Source: s3://data.kl3m.ai/documents/govinfo/USCOURTS/USCOURTS-casd-3_17-cv-01718/USCOURTS-casd-3_17-cv-01718-1/pdf.json

Nature of Suit Code: 190
Nature of Suit: Other Contract Actions
Cause of Action: 28:1332 Diversity Action

---

- 1 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

UNITED STATES DISTRICT COURT

SOUTHERN DISTRICT OF CALIFORNIA

SALAM RAZUKI, individually and on 

behalf of others similarly situated,

Plaintiff,

vs.

CALIBER HOME LOANS, INC., 

Defendant.

CASE NO. 17cv1718-LAB (WVG)

ORDER GRANTING MOTION TO 

DISMISS [Dkt. 31]

Caliber Home Loans (Caliber) moves to dismiss Salam Razuki’s Third Amended

Complaint (TAC), which relates to a data breach in which hackers obtained Razuki’s

personal information from Caliber. In its June 8, 2018 Order, this Court dismissed without

prejudice Razuki’s negligence, California Constitution, Customer Records Act, and Unfair

Competition claims for failure to state a claim. Dkt. 27.

1

 In his TAC, Razuki re-alleges

those four causes of action, and has added a fifth claim of bailment. But Razuki

consented to dismissal of the California Constitution and bailment claims in his opposition,

so the Court considers those claims dismissed. Dkt. 33 at 3-4. For the reasons below,

the Court finds that Razuki’s remaining claims are still insufficient and must be dismissed,

this time with prejudice.

 

1

It also dismissed with prejudice his claim under the California Consumer Legal 

Remedies Act.

Case 3:17-cv-01718-LAB-WVG Document 36 Filed 11/15/18 PageID.<pageID> Page 1 of 6
- 2 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

1. Negligence

Razuki’s second amended complaint failed to state a claim for negligence because

his vague allegations of damages were impossible for the Court to evaluate. Dkt. 27 at

3. The Court made it clear that Razuki’s negligence claim was essentially

indistinguishable from Krottner v. Starbucks Corporation, 406 F. App'x 129, 131 (9th Cir.

2010), in which the Ninth Circuit found the risk of identity theft following a data breach

sufficient to supply an injury-in-fact for standing, but insufficient to support actual

damages for negligence. Id. at 2-3. In his TAC, Razuki’s newly alleged damages include

diminution in value of his personal data, overpayments to Caliber, and continued risk to

his financial information. Dkt. 30 at ¶ 51. First, his claim alleging continued risk of harm

is still insufficient because it stems from the danger of future harm. See Dkt. 27 at 2. 

Second, his claim alleging diminution of value of his personal data fails to allege enough

facts to establish how his personal information is less valuable as a result of the breach. 

On a similar data breach claim, the court in Sony Gaming Networks and Customer Data

Security Breach Litigation found that plaintiffs alleging diminution of value must show how

“[p]laintiffs have suffered an appreciable, non-speculative harm.” 996 F. Supp. 2d 942,

971 (S.D. Cal. 2014). Here, Razuki’s allegations about damages still remain too

conclusory and vague to satisfy the pleading standard in a complex, large-scale, databreach class action. Finally, Razuki alleges that he and the class members overpaid

Caliber for financial services during or after the breach. However, it is unclear what

payments were made to Caliber and for what services these alleged payments were

made. For example, Razuki does not provide any information to show that he paid a

premium for Caliber to provide reasonable and adequate security measures. In short,

Razuki still has not adequately pled damages that could support a negligence claim. 

2. Customer Records Act, Sections 1798.81.5 and 1798.82

Razuki claims “Defendant knew of higher-quality security protocols available to

them” but failed to implement these measures, in violation of the California Customer

Records Act. Dkt. 30 at ¶23, 74-75. This claim fails because it is precisely the type of

Case 3:17-cv-01718-LAB-WVG Document 36 Filed 11/15/18 PageID.<pageID> Page 2 of 6
- 3 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

“threadbare” claim Iqbal warns of. See Ashcroft v. Iqbal, 556 U.S. 662, 678-79 (2009)

(“Rule 8 . . . does not unlock the doors of discovery for a plaintiff armed with no more

than conclusions.”). Razuki makes a conclusory statement that Caliber knew of higherquality security measures, but he does not support that conclusion with any facts about

Caliber’s protocols or actions it took when choosing appropriate security measures. All

section 1798.81.5 requires is that a business “implement and maintain reasonable

security procedures and practices appropriate to the nature of the information.” Cal. Civ.

Code § 1798.81.5. Razuki could have identified what made Caliber’s security measures

unreasonable by comparison to what other companies are doing, but simply knowing of

higher-quality security measures is not sufficient to state a claim. 

Further, Razuki’s TAC says that “Caliber’s misconduct also included its decision

not to comply with industry standards for the safekeeping and maintenance of the

personal and financial information of Plaintiff and the other Class members.” Dkt. 30 at

¶47. The Court has already acknowledged that it may be difficult to definitively show

Caliber’s practices were insufficient prior to discovery, but again, he needs something

more than what he’s pleading now. What facts lead him to believe Caliber didn’t comply

with industry standards? What are other companies doing that Caliber isn’t? These are

basic questions that Razuki could plead to plausibly show Caliber’s conduct was unlawful. 

Instead, it appears he’s simply recited a few buzz words with the hope that he may be

able to figure out later what, if anything, Caliber has done wrong. But the Supreme Court

tells us that’s not enough. This is a large-scale class action involving more than 100,000

potential plaintiffs. As noted in Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 559 (2007),

plausibility pleading standards are especially important in cases like this one, where the

Defendant faces the “potentially enormous expense of discovery” if the Court denies this

motion to dismiss. The requirement that a plaintiff plausibly plead their claim prevents a

would-be class plaintiff “with a largely groundless claim [from] be[ing] allowed to take up

the time of a number of other people, with the right to do so representing an in terrorem

increment of the settlement value.” Id. at 558 (quoting Dura Pharmaceuticals, Inc. v.

Case 3:17-cv-01718-LAB-WVG Document 36 Filed 11/15/18 PageID.<pageID> Page 3 of 6
- 4 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

Broudo, 544 U.S. 336, 347 (2005) (internal quotation marks omitted). These factors

caution against subjecting Caliber to the “potentially enormous expense of discovery”

without a better showing from the Plaintiff that he has a plausible case. 

Razuki’s other theory of liability under the CRA is that Caliber violated Section

1798.82. This provision requires that a business notify its customers of a data breach “in

the most expedient time possible and without reasonable delay.” Cal. Civ. Code §

1798.82(a). Razuki claims Caliber didn’t notify him of the breach until five months after

the breach. Dkt. 30 at ¶26, 74. While in a vacuum this may seem to be a long time

between breach and notification, all that section 1798.82 requires is that the notification

be without “reasonable delay.” Razuki does not allege facts that suggest this time frame

is without “reasonable delay.” He also fails to establish that even if there was

unreasonable delay, the delay caused any alleged injury. As other courts in this Circuit

have recognized, a Plaintiff alleging a violation of 1798.82 must show that the delay in

notification led to incremental harm, which Plaintiff plainly has not shown here. See, e.g.,

In re Adobe Sys., Inc. Privacy Litig., 66 F. Supp. 3d 1197, 1218 (N.D. Cal. 2014)

(“Plaintiffs have not alleged any injury traceable to Adobe’s alleged failure to notify

customers of the 2013 data breach in violation of Section 1798.82, because [p]laintiffs do

not allege that they suffered any incremental harm as a result of the delay.”) (emphasis

in original). His claim under 1798.82 fails. 

3. Unfair Competition Law (UCL)

California Business and Professions Code section 17200 prohibits any “unlawful,

unfair, or fraudulent business act or practice.” Cal. Bus. & Prof. Code § 17200. The UCL

“borrows violation of other laws and treats them as unlawful practices.” Benson v. Kwikset

Corp., 152 Cal. App. 4th 1254, 1267 (2007) (internal citations omitted). Razuki appears

to be making his UCL claim based on the “unlawful” prong of the statute. See Dkt. 30 at

¶65. He bases the claim on violation of the CRA, Privacy Act of 1974, and the Federal

Trade Commission Act (“FTC Act”). Id. As discussed above, his CRA claim fails, so it

cannot serve as the basis for his UCL claim. And as Caliber correctly notes, only federal

Case 3:17-cv-01718-LAB-WVG Document 36 Filed 11/15/18 PageID.<pageID> Page 4 of 6
- 5 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

agencies are subject to violations of the Privacy Act of 1974, so that claim fails, too. Dkt.

31-1 at 21. The only theory left for Razuki’s UCL claim is the FTC Act. The FTC Act

makes unlawful “unfair methods or competition in or affecting commerce, and unfair or

deceptive acts or practices in or affecting commerce.” 15 U.S.C. § 45(a)(1). Because

the Court has already found that the practices Razuki alleged were unfair to be

insufficient, his claim under the FTC Act fails. 

Further, in order to pursue a claim under the UCL, a plaintiff must “have suffered

an ‘injury in fact’ and ‘lost money or property as a result of such unfair competition.” Ruiz

v. Gap Inc., 540 F. Supp. 2d 1121, 1127 (N.D. Cal. 2008) (quoting Hall v. Time Inc., 158

Cal. App. 4th 847, 849 (2008)). The Court warned Razuki that his SAC failed to allege

any lost money or property. Dkt. 27 at 6. At most, Razuki claims that he “suffered lost

money from his Wells Fargo bank account, from which funds were transferred without his

consent.” Dkt. 30 at ¶66. He does not allege how much money was lost or whether Wells

Fargo actually allowed the money to be withdrawn from this account. As Caliber points

out, Wells Fargo itself alerted him to the withdrawal. See Dkt. 31-1 at 3-4. The logical

conclusion to be drawn from this (and one not disputed by Razuki) is that this alert was

part of Wells Fargo’s efforts to determine whether the withdrawal was fraudulent and, if

necessary, reverse the transaction. If Wells Fargo quickly reversed the transaction, he

has suffered no loss. His UCL claim fails.

***

Caliber’s Motion to Dismiss is GRANTED. Dkt. 31. Leave to amend is granted

liberally, but not automatically. In re W. States Wholesale Nat. Gas Antitrust Litig., 715

F.3d 716, 738 (9th Cir. 2013). This is Razuki’s fourth complaint and he still has failed to

plead basic facts that could supports his claim: When was the money withdrawn from his

account? How much was withdrawn? Was it refunded? What are Caliber’s security

measures that were insufficient? What were other firms doing that Caliber wasn’t? The

only inference the Court can draw from his failure to plead basic facts is that he is in

possession of no facts that would plausibly support his claim, and that amendment would

Case 3:17-cv-01718-LAB-WVG Document 36 Filed 11/15/18 PageID.<pageID> Page 5 of 6
- 6 -

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

therefore be futile. For that reason, the Court DISMISSES THIS CASE WITH

PREJUDICE. The clerk is directed to enter judgment in favor of Caliber and to close the

case.

IT IS SO ORDERED.

Dated: November 14, 2018

HONORABLE LARRY ALAN BURNS

United States District Judge

Case 3:17-cv-01718-LAB-WVG Document 36 Filed 11/15/18 PageID.<pageID> Page 6 of 6