Toretto v. Donnelley Financial Solutions, Inc.

Background

Hackers accessed Mediant Communications’ business email accounts on April 1, 2019, and stole personal information belonging to the named plaintiffs and more than 200,000 other people. The plaintiffs alleged that Mediant used inadequate network security, failed to encrypt stored personal information, and delayed notifying affected individuals.

Donnelley Financial Solutions and Mediant worked together to provide proxy services. The plaintiffs alleged that Donnelley and Mediant operated as a legal partnership, that Donnelley had authority to oversee Mediant’s data security, and that Donnelley was responsible both for failing to supervise Mediant and for failing to give timely notice of the breach. The plaintiffs also alleged that they were intended third-party beneficiaries of contracts between Donnelley or Mediant and public companies or mutual funds.

The second amended complaint asserted claims including negligence, negligence per se, breach of contract, unjust enrichment, declaratory judgment, and violations of California and Florida statutes. Donnelley moved under Federal Rule of Civil Procedure 12(b)(1) to dismiss all claims against it for lack of subject-matter jurisdiction, arguing that the plaintiffs had not adequately alleged that Donnelley caused their injuries. Mediant moved under the same rule to dismiss the breach-of-contract claim against it.

Legal Standard

A Rule 12(b)(1) motion challenges the court’s power to hear a case. The defendants’ motions were facial challenges, meaning the court considered whether the complaint itself plausibly alleged constitutional standing. Standing requires an injury, a connection between the injury and the defendant’s conduct, and the possibility that a court decision would remedy the injury.

At the pleading stage, the connection required for standing is called “fair traceability.” The court explained that fair traceability requires less than proving proximate cause—the full legal connection usually required to establish liability. The plaintiffs therefore needed only to allege facts showing that their injuries were possibly connected to the defendants’ conduct, not to prove their claims at this stage.

Donnelley’s Motion

The court held that the plaintiffs adequately alleged that Donnelley was a direct cause of their injuries. The complaint alleged that Donnelley contracted with funds in which the plaintiffs invested; that the information was provided to Mediant as part of those contractual relationships; that Donnelley failed to ensure adequate security and failed to supervise Mediant; and that Donnelley failed to timely disclose the breach.

The court rejected Donnelley’s argument that the plaintiffs had to establish a legal partnership before they could show standing. Whether Donnelley was vicariously liable for Mediant’s conduct was a merits question, not a standing question. The court concluded that the alleged relationship between Donnelley, its customers, and Mediant was enough to satisfy the relatively modest standing requirement, regardless of whether the companies ultimately qualified as legal partners.

Mediant’s Motion and the Contract Claim

The court also held that the plaintiffs adequately alleged standing to pursue their breach-of-contract claim against Mediant. The complaint alleged that Mediant directly contracted with some public companies and mutual funds, that the contracts required Donnelley or Mediant to protect investor information, and that the plaintiffs were intended beneficiaries of those provisions.

The court accepted these allegations even though the plaintiffs made them “on information and belief.” It explained that the contract terms were particularly within the defendants’ possession and control, and that allegations based on information and belief are permissible when supported by facts making the alleged inference plausible.

The court further explained that arguments about whether the plaintiffs had adequately pleaded a breach-of-contract cause of action belonged in a motion under Rule 12(b)(6), not in a motion challenging standing under Rule 12(b)(1). The court nevertheless found that the allegations concerning third-party-beneficiary status were sufficient to establish standing.

Disposition

The court denied Donnelley’s motion to dismiss. It also denied Mediant’s motion to dismiss Count III. The Clerk of Court was directed to terminate the motions listed at docket numbers 64 and 67. The order did not decide whether the plaintiffs would ultimately prevail on their claims.