Gaming v. Trustwave Holdings, Inc.

Gloria M. Navarro, Chief Judge United States District Judge

ORDER

Pending before the Court is the Motion to Dismiss, (ECF No. 17), filed by Defendant Trustwave Holdings, Inc. ("Defendant"). Plaintiff Affinity Gaming ("Plaintiff") filed a Response, (ECF No. 36), and Defendant filed a Reply, (ECF No. 42). For the reasons discussed below, Defendant's Motion to Dismiss is GRANTED in part and DENIED in part.

I. BACKGROUND

The instant dispute arises from a contract between the parties. Plaintiff, a Nevada corporation, owns and operates eleven casinos in four states, including Nevada. (Compl. ¶ 10, ECF No. 1). Defendant, a Delaware corporation, is a firm specializing in the field of data security that helps businesses fight cybercrime, protect data, and reduce security risks. (Id. ¶ 11).

Plaintiff alleges that on October 24, 2013, it was notified of fraudulent credit card activity on its data systems. (Id. ¶ 14). Plaintiff alleges that it contacted Defendant to inquire whether Defendant could identify and remedy the data breach. (Id. ¶ 18). Between October 28, 2013 and October 31, 2013, Plaintiff alleges that Defendant's employees, "including Chris Hague, Grayson Lenik and Matthew Aronson, had multiple direct and indirect conversations with Affinity Gaming personnel (including its Vice President of Insurance and Benefits and Vice President of Information Technology)." (Id. ¶ 19). Plaintiff alleges that during those conversation, Defendant made several representations, including, inter alia, that Defendant "had the capabilities to, and would, identify and help remedy the causes of the data breach, as well as facilitate Affinity Gaming's implementation of measures to help prevent further such breaches." (Id. ¶ 20). From those representations, Plaintiff alleges it hired Defendant to investigate and help remedy the data breach, and on October 31, 2013, the parties entered into an Incident Response Agreement ("Agreement"). (Id. ¶ 25).

Shortly after the conclusion of Defendant's services, Plaintiff alleges it learned that its data systems were still compromised. (Id. ¶ 39). Plaintiff alleges that because Defendant's investigation "had not lived up to what [Defendant] represented, [Plaintiff] was forced once again to conduct a forensic investigation into its data security, retaining a second data security firm." (Id. ¶ 41). According to Plaintiff, the second security firm "determined that [Defendant] had failed to identify the entire extent of the breach," (id. ¶ 43), and Defendant "failed to diagnose that the data breach," (id. ¶ 47). Plaintiff also alleges that the report prepared by the second security firm also concluded that the various recommendations Defendant had presented to improve Plaintiff's data security were pointless: "none addressed the source of the data breach, and none would have prevented the attacker from again accessing [Plaintiff's] data systems (for instance, through the backdoors that [Defendant] failed to find and close)." (Id. ¶ 65).

Based on these allegations, Plaintiff alleges the following causes of action: breach of contract; breach of the implied duty of good faith and fair dealing; fraudulent inducement; fraud; constructive/equitable fraud; gross negligence; negligent misrepresentation; violation of Nevada's Deceptive Trade Practices Act; and declaratory judgment. In the Instant Motion, Defendant requests that the Court dismiss Plaintiff's Complaint in its entirety. (Mot. to Dismiss 1:27-2:1, ECF No. 17).

II. LEGAL STANDARD

Dismissal is appropriate under Rule 12(b)(6) where a pleader fails to state a claim upon which relief can be granted. Fed. R. Civ. P. 12(b)(6); Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007). A pleading must give fair notice of a legally cognizable claim and the grounds on which it rests, and although a court must take all factual allegations as true, legal conclusions couched as a factual allegations are insufficient. Twombly, 550 U.S. at 555. Accordingly, Rule 12(b)(6) requires "more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do." Id. "To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to 'state a claim to relief that is plausible on its face.'" Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). "A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged." Id. This standard "asks for more than a sheer possibility that a defendant has acted unlawfully." Id.

If the court grants a motion to dismiss for failure to state a claim, leave to amend should be granted unless it is clear that the deficiencies of the complaint cannot be cured by amendment. DeSoto v. Yellow Freight Sys., Inc., 957 F.2d655, 658 (9th Cir. 1992). Pursuant to Rule 15(a), the court should "freely" give leave to amend "when justice so requires," and in the absence of a reason such as "undue delay, bad faith or dilatory motive on the part of the movant, repeated failure to cure deficiencies by amendments previously allowed, undue prejudice to the opposing party by virtue of allowance of the amendment, futility of the amendment, etc." Foman v. Davis, 371 U.S. 178, 182 (1962).

III. DISCUSSION

Defendant requests that the Court to dismiss Plaintiff's Complaint in its entirety. The Court considers each claim in turn, beginning with a choice of law issue raised by Defendant.

A. Choice of Law

As a preliminary matter, the Court must address the choice of law conflict posed by Plaintiff's first claim for relief, fraudulent inducement. (Compl. ¶¶ 77-85). Depending on the merits of Plaintiff's claims, the Court will either apply Delaware law pursuant to the choice of law provision in the Agreement, or under Nevada law under Erie Railroad v. Tompkins, 304 U.S. 64, 78 (1938). Under both Nevada and Delaware law, a finding of fraudulent inducement renders a contract voidable at the election of the defrauded party. See Lincoln Nat. Life Ins. Co. v. Joseph Schlanger 2006 Ins. Trust, 28 A.3d 436, 439 (Del. 2011); Havas v. Alger, 461 P.2d 857, 859 (Nev. 1969). Plaintiff suggests that should the Court find the Agreement voidable, it would seek recession of the Agreement. (Resp. 18:4-7, ECF No. 36). Given this possibility, the Agreement as a whole may ultimately be declared invalid, rendering the Delaware choice of law provision inapplicable. In that case, the Court would apply Nevada law pursuant to the Erie doctrine. See Erie, 304 U.S. at 78 ("Except in matters governed by the Federal Constitution or by acts of Congress, the law to be applied in any case is the law of the state.").

The conflict need not be resolved at this juncture, however. Because the instant Motion contests the sufficiency of the pleadings, rather than the merits of the underlying claims for relief, the Court conducts its analysis under both Delaware and Nevada law, preserving the claim where it could be viable under either. See Fuoroli v. Westgate Planet Hollywood Las Vegas, LLC, No. 2:10-cv-2191-JCM-GWF, 2011 WL 1871236, at *1 (D. Nev. May 16, 2011).

B. Breach of Contract

Under Delaware law, the elements of a breach of contract claim are as follows: "first, the existence of the contract, whether express or implied; second, the breach of an obligation imposed by that contract; and third, the resultant damage to the plaintiff." VLIW Tech., LLC v. Hewlett-Packard Co., 840 A.2d 606, 612 (Del. 2003). The elements of the claim under Nevada law are the same. See Saini v. Int'l Game Tech., 434 F. Supp. 2d 913, 919-920 (D. Nev. 2006) (citing Richardson v. Jones, 1 Nev. 405, 405 (Nev. 1865)).

Applying either law, the Court finds that Plaintiff sufficiently alleges a breach of contract claim. Plaintiff alleges that the parties entered into a valid agreement on October 31, 2013. (Compl. ¶ 25). Plaintiff then alleges that Defendant breached this agreement by failing to "perform a forensic investigation to identify, and remedy or contain, the causes of [Plaintiff's] data breach, and to issue recommendations for measures [Plaintiff] would undertake to prevent further breaches in the future." (Id. ¶ 130). Finally, Plaintiff alleges that it has been injured by Defendant's alleged breaches in an amount exceeding $100,000. (Id. at 134). Taking these allegations as true and in a light most favorable to Plaintiff, the Court finds that Plaintiff sufficiently alleges a breach of contract claim. Accordingly, the Court DENIES Defendant's Motion to Dismiss as to this claim.

C. Breach of the Implied Duty of Good Faith and Fair Dealing

To successfully plead a breach of an implied covenant of good faith and fair dealing pursuant to Delaware law, a plaintiff must allege "a specific implied contractual obligation, a breach of that obligation by the defendant, and resulting damage to the plaintiff." Fitzgerald v. Cantor, No. C.A. 16297-NC, 1998 WL 842316, at *1 (Del. Ch. Nov. 10, 1998). However, the implied covenant does not apply when "the subject at issue is expressly covered by the contract." Dave Greytak Enters., Inc. v. Mazda Motors of Am., Inc., 622 A.2d 14, 23 (Del. Ch. 1992), aff'd, 609 A.2d 668 (Del. 1992). In Nevada, to state a claim for breach of implied covenant of good faith and fair dealing, a plaintiff must allege: (1) that the plaintiff and the defendant were parties to a contract; (2) that the defendant breached the covenant of good faith and fair dealing by "deliberately counterven[ing] the intention and spirit of the contract"; and (3) that the plaintiff's "justified expectations" were denied. Hilton Hotels v. Butch Lewis Prods., 808 P.2d 919, 922-23 (Nev. 1991).

To the extent Plaintiff attempts to allege a breach of the duty of good faith and fair dealing, the Complaint fails to allege facts demonstrating a specific implied contractual obligation as required Delaware law, see Fitzgerald, 1998 WL 842316, at *1, or how Plaintiff deliberately contravened the intention and spirit of the contract as require by Nevada law, see Hilton Hotels, 808 P.2d at 922-23. Instead, Plaintiff merely alleges that Defendant had an implied duty to deal "reasonably, prudently, fairly and in good faith, under the implied covenant of good faith and fair dealing" and that Defendant failed perform its services in conjunction with that obligation. (Compl. ¶¶ 113, 132). These statements are insufficient, conclusory allegations that simply recite the formulaic elements to the cause of action. See Twombly, 550 U.S. at 555. Accordingly, the Court DISMISSES without prejudice Plaintiff's claim for breach of the implied covenant of good faith and fair dealing.

D. Economic Loss Doctrine

Both Delaware and Nevada recognize the economic loss doctrine. Under Delaware law, the economic loss doctrine "allows a party to recover in tort only if losses are accompanied by bodily harm or property damage; in other words, the doctrine prevents plaintiffs from recovering in tort for losses suffered that are solely economic in nature." Kuhn Const. Co. v. Ocean & Coastal Consultants, Inc., 844 F. Supp. 2d 519, 526 (D. Del. 2012) (citing Del. Art Museum v. Ann Beha Architects, Inc., Civ. No. 06-481, 2007 WL 2601472, at *2 (D. Del. Sept. 11, 2007)). Delaware recognizes an exception to the economic loss doctrine "when the claims at issue arise independently of the underlying contact." Alltrista Plastics, LLC v. Rockline Indus., Inc., No. CV N12C-09-094 JTV, 2013 WL 5210255, at *4 (Del. Super. Sept. 4, 2013). "Claims of fraud that go directly to the inducement of the contract, rather than its performance, are not barred by the economic loss doctrine." Id.

In Nevada, the economic loss doctrine bars negligent tort actions where the plaintiff seeks to recover only economic loss. Terracon Consultants W., Inc. v. Mandalay Resort Group, 206 P.3d 81, 86 (Nev. 2009). Nevada courts have articulated some exceptions to the rule, which apply "in broad categories of cases in which the policy concerns about administrative costs and a disproportionate balance between liability and fault are insignificant, or other countervailing considerations weigh in favor of liability." Id. at 88.

Here, Plaintiff requests damages that are only economic in nature. (Compl. ¶¶ 67, 74). As a result, the Court will evaluate each of Plaintiff's tort claims under the economic loss doctrine.

i. Fraudulent Inducement

Plaintiff alleges that Defendant acted "with the intent to induce [Plaintiff] to enter into a contract with [Defendant]" by misrepresenting that "it had the capabilities and experience as a data service security provider to investigate, diagnose, and help remedy the data breach" and that it would perform these tasks. (Compl. ¶ 78). In addition, Plaintiff alleges it relied on Defendant's misrepresentations by entering into the Agreement and paying Defendant under the Agreement as well as "to avoid the financial and reputation harm, and the regulatory scrutiny and action" that would result from a future breach. (Id. ¶ 83). Plaintiff further alleges that Defendant knew these promises were false, (id. ¶ 80), that the representations were material to Plaintiff's decision to engage Defendant's services, (id. ¶ 78), and that Defendant intended Plaintiff to rely on its misrepresentations, (id. ¶ 82).

Under Delaware law, a plaintiff must allege the following to state a claim for fraudulent inducement: (1) a false representation of material fact made by the defendant; (2) the defendant's knowledge or belief that the representation was false, or was made with reckless indifference to the truth; (3) an intent to induce the plaintiff to act or to refrain from acting; (4) the plaintiff's action or inaction taken in justifiable reliance upon the representation; and (5) damage to the plaintiff as a result of such reliance. E.I. DuPont de Nemours & Co. v. Fla. Evergreen Foliage, 744 A.2d 457, 461-62 (Del. 1999).

The court finds dismissal of this claim unwarranted. First, the Complaint meets the heightened pleading standard of Federal Rule of Civil Procedure 9(b), which requires a party alleging fraud to "state with particularity the circumstances constituting fraud or mistake." As the summation above notes, Plaintiff has complied with this rule by providing specific facts to support the claim.

Second, the Court finds that the economic loss rule does not apply to this tort under Delaware law, which is the law Defendant seeks to apply. See Alltrista Plastics, 2013 WL 5210255, at *4. Neither would the claim be dismissed under Nevada's economic loss rule, which attaches to "unintentional tort actions." Terracon Consultants, 206 P.3d at 86.

ii. Fraud

Plaintiff alleges that Defendant made false representations of material facts. (Compl. ¶ 87). In particular, Plaintiff alleges that Defendant misrepresented its "capabilities and experience as a data security service provider," "that it had undertaken a proper investigation," that the breach had been secured, and that its recommendations "would help to prevent . . . further data breaches from occurring." (Id.). Plaintiff alleges these representations were untrue, (id. ¶¶ 88-89), Defendant intended Plaintiff to rely on these representations (id. ¶ 91), and Plaintiff justifiably relied on the representations by, inter alia, "representing to customers, vendors, and governmental actors that [Plaintiff's] data breach had been diagnosed and remedied," (id. ¶ 92).

Under Delaware law, the elements of fraud are essential the same as the requirements for fraudulent inducement, discussed supra. See E.I. DuPont de Nemours, 744 A.2d at 461-62.

The Court finds dismissal of this claim unwarranted. As with Plaintiff's fraudulent inducement claim, the Complaint meets the heightened pleading standard of Federal Rule of Civil Procedure 9(b) because Plaintiff has provided specific facts to support the allegations. In addition, the Court declines to dismiss the fraud claim based on the economic loss doctrine as Delaware, and likely Nevada, recognize fraud as an exception to the economic loss doctrine. See Israel Disc. Bank of New York v. First State Depository Co., LLC, No. CIV.A. 7237-VCP, 2012 WL 4459802, at *14 (Del. Ch. Sept. 27, 2012), aff'd, 86 A.3d 1118 (Del. 2014) (noting that exceptions to the economic loss doctrine include "claims of fraud, as well as other intentional torts"); Fuoroli, 2011 WL 1871236, at *5 ("Logic thus dictates that a claim for fraudulent misrepresentation, an intentional tort, would also constitute an exception to the rule.").

iii. Constructive/Equitable Fraud

With respect to Plaintiff's constructive or equitable fraud claim, Plaintiff alleges, in addition to Plaintiff's fraud allegations discussed supra, that it had a "special relationship" with Defendant. (Compl. ¶ 96). Specifically, Plaintiff alleges that Defendant "claimed to possess specialized knowledge, experience and qualifications regarding security for information technology systems and data," that this "specialized knowledge . . . put [Defendant] in a position of superiority over [Plaintiff]," and that Defendant knew Plaintiff would rely on Defendant's claims. (Id. ¶ 97).

In Nevada, constructive fraud is "the breach of some legal or equitable duty which, irrespective of moral guilt, the law declares fraudulent because of its tendency to deceive others or to violate confidence." Perry v. Jordan, 900 P.2d 325, 337 (Nev. 1995). "Constructive fraud is characterized by a breach of duty arising out of a fiduciary or confidential relationship." Id. A confidential relationship may arise out of business or social relations between parties regardless of whether a fiduciary relationship exists. Id. at 338. These are essentially the same requirements under Delaware law. BAE Sys. N. Am. Inc. v. Lockheed Martin Corp., No. CIV.A. 20456, 2004 WL 1739522, at *7 (Del. Ch. Aug. 3, 2004).

The Court finds that Plaintiff's claims sufficiently allege a special relationship with Defendant under either Nevada or Delaware law. Further, as discussed supra, both states exclude fraud from the economic loss doctrine. Accordingly, the Court DENIES Defendant's Motion to Dismiss this claim.

iv. Gross Negligence

Plaintiff alleges that Defendant owed it a "duty of care in performing its data security services, and in providing information that was truthful and accurate regarding Trustwave's investigation, the causes of Affinity Gaming's data breach, and the remediation or containment of that breach." (Compl. ¶ 118). Plaintiff further alleges that Defendant breached this duty, (id. ¶ 19), and that this breach caused Plaintiff harm, (id. ¶ 120).

A claim for gross negligence is separate from a normal negligence claim. To state a claim for negligence, a plaintiff must establish that: (1) the defendant owed a duty to the plaintiff; (2) the defendant breached that duty causing injury to the plaintiff; (3) the breach was the actual cause of the plaintiff's injury; and (4) the injury was a foreseeable consequence of defendant's breach. See Hammerstein v. Jean Dev. W., 907 P.2d 975, 977 (Nev. 1995). However, to state a claim for gross negligence a plaintiff must establish that the defendant failed "to exercise even the slightest degree of care" in his conduct. Hart v. Kline, 116 P.2d 672, 673-74 (Nev. 1941). Similarly, Delaware requires Plaintiff to demonstrate that Defendant owed a duty of care to Plaintiff. See, e.g., McKenna v. Terminex Int'l Co., No. CIV.A. 04C-02-022RBY, 2006 WL 1229674, at *3 (Del. Super. Mar. 13, 2006)

Because Plaintiff does not allege a breach of duty by Defendant "independent of the contractual obligations," Plaintiff's claim for gross negligence fails under Delaware law. See id. (dismissing claims of gross negligence where plaintiff failed to allege duty independent of contract). The Court also finds that this claim fails under Nevada law because Plaintiff has failed to allege that its "injury was a foreseeable consequence of [D]efendant's breach." See Hammerstein, 907 P.2d at 977. Accordingly, the Court DISMISSES without prejudice Plaintiff's gross negligence claim.

v. Negligent Misrepresentation

Plaintiff alleges that Defendant misrepresented its "capabilities and experience as a data security service provider," "that it had undertaken a proper investigation," that the breach had been secured, and that its recommendations "would help to prevent . . . further data breaches from occurring." (Compl. ¶ 122). Plaintiff further alleges it reasonably relied on Defendant's representations, (id. ¶ 127), and that it was "consequently and proximately injured by these misrepresentations, (id. ¶ 128).

A claim for negligent misrepresentation requires a plaintiff to plead: "1) a representation that is false; 2) that the representation was made in the course of the defendant's business or in any action in which he has a pecuniary interest; 3) the representation was for the guidance of others in their business transactions; 4) the representation was justifiably relied upon; 5) that such reliance resulted in pecuniary loss to the relying party; and 6) that the defendant failed to exercise reasonable care or competence in obtaining or communicating the information." G.K. Las Vegas Ltd. P'ship v. Simon Prop. Grp., Inc., 460 F. Supp. 2d 1246, 1262 (D. Nev. 2006). The elements under Delaware law are essentially the same. See Snowstorm Acquisition Corp. v. Tecumseh Prod. Co., 739 F. Supp. 2d 686, 709 (D. Del. 2010).

As an initial matter, the proposed amended complaint's negligent misrepresentation claim does not comply with Federal Rule of Civil Procedure 9(b) because it fails to plead that these misrepresentations "were made in the course of [Defendant's business]" or that these representations were "for the guidance of others in their business transactions." See G.K. Las Vegas Ltd. P'ship, 460 F. Supp. 2d at 1262.

In addition, although under Nevada law a claim for negligent misrepresentation is generally excluded from the economic loss doctrine, Terracon, 206 P.3d at 88, Plaintiff's claim is foreclosed by Delaware's economic loss rule. Under Delaware law, the economic loss doctrine does not bar claims for the tort of negligent misrepresentation if (1) the defendant supplied the information to the plaintiff for use in business transactions, and (2) the defendant is in the business of supplying information. Commonwealth Const. Co. v. Endecon, Inc., No. CIV.A. 08C01266RRC, 2009 WL 609426, at *4 (Del. Super. Mar. 9, 2009). Plaintiff fails to allege that this exception applies in this case. Accordingly, Plaintiff's claim for negligent misrepresentation is DISMISSED without prejudice.

E. Deceptive Trade Practices

The Nevada Deceptive Trade Practices Act ("NDTPA"), codified as NRS § 598, prohibits a seller from making false statements or misrepresentations about his or her goods or services, or failing to disclose material facts about his or her goods or services. See generally NRS § 598. Plaintiff asserts that Defendant knowingly violated the NDTPA, specifically citing NRS § 598.0923(2) (prohibiting "fail[ure] to disclose a material fact in connection with the sale or lease of goods or services"); NRS § 598.0915(5) (prohibiting "knowingly mak[ing] a false representation as to the characteristics, ingredients, uses, benefits, alterations or quantities of goods or services for sale or lease or a false representation as to the sponsorship, approval, status, affiliation or connection of a person therewith"); and, NRS § 598.0915(15) (prohibiting "[k]nowingly mak[ing] any other false representation in a transaction"). For a plaintiff to recover based on consumer fraud under the Deceptive Trade Practices Act, a plaintiff must allege that they reasonably relied on the alleged misrepresentation where it is an affirmative misrepresentation rather than a failure to disclose. Picus v. Wal-Mart Stores, Inc., 256 F.R.D. 651, 657-58 (D. Nev. 2009).

Specifically, Plaintiff alleges that Defendant engaged in deceptive trade practices by falsely representing that Defendant had the capabilities to perform the obligations under the Agreement, that Defendant undertook a proper investigation to determine the cause of the data breach, that the data breach was "contained" and the backdoor was "inert" when it was not, and that Defendant's recommendations would prevent further data breaches. (Compl. ¶ 110). Further, Plaintiff alleges that it relied on Defendant's representations by "representing to customers, vendors, and governmental actors that Affinity Gaming's data breach had been diagnosed and remedied," when it had not. (Id. ¶ 112).

This claim will necessarily be dismissed if the court finds the contract valid and the choice of law provision stands. However, if the court ultimately finds the contract invalid and applies Nevada law, the claim may be viable. The Motion to Dismiss is thus also DENIED as to this claim.

F. Declaratory Judgment

"Claims" for injunctive or declaratory relief are not proper causes of action. "Declaratory relief, like injunctive relief, is a remedy, not an underlying substantive claim." Daisy Trust v. JPMorgan Chase, No. 2:13-cv-00966-RCJ-VCF, 2013 WL 6528467, at *4 (D. Nev. Dec. 11, 2013) (citing In re Wal-Mart Wage & Hour Emp't Practices Litig., 490 F. Supp. 2d 1091, 1130 (D. Nev. 2007)). In the instant case, Plaintiff's claim for declaratory relief merely repeats the allegations supporting Plaintiff's first seven claims. It is therefore duplicative and DISMISSED with prejudice. / / / / / / / / / / / / / / / / / / / / / / / / / / / / / /

IV. CONCLUSION

IT IS HEREBY ORDERED that Defendant's Motion to Dismiss, (ECF No. 17), is GRANTED in part and DENIED in part.

IT IS FURTHER ORDERED that Plaintiff's claims for breach of the implied duty of good faith and fair dealing, gross negligence, and negligent misrepresentation are DISMISSED without prejudice.

IT IS FURTHER ORDERED that Plaintiff's claim for declaratory judgment is DISMISSED with prejudice.

IT IS FURTHER ORDERED that Plaintiff shall have twenty-one days from the date of this Order to file an amended complaint. Failure to file an amended complaint by this date shall result in the dismissal of Plaintiff's claims with prejudice.

DATED this 30 day of September, 2016.

/s/_________

Gloria M. Navarro, Chief Judge

United States District Judge