Toretto v. Mediant Communications, Inc.

Background

Phillip Toretto and Daniel C. King filed the case as a proposed class action against Mediant Communications, Inc. The plaintiffs’ claims arose from an April 2019 data breach in which hackers accessed Mediant’s business email accounts and stole personal information belonging to thousands of shareholders. The information allegedly included names, addresses, email addresses, phone numbers, Social Security numbers, tax identification numbers, account numbers, and other information.

The plaintiffs alleged that their information was compromised and that they spent time monitoring their financial and credit accounts to reduce the risk of harm. Mediant notified affected investors and stated that it had taken steps to strengthen its security systems.

Motion and jurisdictional standard

Mediant moved to dismiss under Federal Rule of Civil Procedure 12(b)(2), which allows dismissal when the court lacks personal jurisdiction over the defendant, and Rule 12(b)(6), which concerns whether a complaint adequately states a claim. The parties conducted discovery concerning jurisdiction before the court decided the motion.

The court focused on personal jurisdiction. Because Mediant was headquartered in New York and incorporated in Delaware, the issue was whether California had specific personal jurisdiction over it. Specific personal jurisdiction allows a court to hear claims connected to a defendant’s contacts with the forum state—in this case, California.

Under the Ninth Circuit’s three-part test, the plaintiffs had to show that Mediant purposefully conducted activities in California, that their claims arose from or related to those activities, and that exercising jurisdiction would be reasonable.

Court’s analysis

The court concluded that the plaintiffs had not shown purposeful availment, meaning that Mediant had affirmatively created a meaningful connection with California or deliberately taken advantage of doing business there. The plaintiffs were not Mediant’s clients, and there was no contract between the plaintiffs and Mediant. Mediant contracted with fund managers and performed proxy-agent services for public companies and mutual funds, often through an intermediary.

The record did not show that Mediant negotiated contracts in California, directly solicited business there, or agreed that California law would govern its contracts. Mediant stated that it did not conduct business operations, lobbying, marketing, or advertising in California, and the court found that this evidence was not rebutted. The court also found no evidence that Mediant knew where shareholders lived before beginning its proxy work or that it specifically targeted California residents.

The plaintiffs pointed to seven California-headquartered companies whose shareholder information was exposed and at least 21,703 affected individuals residing in California. The court found those facts insufficient. Approximately 10% of the affected shareholders were in California, while California represented approximately 12% of the United States population. The court also reasoned that foreseeability of harm in California, without additional conduct directed toward California, does not establish personal jurisdiction.

The court separately held that the plaintiffs had not shown that their claims arose from Mediant’s California-related activities. Even without contracts with California businesses, California residents could have been affected because they might own stock in companies or funds that hired Mediant through managers outside California. The court noted that Toretto alleged Mediant received his information from Blackstone Real Estate Income Trust, which appeared to be headquartered in New York, while King alleged that Mediant received his information from the Ivy Natural Resources Fund, associated with a Missouri company.

The court also considered, for completeness, whether Mediant had purposefully directed its conduct toward California. Applying the effects test for that theory of jurisdiction, the court found no evidence that Mediant expressly aimed an intentional act at California. It stated that untargeted negligence was not enough to establish purposeful direction.

Disposition

The court granted Mediant’s motion to dismiss and dismissed the plaintiffs’ complaint in its entirety for lack of personal jurisdiction. Because the dismissal rested on personal jurisdiction, the court did not reach Mediant’s other challenges to the plaintiffs’ allegations. The order disposed of Docket No. 24.