Reidinger v. Zendesk, Inc.

Background

A class of Zendesk stock purchasers, led by Local 353, I.B.E.W. Pension Fund, sued Zendesk and two Zendesk officers under Section 10(b) of the Securities Exchange Act of 1934, Securities and Exchange Commission Rule 10b-5, and Section 20(a). The fund alleged that Zendesk made misleading statements about its data-security program before the company disclosed a data breach that had begun in November 2016 and remained undetected for nearly three years.

The fund alleged that Zendesk had shared Amazon Web Services access keys with a third-party vendor, failed to use available logging features properly, and implemented multifactor authentication only after the breach. It challenged statements in Zendesk’s 2018 annual report and 2019 quarterly reports describing a comprehensive security program and warning that future breaches could occur and remain undetected.

The court had previously dismissed the fund’s first amended complaint under Federal Rule of Civil Procedure 12(b)(6), which permits dismissal for failure to state a legally sufficient claim, and allowed amendment. The fund’s second amended complaint focused on the data breach and did not renew allegations concerning Zendesk’s regional performance or claims against Senior Vice President of Worldwide Sales Norman Gennaro.

The Court’s Analysis

To state a claim under Section 10(b) and Rule 10b-5, the fund had to adequately plead, among other things, a material false statement or omission and scienter. Scienter means the intent to deceive, manipulate, or defraud; under the applicable pleading standard, the complaint had to allege particular facts creating a strong inference of that intent.

The court held that the fund had not identified a false statement. It reasoned that Zendesk’s 2019 statements addressed its recent and current security practices and did not claim that its security had always met the highest standards or that employees had always followed every best practice. The court also concluded that the statements did not misleadingly imply that Zendesk had never suffered an undetected breach. Zendesk had expressly warned that a breach might remain undetected for an extended period.

The court further held that the fund had not identified information Zendesk had a duty to disclose. The allegations indicated that Zendesk was unaware of the breach and the earlier sharing of access keys when it made the challenged statements. The court therefore concluded that the fund had not adequately pleaded a material misstatement or omission.

Independently, the court held that the fund had not pleaded a strong inference of scienter. The allegations supported the competing inference that Zendesk’s officers were unaware of the earlier security mistakes and did not consciously disregard a risk that their statements would mislead investors. The court also found that the complaint did not adequately allege corporate or collective scienter, a theory that can attribute the combined knowledge of corporate employees to the company if the allegations support a strong inference that officials knew the statements were false.

Because the fund had not stated an underlying Section 10(b) or Rule 10b-5 claim, the court held that its Section 20(a) control-person claims also failed.

Disposition

The court granted Zendesk’s motion to dismiss the Second Amended Complaint. It granted the Pension Fund leave to amend, allowing the fund 21 days from the order to file another amended complaint. The opinion does not state that the dismissal was with or without prejudice. The court also granted Zendesk’s request for judicial notice of documents incorporated into the complaint or otherwise appropriate for judicial notice, and vacated the previously scheduled oral argument.