ORDER GRANTING IN PART PLAINTIFF’S MOTION FOR PRELIMINARY INJUNCTION AND PLAINTIFF’S MOTION FOR EXPEDITED DISCOVERY

Plaintiff SuecessFactors, Inc. moves for a prehminary injunction enjoining Defendant from (1) disseminating, publishing, causing to be made available to the public, affirming the purported truth or accuracy of, or directing any person to disseminate, publish, cause to be made available to the public or affirm the purported truth or accuracy of a certain presentation; (2) disseminating, publishing, causing to be made available to the public, affirming, or directing any person to disseminate, publish, cause to be made available to the public or affirm the allegedly false or misleading statements set forth within that presentation; (3) representing or implying that a person or entity other than Defendant authored any statement in the presentation regarding Plaintiff when such person or entity did not explicitly so author; (4) disseminating or making public use of Plaintiffs trade name, trademark or logo beyond that amount reasonably necessary to identify Plaintiff or its products and services; (5) accessing or obtaining data from any computer system or computer owned, operated or licensed by Plaintiff and subject to restrictions on access without Plaintiffs express written authorization; or (6) disclosing, publishing, reproducing or communicating any information or data received from such a restricted computer or computer system. Plaintiff also seeks an order allowing certain expedited discovery.

The Court issued a temporary restraining order on March 13, 2008 and set a briefing schedule. Defendant has opposed both motions. The motions were heard on March 27, 2008. Having considered all of the papers filed by the parties and oral argument on the motion, the Court grants in part Plaintiffs motion for a preliminary injunction and denies it in part and grants in part Plaintiffs motion for expedited discovery.

BACKGROUND

Plaintiff is a publicly traded company that provides internetbased human resources management software. Defendant is one of Plaintiffs competitors. On or about March 24, 2008, hundreds of Plaintiffs actual or prospective customers received an email from “John Anonymous” with the email address hcmknowledg2008 a@gmail.com. The subject line of the message is “SuecessFactors Failures and Problems” and the body reads, “If you are thinking about purchasing from Success-Factors, please read the following document; it provides information about Suc-cessfactors [sic] which they do not want you to know.” Bernshteyn Deck, Ex. 1. Attached to the message was a forty-three page PowerPoint presentation titled “The Naked Truth.” The presentation appears on a SuecessFactors template and includes SuccessFactor’s trademarked logo at the top of each page. The presentation purports to be “a compilation of the facts from Successfactors [sic] customers” and states that the facts contained in the presentation “represent the measure of Successfactors’ [sic] lack of corporate integrity and why many of us have left them.” Id In addition, Plaintiff alleges that the presentation includes screenshots from three areas of its website: (1) a publicly-available list of customers taken both before and after February 28, 2008, when the list was updated, (2) screens from several publicly available “webinars” and (3) screens from Plaintiffs ACE environment, a password-protected area which is accessible only to Plaintiffs employees, authorized customers, authorized prospective customers and partners.

After learning about the presentation and its contents, Plaintiff analyzed its computer logs to determine which IP addresses had accessed each of these three areas of its website between February 11, 2008 and March 4, 2008. Plaintiff states that only one IP address that is not associated with one of its own offices or employees accessed all three areas of the website. That IP address, 68.236.68.19 belongs to Defendant’s Wayland, Massachusetts office. Plaintiff also determined that this IP address had accessed a specific ACE account, the ACE275 demo account, on February 19 and 21, 2008. One of the screen-shots in the presentation is taken from a customized goal included in the ACE275 demonstration.

Plaintiff also discovered that the ACE275 account was accessed without authorization from three additional IP addresses, two residential IP addresses located near Wayland, Massachusetts and one business address assigned to Defendant’s London, England office. The ACE275 account was created for a purported prospective customer named Ely Valles on behalf of a company called New Millenium [sic] Shoe. At the hearing, Defendant disclosed that its CEO David Watkins is also the CEO of New Millenium [sic] Shoe.

Plaintiff also searched its Customer Relationship Management (CRM) database for any information associated with the IP addresses it identified. The CRM database is a repository of registration information from individuals who seek access to the publicly-available webinars, white papers and data sheets on Plaintiffs website. Plaintiff discovered nine entries in the CRM database, dating back to January, 2006, for the 68.236.68.19 IP address. The name and registration information provided by the person accessing Plaintiffs website from that IP address varied and Plaintiff suspects that many of the names were false. However, Plaintiff found information linking to Defendant two of the names provided.

Plaintiff alleges in the three days after the anonymous email was sent, it received numerous inquiries from concerned current and prospective customers. On March 7, 2008, JMP Securities, an investment bank that provides market analysis of securities, described the presentation as “highly critical of SuccessFactors.” Bernshteyn Decl., Ex. 3. The JMP report contained this heading: “We maintain our Market Outperform rating on SuccessFac-tors, but reduce our price target from $15 to $12 in light of the compression in the on demand comparables.” Id. Under this heading, and referring to the presentation, the JMP report stated, “While some of the critical claims certainly seem to be exaggerated or unfounded, the descriptions of specific customer problems are harder to dismiss without independent analysis.” Id. Therefore, the report stated, “[W]e reserve final judgment until we have had a chance to conduct some independent due diligence.” Id. On March 10, JMP issued another report subtitled “Johnny Anonymous Loses Round One” and describing the “case studies regarding alleged problems with customer implementations” as “unfounded.” Id. at Ex. 4. Plaintiff also provides evidence that concerns about the presentation have been discussed on an internet message board related to Success-Factors’ stock. Id. at Ex. 5.

On March 11, 2008, Plaintiff filed a complaint, alleging claims of false and misleading statements under the Lanham Act and California Business and Professions Code § 17500; trademark infringement under the Lanham Act; damages under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030 ; unauthorized access to computers, computer system and computer data under California Penal Code § 502; defamation; trade libel; intentional interference with prospective economic relations; and unfair competition. On that date, Plaintiff also filed a motion for a temporary restraining order and application for expedited discovery, with notice to Defendant. Defendant opposed the motions, and, on March 13, 2008, the Court granted in part Plaintiffs motion for a temporary restraining order and granted in part Plaintiffs motion for expedited discovery.

Defendant concedes that it created the presentation but argues that it was intended only for internal use by Defendant’s sales force. Defendant states that it does not and will not use the presentation in any external sales or marketing efforts. It considers the presentation to be “its confidential strategic business information” and states that it does not know who distributed it outside the company. Response to Order to Show Cause (Response) at 2. Defendant asserts that, since the presentation’s creation, it has instructed its employees that the document is strictly for internal use.

However, the only evidence Defendant presents in support of this assertion is two email messages from its CEO to its employees, each sent after the complaint was filed. Both of the email messages state that the presentation is only for internal use while maintaining that the presentation is based on “publicly available sources.” Watkins Deck, Exs. A & B. One of the messages instructs that “[information contained in the document should be used judiciously in competitive situation [sic] as required.” Watkins Deck, Ex. A. In addition to its internal reassurance that the information contained in the presentation was substantiated, Defendant issued a press release publicly affirming the veracity of the presentation. The press release states that the presentation “was based on substantiated facts.” Id. at Ex. 3. Plaintiff provides evidence that Defendant has emailed a link to this press release to its potential customers who are also Plaintiffs potential customers. Bernshteyn Reply Deck, Ex. 4.

LEGAL STANDARD

To obtain a preliminary injunction, the moving party must establish either: (1) a combination of probable success on the merits and the possibility of irreparable harm, or (2) that serious questions regarding the merits exist and the balance of hardships tips sharply in the moving party’s favor. Rodeo Collection, Ltd. v. West Seventh, 812 F.2d 1215, 1217 (9th Cir.1987).

The test is a “continuum in which the required showing of harm varies inversely with the required showing of meritoriousness.” Id. (quoting San Diego Comm. Against Registration & the Draft v. Governing Bd. of Grossmont Union High Sch. Dist., 790 F.2d 1471 , 1473 n. 3 (9th Cir.1986)). The moving party ordinarily must show “a significant threat of irreparable injury,” although there is “a sliding scale in which the required degree of irreparable harm increases as the probability of success decreases,” United States v. Odessa Union Warehouse Co-op, 833 F.2d 172, 174, 175 (9th Cir.1987), and vice versa. To overcome a weak showing of merit, a plaintiff seeking a prehminary injunction must make a very strong showing that the balance of hardships is in its favor. Rodeo Collection, 812 F.2d at 1217 .

DISCUSSION

I. Probability of Success on the Merits

Plaintiff argues that there is a sufficient likelihood that it will succeed on the merits of three of its claims to support the grant of a preliminary injunction.

A. CFAA

Plaintiff first argues that it is likely to succeed on the merits of its claim under the CFAA, which creates liability for anybody who “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains ... information from any protected computer if the conduct involved an interstate or foreign communication.” 18 U.S.C. § 1030 (a)(2)(C). The CFAA further provides, “Any person who suffers damage or loss by reason of a violation of this section may maintain a civil action against the violator to obtain compensatory damages and injunctive relief or other equitable relief.” Id. § 1030(g). For purposes of a civil action, the loss, including “any reasonable cost to any victim, including the cost of responding to an offense, conducting a damage assessment, and restoring the data, program, system, or information to its condition prior to the offense, and any revenue lost, cost incurred, or other consequential damages incurred because of interruption of service,” must total at least $5,000 in value. Id. §§ 1030(a)(5)(B)®; 1030(e)(ll); 1030(g).

Plaintiff contends that it can prove that it suffered over $5,000 in losses, citing the

Reply at 13. Plaintiff claims, “These reasonable responses took many hours of valuable time away from day-to-day responsibilities, causing losses well in excess of $5,000.” Id.

Defendant argues only that Plaintiffs CFAA claim will fail because Plaintiffs alleged cost of discovering the author of the presentation does not fit the definition of “loss” under the statute. Defendant cites Tyco International (U.S.) v. Does, 2003 WL 23374767 , 2003 U.S. Dist. LEXIS 25136 (S.D.N.Y.2003), in support of its argument that the “cost of investigating and trying to locate the perpetrator is not included as a qualifying type of loss.” Id. at 2003 WL 23374767 , *3, 2003 U.S. Dist. LEXIS 25136 *8-9.

However, Tyco and the other cases upon which Defendant relies are neither controlling nor directly on point. In Tyco, the New York court addressed a CFAA claim against an individual who unsuccessfully attempted to damage Tyco’s computers by sending spam. In that case, default entered against the defendant and Tyco argued that it was entitled to recover as damages the fees paid to its investigator to discover the identity of the unsuccessful spammer. The court acknowledged that “the CFAA allows recovery for losses beyond mere physical damage to property” but found that “the additional types of damages awarded by courts under the Act have generally been limited to those costs necessary to assess the damages caused to plaintiffs system or to resecure the system in the wake of a spamming attack.” Id. at 2003 WL 23374767 , **3-4, 2003 U.S. Dist. LEXIS 25136 *10.

However, in cases like this, where the offense involves unauthorized access and the use of protected information, the reasonable “cost of responding to [the] offense,” 18 U.S.C. § 1030 (a)(5)(B)(I), will be different from such cost in a case where the primary concern is the damage to the plaintiffs computer system itself. While discovering who caused the damage would be important to the plaintiff in a case such as Tyco to determine from whom it should seek relief, it is not essential to remedying or discovering the extent of the harm. In contrast, where the offender has actually accessed protected information, discovering who has that information and what information he or she has is essential to remedying the harm. In such cases courts have considered the cost of discovering the identity of the offender or the method by which the offender accessed the protected information to be part of the loss for purposes of the CFAA. See, e.g., Shamrock Foods Co. v. Gast, 535 F.Supp.2d 962, 963-64 (D.Ariz.2008) (finding that the cost the plaintiff incurred in conducting a forensic analysis of the defendant’s computer was a loss where the defendant emailed the plaintiffs confidential information to himself before resigning from his position with the plaintiff).

The Court finds that Plaintiff has demonstrated a likelihood that it will prevail on its CFAA claim.

B. Trademark Infringement

Plaintiff also contends that it is likely to succeed on its trademark infringement claim, arguing that Defendant has used more of Plaintiffs trade name than necessary to criticize legitimately Plaintiff and its products and services. Defendant counters that, even if it has exceeded the nominative fair use to which it is entitled, it has only used Plaintiffs trademarks on internal documents. Defendant further argues that, even if one of its employees distributed the presentation, Defendant would not be liable because any such action would be outside the scope of the individual’s employment.

Defendant states, “At this stage, it cannot be disputed that the Presentation was intended for internal use at Softscape. Softscape did not distribute the Presentation to the public, and the disclosure of the Presentation was not authorized, ratified or condoned by Softscape.” Response at 11. However, as Plaintiff points out, whether or not Defendant authorized or condoned the distribution of the Presentation, it was distributed. Moreover, there is no evidence that anybody other than Defendant and its employees had access to the presentation. Therefore, based on the evidence currently available, and even accepting as true Defendant’s position that it did not intend the presentation to be disseminated outside of the company, either Defendant or one of its employees must have distributed the presentation or provided the presentation to the individual who did so.

Defendant cites the Restatement of Agency § 7.03 in support of its position that even if the document were distributed by one of its employees, such distribution was unauthorized and therefore outside the scope of that individual’s employment. However, as Plaintiff argues, the Restatement specifically states, “Conduct is not outside the scope of employment merely because an employee disregards the employer’s instructions.” Rest. (3d) Agency § 7.07 cmt. c.

Even if Defendant did not intend to distribute the presentation containing Plaintiffs registered marks, the presentation was distributed and it is likely that Defendant can be held liable for any causes of action based on that distribution. Based on the evidence currently available, the Court finds that Plaintiff has established a likelihood of succeeding on the merits of its trademark infringement claim.

C. Lanham Act False Advertising Claim

Plaintiff next argues that it has established a likelihood of success on the merits of its Lanham Act false advertising claim. The Ninth Circuit has held that the elements of such a claim are:

Southland Sod Farms v. Stover Seed Co., 108 F.3d 1134, 1139 (9th Cir.1997).

Plaintiff argues that much of the information contained in the presentation is false or misleading, and provides declarations to support its arguments. The statements in the declarations submitted by Defendant are not sufficient to rebut Plaintiffs evidence.

In fact, Defendant does not argue directly that the statements are not false or misleading. Rather, Defendant argues that Plaintiffs false advertising claim fails because (1) Defendant did not use the presentation in commerce; (2) the presentation was not an advertisement; and (3) Defendant did not circulate the presentation in interstate commerce.

As Plaintiff notes, Defendant’s argument that it did not use the presentation in commerce fails because Defendant admittedly continues to use information from the presentation in commerce. As described above, Defendant’s CEO sent an email to Defendant’s sales group instructing them to continue to use the information in the presentation “in competitive situations.” Watkins Decl., Ex. A. Moreover, a press release posted on Defendant’s website affirms the veracity of the information in the presentation. Defendant has emailed to its prospective customers a link to this press release. These acts are sufficient to establish that Defendant is continuing to represent the veracity of the contents of the presentation in commerce.

Defendant next argues that the presentation was not an advertisement. The Ninth Circuit has held that representations may be considered advertisements if they are

Rice v. Fox Broad. Co., 330 F.3d 1170 , 1181 (9th Cir.2003) (quoting Coastal Ab stract Serv. v. First Am. Title Ins. Co., 173 F.3d 725, 735 (9th Cir.1999)). Defendant asserts that Plaintiffs claim fails because the “speech,” which it defines as “the circulation of the Presentation” was not conducted by Defendant. However, as discussed above, the evidence before the Court strongly suggests that Defendant can be held liable for any dissemination of the presentation. Moreover, Defendant’s continuing affirmation of the veracity of the contents of the presentation constitutes ongoing speech.

Defendant’s final argument, that it did not cause the presentation to enter interstate commerce, also relies on its assertion that it cannot be held liable for the dissemination of the presentation. Thus, this argument also fails. The Court finds that Plaintiff has demonstrated a fair likelihood of success on the merits of its Lanham Act false advertising claim. Because Defendant has not provided evidence that the statements in the presentation are true, the Court will enjoin Defendant from affirming the veracity of such statements to the extent that they purport to represent objective facts that can easily be proven true or false.

II. Likelihood of Irreparable Injury

Plaintiff argues that it has demonstrated a likelihood of irreparable injury because it will “continue to suffer immeasurable loss to its relationships with actual and prospective customers caused by the distribution of the Presentation if an injunction does not issue.” Application for TRO at 8.

Defendant counters that Plaintiff has already suffered any harm stemming from the one-time distribution of the presentation. Defendant further argues that past conduct cannot alone suffice to establish the threat of irreparable injury. Finally, Defendant contends that its stated intent not to distribute the presentation in the future precludes the need for a preliminary injunction. However, as discussed above, Defendant has continued publicly to attest to the veracity of the material contained in the presentation. Moreover, there is no evidence that Defendant has publicly acknowledged that it, not Plaintiffs dissatisfied customers, created the presentation.

Based on the likelihood of success on Plaintiffs trademark infringement and false advertising claims discussed above, the Court grants in part Plaintiffs motion for a preliminary injunction.

III. Expedited Discovery

Plaintiff seeks expedited discovery with respect to two issues: how Defendant accessed the restricted portions of its computer system and which individuals were responsible for the creation and distribution of the presentation. As discussed at the hearing, by March 28, 2008, the parties were to have met and conferred along with their respective IT experts to determine a plan for preserving electronic evidence. Formal discovery may commence forthwith. In addition, the parties shall conduct their Federal Rule of Civil Procedure 26(f) conference on April 10, 2008 to establish a mutually agreeable discovery plan. To the extent the parties are unable to agree, each party shall file a brief of five pages or less stating its position on the disagreement by April 14, 2008.

CONCLUSION

The Court GRANTS in part Plaintiffs motion for a preliminary injunction. The injunction has entered as a separate order. Plaintiffs motion for expedited discovery is GRANTED in part.

IT IS SO ORDERED.

. A civil action may also be maintained based on other types of damages not relevant to this case. See 18 U.S.C. § 1020 (a)(5) (B)(ii)-(v). . It is notable that the only evidence Defendant provides in support of this contention is the declaration of its general counsel and emails regarding the confidentiality of the presentation sent by Defendant’s CEO after this lawsuit was filed.