In re Okta, Inc. Securities Litigation

Background

Nebraska Investment Council brought this securities-fraud action for itself and a proposed class of purchasers of Okta, Inc. Class A common stock during the period from September 1, 2021, through September 1, 2022. The amended complaint asserted claims under Section 10(b) and Section 20(a) of the Securities Exchange Act of 1934 and Securities and Exchange Commission Rule 10b-5(b).

The allegations concerned two subjects: Okta’s May 2021 acquisition of Auth0, Inc. and the resulting sales-team integration problems, and a January 2022 incident involving a third-party support vendor that Okta disclosed publicly in March 2022. Plaintiff alleged that Okta and its Chief Executive Officer Todd McKinnon, Chief Financial Officer Brett Tighe, and Chief Operating Officer Frederic Kerrest made false or misleading statements and omitted material information.

Defendants moved to dismiss under Federal Rules of Civil Procedure 9(b) and 12(b)(6). Rule 12(b)(6) permits dismissal when a complaint does not adequately state a claim, while Rule 9(b) requires fraud allegations to be pleaded with particularity. The court also applied the heightened pleading requirements of the Private Securities Litigation Reform Act.

Auth0 Integration Allegations

The court dismissed allegations concerning statements made in September and early December 2021 about employee attrition and the Auth0 integration. The complaint did not provide sufficiently specific timing showing when employees left or when the alleged integration problems arose. The court therefore granted, without prejudice, the motion to dismiss those allegations.

The court reached a different conclusion about statements made during the March 2 and June 2, 2022 earnings calls. The complaint alleged with particularity that Okta abandoned its original integration plan around December 2021 and gave sales employees about two weeks’ notice that they would have to sell both companies’ products without the necessary knowledge or training. The court held that the individual defendants’ positive descriptions of the integration omitted material information and were more than general corporate optimism. It also held that the allegations adequately supported an inference that senior management knew, or was deliberately reckless in not knowing, about the condition of the newly integrated sales team.

The court therefore denied the motion to dismiss the Section 10(b) claims based on the alleged omissions during the March 2 and June 2 earnings calls. Because those allegations also supported a primary securities-law violation, the court held that the related Section 20(a) control-person claim was adequately stated. The court dismissed the remaining Section 20(a) allegations because no underlying Section 10(b) violation had been adequately pleaded for those claims.

Risk Disclosures About Employee Attrition

The court granted the motion to dismiss claims based on Okta’s March and June 2022 risk disclosures concerning possible loss of employees and integration problems. The complaint did not specify how many employees left, when they left, or what the individual defendants knew and when they knew it. The court concluded that the allegations did not adequately plead either that the risk disclosures were misleading when made or that the individual defendants acted with the required state of mind, known as scienter.

Data-Security Allegations

The court granted the motion to dismiss the claims based on statements about Okta’s commitment to data security, holding that those statements were vague corporate commitments or “puffery,” rather than concrete factual representations.

The court also dismissed claims based on a September 15, 2021 conference statement about “Zero Trust” security. The complaint did not provide sufficiently specific facts showing that the statement was false or misleading when made. The confidential-witness allegations did not establish that Okta failed to require its subcontractors to follow its security requirements, and the complaint did not allege that the January 2022 incident resulted from a compromised “SuperUser” account.

The court dismissed the claim based on Okta’s March 7, 2022 risk disclosure about possible security incidents because the complaint did not adequately allege that the individual defendants knew about the January incident by that date. The court did not need to resolve the parties’ dispute over whether the disclosure was false because it found the scienter allegations insufficient.

The court also dismissed claims based on McKinnon’s June 8, 2022 statements about customer trust and Okta’s business outlook. The complaint did not identify with sufficient detail how many sales were lost because of the security incident or when those losses occurred. The court found that the allegations from confidential witnesses did not adequately show that the statements were false or misleading when made.

Disposition

Judge Susan Illston granted in part and denied in part defendants’ motion to dismiss, with leave to amend. The court granted the motion except as to the alleged omissions by the individual defendants concerning the Auth0 integration during the March 2 and June 2, 2022 earnings calls. The court required a second amended complaint by April 28, 2023 and directed plaintiff to attach a chart identifying each challenged statement, its speaker, its date, and the facts alleged to make it false or misleading.

The court declined to rule on defendants’ request for judicial notice because it did not rely on the submitted documents in resolving the motion.