Riordan v. Western Digital Corporation

Background

Kevin Riordan, Ashley Laurent, Jeremy Bobo, and Nagui Sorial brought a proposed class action against Western Digital Corporation. They alleged that security flaws in Western Digital’s My Book Live and My Book Live Duo data-storage devices allowed unauthorized persons to access and delete data beginning June 23, 2021. The plaintiffs alleged that hackers performed factory resets, wiping stored personal and business data, and that Western Digital’s offered recovery service would be largely ineffective.

The Second Amended Complaint asserted four claims: violation of the California Song-Beverly Consumer Warranty Act, negligence/failure to warn, violation of California’s Unfair Competition Law, and unjust enrichment. The plaintiffs also requested injunctive relief, including an order requiring Western Digital to implement or maintain security measures for the web portal.

Court’s analysis

The court addressed the requests for injunctive relief under Federal Rule of Civil Procedure 12(b)(1), which allows dismissal for lack of subject-matter jurisdiction. The court had previously found that the plaintiffs lacked standing—a personal stake required to invoke federal jurisdiction—to seek an injunction because their allegations about future misuse of their data were speculative. The Second Amended Complaint added no more concrete allegations, and the plaintiffs agreed that the remaining injunctive-relief requests could be removed. The court therefore granted the motion to dismiss those requests for lack of subject-matter jurisdiction, without leave to amend.

The court addressed the Song-Beverly Act, UCL, and unjust-enrichment claims under Rule 12(b)(6), which allows dismissal for failure to state a legally sufficient claim. For the Song-Beverly claim, the court held that California’s implied warranty lasts no more than one year after delivery and rejected the plaintiffs’ argument that Western Digital’s ongoing maintenance of the web portal continuously extended the warranty period. Because the complaint did not allege when any plaintiff purchased a device, it did not establish that the alleged breach occurred during the warranty period or within the applicable four-year limitations period. The court found the claim both time-barred and insufficiently pleaded.

For the UCL claim, the court held that a plaintiff seeking equitable relief must first show that there is no adequate remedy at law, meaning that money damages would not be sufficient. The plaintiffs acknowledged that they sought damages for the same conduct and identified injunctive relief as the remedy unavailable at law. Because they lacked standing to seek that injunction, the court found that they had not adequately alleged the required lack of an adequate legal remedy. The court dismissed the unjust-enrichment claim for the same reason, applying the same pleading requirement to that equitable claim.

Disposition

The court GRANTED Western Digital’s motion to dismiss. The plaintiffs’ Song-Beverly Act, UCL, and unjust-enrichment claims were DISMISSED WITHOUT LEAVE TO AMEND. The plaintiffs’ requests for injunctive relief were also DISMISSED WITHOUT LEAVE TO AMEND. The negligence/failure-to-warn claim is the sole remaining claim, and Western Digital’s answer is due within 14 days after entry of the order.