WalkMe Ltd., an Israeli company v. Whatfix, Inc., a Delaware corporation

Background

WalkMe Ltd. and WalkMe Inc. sued Whatfix, Inc. and Whatfix PL. WalkMe alleged violations of the federal Defend Trade Secrets Act, California’s Uniform Trade Secrets Act, the federal Computer Fraud and Abuse Act, and California’s Data Access and Fraud Act. The trade-secret claims concerned alleged “technical trade secrets” and “business trade secrets.” Whatfix moved to dismiss under Federal Rule of Civil Procedure 12(b)(6), which tests whether a complaint alleges enough facts to state a legally plausible claim.

Claims Against Whatfix, Inc.

The court held that WalkMe sufficiently stated claims against Whatfix, Inc. based on conduct attributed to its employee Paula Prigge. WalkMe clarified that it was not relying on a theory that Whatfix, Inc. was automatically responsible for acts by Whatfix PL. Instead, it alleged that Ms. Prigge accessed WalkMe’s system without authorization and learned confidential information about WalkMe’s product and processes.

Technical Trade Secrets

For claims under the federal and California trade-secret statutes, WalkMe had to allege that it possessed trade secrets, that Whatfix misappropriated them, and that Whatfix caused or threatened damage. The court found that WalkMe described the technical trade secrets with enough detail, including through exhibits describing alleged intrusions into WalkMe’s system and videos allegedly showing Whatfix employees interacting with the information.

The court also found sufficient allegations that WalkMe took reasonable steps to keep the information secret, including legal restrictions, password and identity controls, monitoring, recorded platform use, and limits on access to certain information. The court concluded that disputes over whether WalkMe’s customer agreements or website disclosures affected secrecy could not be resolved on a motion to dismiss.

The court further found that WalkMe plausibly alleged misappropriation of the technical trade secrets. WalkMe alleged that Whatfix used customer credentials to access areas of WalkMe’s platform that contained no customer information and to copy aspects of WalkMe’s product. The court therefore denied the motion to dismiss the claims based on misappropriation of the technical trade secrets.

Business Trade Secrets

The business-trade-secret theory involved former WalkMe employees and a former customer who allegedly downloaded or emailed files before joining Whatfix. The court assumed, for purposes of its analysis, that WalkMe sufficiently alleged that Whatfix acquired the business trade secrets. However, it found insufficient allegations that Whatfix acquired them through “improper means,” such as knowing about or encouraging a confidentiality breach.

The court also found insufficient allegations that Whatfix used the business trade secrets. It therefore granted the motion to dismiss the claims based on misappropriation of the business trade secrets.

Computer Fraud and Abuse Act Claim

The court partly granted and partly denied the motion concerning WalkMe’s claim under the Computer Fraud and Abuse Act. The court explained that the statute addresses computer intrusion, not merely misuse of information or violation of website terms. Allegations that Whatfix employees obtained credentials in violation of customer contracts were insufficient. The court also found that alleging access for an improper purpose was not enough when authorized users could access the areas involved.

The court treated alleged conduct by Dipit Sharma after Whatfix’s work with a customer ended as an exception to that analysis. It also considered WalkMe’s allegations that employees spent more than $5,000 investigating and documenting intrusions, suspended a false account, and sent Whatfix a cease-and-desist letter. The court concluded that these allegations were sufficient at the pleading stage to allege the required computer-related loss, while granting in part and denying in part Whatfix’s motion concerning this claim.

California Data-Access Claim

The court denied Whatfix’s motion to dismiss WalkMe’s claim under California Civil Code section 502. WalkMe alleged that Whatfix employees knowingly accessed WalkMe information and improperly used it to improve Whatfix’s competing products and customer-facing strategies. The court found those allegations sufficient to state a claim.

Disposition

Judge Jeffrey White granted in part and denied in part Whatfix’s motion to dismiss the Second Amended Complaint. The order states that Whatfix must file an answer by July 30, 2024, and lifts the stay on discovery.