pending before the Court is a Motion to Dismiss, (ECF No. 217), filed by Amazon.com, Inc. doing business as Zappos.com (“Zappos”). Also pending is Zappos’s Motion to Strike Prayers for Punitive Damages and Restitution. (ECF No. 219). Zappos has also filed a Motion for Leave to File Excess Pages. (ECF No. 218). The Court has considered all of the briefing on the pending Motions. For the reasons contained herein, the Motion to Dismiss is GRANTED, and the Motion to Strike is DENIED as moot.
I. FACTS AND PROCEDURAL HISTORY
On January 15, 2012, Zappos’s servers located in Kentucky and Nevada were targeted by a hacker or group of hackers. The servers contained the personal identifying infоrmation of approximately 24 million Zappos’s customers. On January 16, 2012, Zappos sent an email to its customers notifying them that its servers had been breached and that data had been stolen, including customers’ names, account numbers, passwords, email addresses, billing and shipping addresses, phone numbers, and the last four digits of their credit cards used to make purchases. Shortly thereafter, a number of lawsuits were filed against Zappos seeking damages.
On June 14, 2012, the U.S. Judicial Panel on Multidistrict Litigation (“JPML”) granted Zappos’s motion to create the present case pursuant to 28 U.S.C. § 1407, transferring six extra-district actions to
Plaintiffs then amended their pleadings into two separate consolidated class action complaints, and Zappos filed a motion to dismiss the amended complaints for lack of standing and for failure to state a claim. (ECF No. 62). On September 9, 2013, the Court granted in part and denied in part Zappos’s motion. (ECF No. 114). Thereafter, Plaintiffs Preira, Ree, Simon, Hasner, Habashy, and Nobles (“the Preira Plaintiffs”) filed their Second Amended Consolidated Complaint (the “Preira SAC”). (ECF No. 118). And Plaintiffs Stevens, Penson, Elliot, Brown, Seal, Relethford, and Braxton (the “Stevens Plaintiffs”) filed their Second Amended Consolidated Class Action Complaint (the “Stevens SAC”). (ECF No. 119).
On November 4, 2013, Zappos moved for dismissal of the Preira SAC and the Stevens SAC. (ECF No. 122). Zappos also moved to strike Plaintiffs’ prayers for punitive damages and restitution. (ECF No. 124). While those motions were pending, the partiеs engaged in mediation in an attempt to reach a settlement. The parties stipulated to stay the proceedings various times, each time representing to the Court that settlement negotiations were progressing. (See ECF Nos. 192, 196, 201). After the third stipulation to stay, which was filed on September 17, 2014, and in reliance on the parties’ representation that a Settlement agreement was close, the Court entered an order denying Zappos’s still pending motion to dismiss and motion to strike without prejudice. (ECF No. 202).
Despite the progress made during mediation as to class-wide relief, a final agreement could not be reached between the parties due to a disagreement over attorneys’ fees. However, Plaintiffs filed a motion on December 4, 2014 to enforce a supposed settlement. (ECF No. 207), claiming that a cap on the fees class counsel would request was not material to the settlement. After responding to Plaintiffs’ arguments regarding whether an enforceable settlement had been reached, Zappos renewed its previous dismissal arguments by filing the instant Motions on January 30, 2015. (ECF Nos. 217, 219). Plaintiffs then requested an extension of time to oppose the Motions pending the Court’s determination of the motion to enforce. On March 27, 2015, the Court, finding that no final settlement had been reached, denied the motion to enforce and ordered Plaintiffs to respond to the instant Motions so that the case might proceed. Accordingly, the Court now considers the merits of Zappos’s Motion to Dismiss the Preira and Stevens SACs pursuant to Rule 12(b)(1) for lack of standing.
II. LEGAL STANDARD
“Lack of standing is a defect in subject-matter jurisdiction and may properly be challenged under Rule 12(b)(1).” Wright v. Incline Vill. Gen. Imp. Dist.,
III. DISCUSSION
Zappos contends that Plaintiffs lack standing in this case because they have not alleged any actual damages arising from the data breach. Plaintiffs contend that their injury stems from an increased risk that they will become victims of identity theft or other fraudulent activities because their personal information has been jeopardized. None of the Plaintiffs, however, allege that they have suffered such harm as of yet. Moreover, only three of the twelve named Plaintiffs have taken the additional step of purchasing credit monitoring services to protect against the allegedly increased threat of fraud. In addition to the increased threat of harm, Plaintiffs further argue that they have standing based on damage to the intrinsic value of their data.
The Court was presented with similar arguments when ruling on Zappos’s previous motion to dismiss. At that time, the Court determined that Plaintiffs’ allegations “that they have had to pay money to monitor their credit scores and secure their financial information due to the increased risk of criminal fraud” were sufficient to establish standing. (Sept. 9, 2013 Order 5). However, given developments in the caselaw dealing with standing of data-breach victims, and because Article III standing is an “indispensable part of a plaintiffs case” rather than a pleading requirement, the Court finds it appropriate to review its prior ruling. Lujan v. Defenders of Wildlife,
“Standing under Article III of the Constitution requires that an injury be concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” Monsanto Co. v. Geertson Seed Farms,
The party invoking federal jurisdiction has the burden of establishing actual or imminent injury. Defenders of Wildlife,
1. Decreased value in Plaintiffs’ personal information
The Court deals first with Plaintiffs’ last theory of standing. Plaintiffs attempt to establish standing by arguing that the data breach resulted in a devaluation of their personal information. Plaintiffs allege that a “robust market” exists for the sale and purchase of consumer data such as the personal information that was stolen during the breach, the value of this data apparently being appraised at between $30.49 and $44.62. (Stevens SAC ¶¶ 51-52). Plaintiffs claim that the Zappos security breach deprived them of the “substantial value” of their personal information, which they are entitled to recover. (Id. ¶ 54).
The Court does not buy this argument. Even assuming that Plaintiffs’ data has value on the black market, Plaintiffs do not allege any facts explaining how their personal information became less valuable as a result of the breach or that they attempted to sell their information and were rebuffed because of a lower price-point attributable to the security breach. See Galaria v. Nationwide Mut. Ins. Co.,
2. Increased threat of future harm
Plaintiffs’ purported standing rests largely on the theory that they suffer an increased threat of future identity theft and fraud as a result of Zappos’s security breach. Courts are divided on what constitutes sufficient injury-in-fact to establish standing in the context of a data security breach. The division arises, at least in part, from the Supreme Court’s recent holding in Clapper v. Amnesty International.
In Clapper, the plaintiffs, a group of lawyers, challenged the constitutionality of a section of the Foreign Intelligence Surveillance Act (“FISA”) that authorizes surveillance of individuals who are not United States persons and are believed to be located outside of the United States.
The Court held that the alleged harm was entirely speculative and did not support standing since the future injury was not “certainly impending.” Id. at 1148. The Court explained that the plaintiffs’ arguments “rest[ed] on their highly speculative fear” that (1) the Government would decide to target non-U.S. persons with whom they communicаte; (2) that in doing so, the Government would choose to invoke its authority under FISA rather than some other method of surveillance; (3) that the Article III judges who serve on the Foreign Intelligence Surveillance Court would conclude the surveillance comported with the Fourth Amendment; (4) that the Gov
This “highly attenuated chain of possibilities,” the Court concluded, did not satisfy “the requirement that injury must be certainly impending.” Id. The Court was also not willing “to abandon [its] usual reluctance to endorse standing theories that rest on speculation abоut the decisions of independent actors,” id. at 1150, and it rejected the Second Circuit’s reasoning that standing could be based on “an objectively reasonable likelihood” that the plaintiffs’ communications with their foreign contacts would be intercepted in the future, id. at 1147.
The majority of courts dealing with data-breach cases post-Clapper have held that absent allegations of actual identity theft or other fraud, the increased risk of such harm alone is insufficient to satisfy Article III standing. See, e.g., Green v. eBay Inc., No. CIV.A.14-1688,
Courts in the Ninth Cirсuit, however, have held the opposite.
In Krottner, employees of Starbucks sued the company when a laptop containing unencrypted names, addresses, and social security numbers of approximately 97,-000 employees was stolen.
While other courts have criticized this test for being too lax post-Clapper, see Peters,
In Sony, the court found that “although the Supreme Court’s word choice in Clapper differed from the Ninth Circuit’s word choice in Krottner, stating that the harm must be ‘certainly impending,’ rather than ‘real and immediate,’ the Supreme Court’s decision in Clapper did not set forth a new Article III framework, nor did the Supreme Court’s decision overrule previous precedent requiring that the harm be ‘real and immediate.’ ”
Likewise, the Adobe court reasoned that “Clapper did not change the law governing Article III standing.”
This Court agrees that Clapper does not necessarily overrule Krottner. The Krottner test is composed of two parts: (1) the plaintiff must face “a credible threat of harm,” and (2) “that harm [must be] ‘both real and immediate.’ ”
Furthermore, the Supreme Court explained post-Clapper that “[a]n аllegation of future injury may suffice if the threatened injury is ‘certainly impending’ or there is a ‘substantial risk’ that the harm will occur.” Driehaus,
However, just because Krottner is controlling does not consequently mean that its outcome dictates the Court’s conclusion as to standing here, due to the unique posture of this case. Immediacy is a common theme found in cases that discuss standing based on an alleged future harm. See Nelsen v. King Cnty.,
Similarly, a risk is surely not substantial unless the plaintiff can allege that the feared harm will likely be avoided only with judicial intervention. See Monsanto Co.,
Enter the facts of this case. Zappos’s servers were breached in January 2012. Plaintiffs allege that the personal information of 24 million Zappos’s customers was stolen. Of those 24 million customers, only twelve are before the Court seeking damages against Zappos. Of those twelve, only three determined that the increased threat of identity theft and fraud was sufficiently severe to purchase credit monitoring services. Of those three, not one alleges to have detected any irregularity whatsoever in regards to unauthorized purchases or other manifestations that their personal information has been misused. Yet Plaintiffs still claim that the threat they face is immediate, though there is no indication when or if that threat will materialize.
Given the stipulated stays and other delays in this case, the Court must decide whether the alleged threat of future harm is properly considered certainly impending three-and-a-half years after the breach occurred. Even if Plaintiffs’ risk of identity theft and fraud was substantial and immediate in 2012, the passage of time without a single report from Plaintiffs that they in fact suffered the harm they fear must mean something. Determining what the lapsed time means, however, requires the Court to engage in speculation — precisely what the Supreme Court has counseled against. Clapper,
If the Court assumes that the hacker or some other nefarious third-party remains in possession of Plaintiffs’ personal information, then the threat may as yet be credible. In fact, Plaintiffs claim that cy-bercriminals “often hold onto stolen personal and financial information for several years before using and/or selling the information to other identity thieves,” (Preira SAC ¶ 21; Stevens SAC ¶ 42), indicating that the alleged harm is not merely speculative despite the years that have passed without an occurrence of theft or fraud. But a harm that is “not merely speculative” does not constitute an injury-in-fact sufficient to confer standing. See Galaria,
Indeed, there must be a pоint at which a future threat can no longer be considered certainly impending or immediate, despite its' still being credible; otherwise, an “objectively reasonable likelihood” of harm would be enough to establish standing. See id. (citing Clapper,
The Court therefore finds that the increased threat of identity theft and fraud stemming from the Zappos’s security breach does not constitute an injury-in-fact
The degree of Plaintiffs’ speculation is heightened further by the fact that the future harm is based entirely on the decisions or capabilities of an independent, and unidentified, actor. Clapper,
The Court also notes the factual differences between the instant case and the Adobe and Sony cases. In Adobe, the plaintiffs alleged that the hackers had spent several weeks targeting Adobe’s systems and that the hackers used Adobe’s own system to decrypt customer credit cards.
Unlike the plaintiffs in Adobe whose entire credit card numbers were stolen as a result of the security breach, Plaintiffs here allege that only their credit card “tails,” the last four digits of a credit card, were accessed during Zappos’s breach. Also unlike the plaintiffs in Adobe whose information began to surface on the Internet shortly after the breach, Plaintiffs here mаke no allegations that their data has appeared in any place where others might obtain and misuse it. Unlike the plaintiffs in Sony who experienced an actual loss, albeit temporarily, of the services for which they had paid Sony to provide, the usefulness of the goods Plaintiffs purchased from Zappos was in no way impacted by the security breach in this case. And unlike some of the plaintiffs in Sony who dealt with actual unauthorized charges on credit cards, Plaintiffs here do not allege one instance of financial fraud.
But perhaps the most distinguishing element between this case and Adobe and Sony is the amount of time from when the breach occurred to when the respective
Finally, even if Plaintiffs suffer identity theft or fraud at some point in the future, there may be a genuine issue regarding whether the Zappos’s security breach is the reason for the damages then incurred. Peters,
3. Costs to mitigate
Plaintiffs Hasner, Preira, and Habashy next argue that even if the increased threat of future harm does not constitute an injury-in-fact, their purchasing of credit monitoring services does. However, in Clapper the Supreme Court rejected a similar argument raised by the plaintiffs there that they had standing because of expenditures made to protect the confidentiality of their communications.
Courts have generally interpreted this holding to mean that “in order for costs incurred in an effort to mitigate the risk of future harm to constitute injury-in-fact, the future harm being mitigated must itself be imminent.” In re Adobe,
The Court realizes that this is a frustrating result where Plaintiffs’ fears of identity theft and fraud are rational, and it recognizes that purchasing monitoring services is a responsible response to a data breach. Nevertheless, costs incurred to prevent future harm is not enough to confer standing, Clapper,
As one court reasoned:
Hackers are constantly seeking to gain access to the data banks of companies around the world. Sometimes, they are successful. Other times not. Despite many companies’ best efforts and tremendous expense to secure and protect their data systems, an industrious hacker every so often may find a way to access their data. Millions of people, out of reasonable fear and prudence, may decide to incur credit monitoring costs and take other preventative steps, which the hacked companies often freely provide. However, for a court to require companies to pay damages to thousands [and in this case millions] of customers, when there is yet to bе a single case of identity theft proven, strikes us as overzealous and unduly burdensome to business. There is simply no compensable injury yet, and courts cannot be in the business of prognosticating whether a particular hacker was sophisticated or malicious enough to both be able to successfully read and manipulate the data and engage in identity theft.
Storm,
To the extent that Plaintiffs allege that there are potential class members who have suffered identity theft or other fraud as a result of the Zappos’s security breach, (see Preira SAC ¶¶ 5, 35), the Court agrees that those individuals would have standing. Yet Plaintiffs would not be the proper representatives of such a class, as they do not allege that they have suffered these same damages. Gen. Tel. Co. of Sw. v. Falcon,
Therefоre, based on the forgoing reasons, the Court is granting Zappos’s Motion to Dismiss.
CONCLUSION
IT IS HEREBY ORDERED that Defendant’s Motion to Dismiss (ECF No. 217) is GRANTED without prejudice. Plaintiffs are granted leave to amend their Complaints to allege instances of actual identity theft or fraud.
IT IS FURTHER ORDERED that Defendant’s Motion to Strike (ECF No. 219) is DENIED as moot.
IT IS FURTHER ORDERED that Defendant’s Motion for Leave (ECF No. 218) is GRANTED.
IT IS SO ORDERED.
Notes
. Some courts outside the Ninth Circuit have also fоund standing in data breach cases
. Clapper recognized that future harm could create standing if the harm posed a “substantial risk.”
. Plaintiffs Hasner and Noble do allege that after the breach, their AOL email accounts were accessed by a third party who sent unauthorized advertisements to others from the accounts. (Preira SAC ¶¶ 11, 16). The AOL accounts used the same passwords as Has-ner’s and Noble’s Zappos accounts. Besides the advertisements, however, no additional misuse of the accounts or actual damages is alleged. Moreover, Hasner and Noble also took quick remedial measures by changing the passwords on their AOL accounts. (Id.).
. The Court finds this to be true notwithstanding Zappos’s questionable customer service in response to the data breach. Plaintiffs allege that once Zappos notified customers of the breach it “shut down its customer service phone lines for a week." (Preira SAC ¶ 4). Also perplexing, and undoubtedly offensive to its customers, is Zappos's apparent decision to not offer free credit monitoring services to its customers, which is a common gesture in these types of cases. Nevertheless, these deficiencies in Zappos’s customer care do not establish standing where Plaintiffs fail to allege actual damages or an immediate threat of future harm.
. Plaintiffs claim they have standing on the alternative theories that the breach caused them a loss of privacy and that it resulted in a diminished value of the services provided by Zappos. (Resp. 5, ECF No. 231). Neither of these arguments is persuasive. Even if Plaintiffs adequately allege a loss of privacy, they have failed to show how that loss amounts to a concrete and particularized injury. See O’Shea v. Littleton,