Fraser v. Mint Mobile, LLC

Background

Daniel Fraser alleged that Mint Mobile, LLC experienced a large data breach between June 8 and June 10, 2021. He alleged that criminals used information exposed in the breach on June 11, 2021, to take over his phone through a SIM port and then hack his cryptocurrency account at a non-party exchange. He alleged that the criminals stole cryptocurrency worth $466,000.

An earlier order granted Mint’s motion to dismiss several, but not all, claims. Fraser sought permission under Federal Rule of Civil Procedure 15 to file a first amended complaint addressing the dismissed Computer Fraud and Abuse Act claim, claims under California Business and Professions Code section 17200, and his request for punitive damages. The court considered bad faith, delay, prejudice, futility, and repeated failure to correct deficiencies. It found no indication of bad faith, undue delay, prejudice, or repeated failure to cure, so it focused on whether the proposed amendments would be futile.

Computer Fraud and Abuse Act claim

The court denied leave to amend Fraser’s Computer Fraud and Abuse Act claim. A civil claim under that statute requires the plaintiff to allege that he suffered damage or loss because of the defendant’s violation. The court explained that the statute’s definitions of “damage” and “loss” focus on technological harms to computer systems or data, such as corrupted files.

Fraser’s proposed amendment alleged fees for hiring a cryptographic expert to trace movements of his stolen assets. The court found that these expenses were incurred to assess his damages, not to repair or assess technological harm to the breached computer system. Because the proposed amendment did not allege a loss recognized by the statute, the court did not reach Fraser’s proposed changes to his aiding-and-abetting theory. The court denied leave to amend this claim and dismissed the claim with prejudice.

Punitive damages

The court denied leave to amend Fraser’s allegations supporting punitive damages under Counts VII, VIII, and IX. It found that the amended allegations made no meaningful change to the original negligence claims, which an earlier order had described as conclusory and lacking factual support. The court also found inadequate Fraser’s allegations that he expected discovery to reveal documents showing Mint intentionally bypassed security and privacy measures. The court characterized those allegations as anticipatory and insufficient to state a claim for punitive damages.

California Business and Professions Code section 17200 claims

The court denied leave to amend Fraser’s claims under section 17200, which addresses unlawful, unfair, or fraudulent business practices. The court found the proposed amendments futile for two reasons. First, Fraser still alleged only that he lost cryptocurrency; he did not allege that Mint acquired it. The court therefore rejected his attempt to seek restitution for that loss, whether described as restitution or injunctive relief.

Second, the court found that Fraser did not request a specific injunction directed at a particular Mint practice. Instead, he sought a general order requiring cessation of Mint’s practices. The court concluded that this did not adequately identify the relief sought or put Mint on notice of the requested injunction. It did not decide whether the requested injunction would qualify as public or private injunctive relief.

Disposition

The court denied Fraser’s motion for leave to file a first amended complaint. It dismissed the Computer Fraud and Abuse Act claim with prejudice and denied leave to amend the punitive-damages and section 17200 allegations. The conclusion states that Fraser’s claims for declaratory judgment, violation of the Federal Communications Act, negligence, and breach of contract remained. The hearing was vacated, and the motion was decided on the written submissions.