1 2 3 4 5 6 7 8 UNITED STATES DISTRICT COURT 9 SOUTHERN DISTRICT OF CALIFORNIA 10 11 GERALD S. LEE, individually and on Case No.: 21cv1144-LL-MSB behalf of all others similarly situated 12 and on behalf of the general public, ORDER GRANTING DEFENDANT’S 13 MOTION TO DISMISS FOR LACK Plaintiff,

OF PERSONAL JURISDICTION

14 v. 15 [ECF No. 12]

NETGAIN TECHNOLOGY, LLC,

16 Defendant. 17

18 Defendant Netgain Technology, LLC (“Netgain”) moves to dismiss this putative 19 class action for lack of personal jurisdiction under Federal Rule of Civil Procedure 20 12(b)(2). ECF No. 12. Plaintiff filed a response in opposition, [ECF No. 14], and Netgain 21 filed a reply, [ECF No. 16]. The motion has been fully briefed and is suitable for 22 submission without the need for oral argument. For the below reasons, the motion is 23 GRANTED.1 24 25 26 1 A different plaintiff and putative class representative filed a nearly identical complaint in 27 Clark v. Netgain Technology, LLC, No. 21-cv-1432-LL-MSB (S.D. Cal. Aug. 10, 2021) in which Netgain also has a pending motion to dismiss for lack of personal jurisdiction. Both 28 1 I. BACKGROUND 2 Plaintiff alleges that Netgain is a cloud hosting and information technology services 3 company that provides services to several organizations in the healthcare and accounting 4 industries nationwide. Complaint (“Compl.”) ¶ 3. CareSouth Carolina, Inc. (“CareSouth”) 5 is one of Netgain’s clients and is a community health center providing a comprehensive set 6 of services to its patients, from pediatrics to pharmacy to community outreach.2 Id. ¶ 6. 7 Plaintiff is a citizen and resident of South Carolina. Id. ¶ 14. As a patient of CareSouth, he 8 was required to provide Netgain and CareSouth with his personal medical information 9 (“PMI”) with the assurance that such information would be kept safe from unauthorized 10 access. Id. at 7. 11 On or around December 3, 2020, cyber criminals infiltrated network servers 12 belonging to Netgain and CareSouth where sensitive personal and medical information was 13 being kept unprotected (the “data breach”). Id. ¶ 1. The cybercriminals gained access to 14 certain network servers, and Netgain paid a significant amount of money in exchange for 15 a promise from the attackers that they would delete the copies of the data that was in their 16 possession and would not publish, sell or otherwise share the data. Id. ¶ 2. On May 17, 17 2021, Plaintiff received a letter from CareSouth informing him of “an incident that 18 involved personal information maintained by our vendor Netgain” in which “some of [the] 19 servers that it maintained for CareSouth Carolina were affected as part of a ransomware 20 attack.” ECF No. 1-2. 21 Plaintiff brings a putative nationwide class action on behalf of all persons residing 22 in the United States whose PMI was compromised as a result of the data breach. Id. ¶ 119. 23 Plaintiff also brings a putative subclass action on behalf of all patients of CareSouth. Id. 24 Plaintiff’s claims include: (1) negligence; (2) invasion of privacy; (3) breach of third-party 25 beneficiary contract; (4) breach of implied contract; (5) breach of confidence; (6) breach 26 27 2 CareSouth was voluntarily dismissed as a defendant just prior to the filing of Negtain’s 28 1 of implied covenant of good faith and fair dealing; (7) violations of South Carolina Code 2 of Laws, S.C. Stat. Tit. 389, Ch. 5 §§ 10, et seq.; (8) violations of South Carolina Code of 3 Laws, S.C. Stat. Tit. 39, Ch. 1 § 90; and (9) for declaratory relief. 4 II. LEGAL STANDARDS 5 Under Federal Rule of Civil Procedure 12(b)(2), a district court may dismiss an 6 action for lack of personal jurisdiction. Any judgment rendered by a court that lacks 7 personal jurisdiction over a defendant is void. Ruiz v. Snohomish Cnty. Pub. Util. Dist. No. 8 1, 824 F.3d 1161, 1164 (9th Cir. 2016). A federal court has personal jurisdiction over an 9 out of state defendant if the defendant had certain minimum contacts with the state such 10 that the maintenance of the suit does not offend traditional notions of fair play and 11 substantial justice. Goodyear Dunlop Tires Ops., S.A. v. Brown, 564 U.S. 915, 923 (2011) 12 (citing Int’l Shoe Co. v. Washington, 326 U.S. 310, 316 (1945)). This minimum contact 13 jurisdiction may be either “general or all-purpose jurisdiction,” or “specific or case-linked 14 jurisdiction.” Id. at 919 (citing Helicopteros Nacionales de Colom. a S.A. v. Hall, 466 U.S. 15 408, 414 (1984)). 16 “Where defendants move to dismiss a complaint for lack of personal jurisdiction, 17 plaintiffs bear the burden of demonstrating that jurisdiction is appropriate.” Dole Food Co. 18 Inc. v Watts, 303 F.3d 1104, 1108 (9th Cir. 2002). Factual disputes are resolved in the 19 plaintiff’s favor. Pebble Beach Co. v. Caddy, 453 F.3d 1151, 1154 (9th Cir. 2006) (citation 20 omitted). Where the court decides a motion to dismiss for lack of personal jurisdiction 21 without an evidentiary hearing, the plaintiff need only make a prima facie showing of 22 jurisdictional facts to withstand the motion to dismiss. Ballard v. Savage, 65 F.3d 1495, 23 1498 (9th Cir. 1995). 24 The plaintiff cannot, however, simply rest on the bare allegations of his or her 25 complaint. Mavrix Photo, Inc. v. Brand Techs., Inc., 647 F.3d 1218, 1223 (9th Cir. 2011) 26 (citation omitted). Only uncontroverted allegations in the complaint must be taken as true. 27 Id. The court may consider evidence presented in affidavits and declarations in determining 28 personal jurisdiction. Doe v. Unocal Corp., 248 F.3d 915, 922 (9th Cir. 2011); see also In 1 re Cathode Ray Tube (CRT) Antitr. Litig., 27 F. Supp. 3d 1002, 1008 (N.D. Cal. 2014) 2 (“The Court may not assume the truth of allegations that are contradicted by affidavit.”). 3 III. DISCUSSION 4 The parties dispute whether the Court has specific jurisdiction over Netgain.3 5 Specific jurisdiction exists where “the defendant's suit-related conduct . . . . create[s] a 6 substantial connection with the forum State.” Walden v. Fiore, 571 U.S. 277, 284 (2014). 7 In order for a federal court to exercise specific jurisdiction over a non-resident defendant: 8 (1) The non-resident defendant must purposefully direct his activities or consummate some transaction with the forum or resident thereof; or perform 9 some act by which he purposefully avails himself of the privilege of 10 conducting activities in the forum, thereby invoking the benefits and protections of its laws; (2) the claim must be one which arises out of or relates 11 to the defendant’s forum-related activities; and (3) the exercise of jurisdiction 12 must comport with fair play and substantial justice, i.e. it must be reasonable.

13 See Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 801–02 (9th Cir. 2004). 14 (citing Lake v. Lake, 817 F.2d 1416, 1421 (9th Cir. 1987)). “If any of the three requirements 15 is not satisfied, jurisdiction in the forum would deprive the defendant of due process of 16 law.” Caddy, 453 F.3d at 1155. The plaintiff bears the burden of satisfying the first two 17 prongs of the test. Id. (citing Sher v. Johnson, 911 F.2d 1357, 1361 (9th Cir. 1990)). If the 18 plaintiff satisfies the first two prongs, the burden shifts to the defendant to present a 19 “compelling case” that the exercise of jurisdiction would not be reasonable. Burger King 20 Corp. v. Rudzewicz, 471 U.S. 462, 476–78 (1985). 21 A. Purposeful Availment and Direction 22 A purposeful availment analysis is most often used in suits sounding in contract 23 while a purposeful direction analysis is most often used in suits sounding in tort. 24 Schwarzenegger, 374 F.3d at 802 (citations omitted). “[B]oth purposeful availment and 25 purposeful direction ask whether defendants have voluntarily derived some benefit from 26 27 3 The parties do not dispute (1) that Netgain does not reside in California, and (2) the Court 28 1 their interstate activities such that they will not be haled into a jurisdiction solely as a result 2 of ‘random,’ ‘fortuitous,’ or ‘attenuated’ contacts.” Global Commodities Trading Grp., Inc. 3 v. Beneficio de Arroz Choloma, 972 F.3d 1101, 1107 (9th Cir. 2020) (quoting Burger King, 4 471 U.S. at 474–75). 5 1. Purposeful Direction 6 Purposeful direction requires that that the defendant: “‘(1) committed an intentional 7 act, (2) expressly aimed at the forum state, (3) causing harm that the defendant knows is 8 likely to be suffered in the forum state.’” Axiom Foods, Inc. v. Acerchem Int’l, Inc., 874 9 F.3d 1064, 1069 (9th Cir. 2017) (quoting Wash. Shoe Co. v. A-Z Sporting Goods Inc., 704 10 F.3d 668, 673 (9th Cir. 2012)). A defendant acts intentionally when he acts with “an intent 11 to perform an actual, physical act in the real world, rather than an intent to accomplish a 12 result or consequence of that act.” AMA Multimedia, LLC v. Wanat, 970 F.3d 1201, 1209 13 (9th Cir. 2020) (quoting Schwarzenegger, 374 F.3d at 806). Showing the defendant 14 “engaged in wrongful conduct targeted at a plaintiff whom the defendant knows to be a 15 resident of the forum state” is relevant to the “expressly aimed” inquiry. Axiom Foods, 874 16 F.3d at 1069–70. 17 In his Complaint, Plaintiff claims “[t]his Court has personal jurisdiction over 18 Defendants because Defendant Netgain conducts much of its business in and has sufficient 19 minimum contacts with California.” Compl. ¶ 28. Plaintiff further claims that “[v]enue is 20 likewise proper . . . . in this District . . . . because Defendant Netgain conducts business 21 through this District (including promoting, selling, marketing, and distributing the Netgain 22 brand and services at issue).” Id. ¶ 29. Plaintiff argues he has made a prima facie showing 23 of both purposeful availment and direction because “the uncontroverted allegations are that 24 Netgain (1) advertises serving the San Diego market via its website; (2) has a physical 25 office in California; (3) employs personnel working in California; and (4) has California 26 employees providing IT services to its customers, which includes California residents, 27 contracting with California residents, and maintaining business relationships with 28 California residents.” ECF No. 14 at 5. In support of this argument, Plaintiff cites a link to 1 a page on Netgain’s website noting that “[t]he company has grown to include offices and 2 data centers in Chicago, Minneapolis, San Diego and Phoenix.”4 Id. at n.1. 3 In opposition, Netgain argues that Plaintiff has not shown purposeful direction5 4 because “Netgain only has one satellite office in California that is staffed by only a few 5 employees, none of whom provided services to CareSouth” and “Netgain does not store 6 any data at its California office, including any data associated with Mr. Lee or CareSouth.” 7 ECF No. 12 at 10. In support of this argument, Netgain attaches a declaration by its Vice 8 President of Finance stating: (1) “Netgain has a satellite office in San Diego;” (2) “Netgain 9 does not store any customers’ personal information data at its California office, including 10 any data associated with Plaintiff . . . . or . . . . CareSouth;” and (3) “Netgain’s California 11 office is staffed by only a few employees who are responsible for IT services for customers 12 not including CareSouth.” ECF No. 12-1 at 4–6. 13 By opening an office and data center in San Diego, Netgain performed an actual, 14 physical act in the real world that was aimed at California. In operating the San Diego 15 office day-to-day, Netgain also presumably performs acts aimed at California. However, 16 17 4 Plaintiff states “[t]he legal standard governing a motion to dismiss for lack of personal 18 jurisdiction permits the Court to consider relevant materials outside the pleadings without 19 taking judicial notice of those materials.” ECF No. 14 at 5 n.1 (citing Diaimler AG v. Bauman, 134 S. Ct. 746, 752 (2014). Although Netgain does not dispute the information 20 on its website, to the extent Plaintiff requests the Court take judicial notice of Netgain’s 21 website, the request is GRANTED. See Allphin v. Peter K. Fitness, LLC, No. 13-cv-01338- BLF, 2014 WL 6997653, at *3 (N.D. Cal. Dec. 11, 2014) (“Courts have taken judicial 22 notice of the websites of parties to the litigation when determining personal jurisdiction.”). 23 5 Netgain argues the correct test is purposeful direction “because [Plaintiff’s] claims sound 24 in tort, not contract.” ECF No. 15 at 3. As noted above, however, in addition to claims for 25 negligence, invasion of privacy, and South Carolina state statutory claims, Plaintiff brings claims for breach of contract under a third party beneficiary theory, breach of implied 26 contract, and bad faith. Netgain does not explain, nor is it apparent, why these claims sound 27 in tort but not contract. See Baton v. Ledger SAS, No. 21-cv-02470-EMC, 2021 WL 5226315, at *5 (N.D. Cal. Nov. 9, 2021) (applying purposeful direction test data breach 28 1 Plaintiff does not identify an actual, physical act in the real world that Netgain did that 2 caused the data breach. The gravamen of Plaintiff’s claims is that Netgain failed, by taking 3 no action or insufficient action, to secure CareSouth patients’ PMI. The act of opening and 4 operating a San Diego office does not, without more, constitute wrongful conduct, or 5 conduct targeted at a plaintiff whom Netgain knew was a California resident.6 See Calder 6 v. Jones, 465 U.S. 789 (1984) (“mere untargeted negligence” does not support personal 7 jurisdiction). 8 Plaintiff also does not allege or show, that by operating the San Diego office, Netgain 9 caused the data breach, or that Netgain knew that by operating the San Diego office the 10 data breach would likely occur. While Plaintiff alleges that after the data breach CareSouth 11 “began filing” sample data security incident letters with various state Attorneys General, 12 including California’s, that mirrored the language of the notice sent to Plaintiff, see Compl. 13 ¶ 31, Plaintiff does not allege, or provide any evidence supporting, that any such notices 14 were actually sent to a person in California. In data breach cases, courts have found that 15 decisions by out-of-state companies regarding data breach notifications in California 16 presumably occur at the company’s headquarters. In Baton, for example, the court found 17 “[t]here are no facts alleged that [defendant] made its decision regarding notification in 18 California or that it specifically targeted California in its decision not to provide 19 communications about the breach, nor do any facts presented by Plaintiffs suggest that 20 California-residents were uniquely harmed or entitled to a warning about the breach more 21 than anyone else affected by the breach residing in any other jurisdiction.” 2021 WL 22 5226315, at *7; see also Caces-Tiamson v. Equifax, No. 20-cv-00387-EMC, 2020 WL 23 1322889, at *3 (N.D. Cal. Mar. 20, 2020) (declining to find specific jurisdiction because 24 25 6 Even if Plaintiff was a resident of California and suffered harm in California, that fact 26 alone would not be enough for specific jurisdiction. See Patao v. Equifax, Inc., No. CV 19- 27 00677 JMS-WRP, 2020 WL 5033561, at *4 (D. Haw. Aug. 25, 2020) (alleging that data breach caused plaintiff to suffer harm in forum state is “insufficient to establish specific 28 1 actions defendant did or did not take with respect to its data security systems would 2 presumably have occurred where it had its principal place of business, even where the 3 plaintiff resided in California); Tiamson v. Equifax, Inc., No. 19-CV-08430-LHK, 2020 4 WL 3972582, at *6 (N.D. Cal. July 14, 2020) (applying Caces-Tiamson’s reasoning that 5 specific jurisdiction does not exist where the plaintiff did not show that the data breach, or 6 the failure to prevent the data breach, was “tied to” California). 7 Moreover, as discussed below, Plaintiff essentially admits in his request for 8 jurisdictional discovery that he does not know whether the data breach originated in 9 California due to the acts or omissions of the San Diego office, or whether the San Diego 10 office had any control of Plaintiff’s or CareSouth’s data. See Baton, 2021 WL 5226315, at 11 *6–7 (finding lack of specific jurisdiction where there was no evidence by declaration or 12 elsewhere that the defendant “reposited” the plaintiff’s data in California, and where the 13 plaintiff did not allege that the defendant permitted customer data to be accessible to, and 14 accessed by, anyone in California). As is the case for decisions regarding breach 15 notifications, it is not reasonable to infer that decisions regarding data security, especially 16 CareSouth’s data security, were made in California. Accordingly, Plaintiff has not made a 17 prima facie showing of purposeful direction. 18 2. Purposeful Availment 19 “A showing that a defendant purposefully availed himself of the privilege of doing 20 business in a forum state typically consists of evidence of the defendant’s actions in the 21 forum, such as executing or performing a contract there.” Schwarzenegger, 374 F.3d at 22 802. Instructive factors include: (1) prior negotiations; (2) contemplated future 23 consequences; (3) the terms of the contract at issue; and (4) the parties’ actual course of 24 dealing. Burger King, 471 U.S. at 479. The analysis involves a “qualitative evaluation of 25 the defendant’s contact with the forum state.” Harris Rutsky & Co. Ins. Servs., Inc. v. Bell 26 & Clements Ltd., 328 F.3d 1122, 1130 (9th Cir. 2003). Direct solicitation of business in 27 the forum state, and conducting negotiations in the forum state, are “particularly 28 persuasive” under the purposeful availment test. Decker Coal Co. v. Commonwealth 1 Edison Co., 805 F.2d 834, 840 (9th Cir. 1986). The substantiality of the effect in the forum 2 state may be considered. See, e.g., Haisten v. Grass Valley Med. Reimburs. Fund, Ltd., 784 3 F.2d 1392, 1398 (9th Cir. 1986). 4 By operating an office in San Diego, Netgain has purposefully availed itself of the 5 privilege of doing business in California. See Jeong v. Nexo Fin. LLC, No. 21-cv-02392- 6 BLF, 2022 WL 174236, at *10 (N.D. Cal. Jan. 19, 2022) (uncontradicted allegation that 7 defendant operated a branch of its business in California is sufficient to find purposeful 8 availment). In his opposition, however, Plaintiff does not recognize: (1) the distinction 9 between purposeful direction and availment; (2) that each test typically applies to different 10 types of claims; or (3) that Plaintiff’s claims appear to sound in both tort and contract. 11 Moreover, Plaintiff does not allege that he directly contracted with Netgain. See Toretto v. 12 Mediant Commc’ns, Inc., No. 19-cv-05208-EMC, 2020 WL 1288478, at *4 (N.D. Cal. 13 Mar. 18, 2020) (finding lack of purposeful availment in data breach case where the 14 defendant did not have a “direct contractual relationship with any of the . . . . businesses 15 involved in the breach” and “no direct contractual relationship with any of the . . . . breach- 16 affected companies located in California”). Nonetheless, to the extent Plaintiff argues that 17 Netgain has purposefully availed itself, Plaintiff has made a prima facie showing of 18 purposeful availment, but only with respect to his contract-based claims. 19 3. Relatedness 20 To demonstrate that its claims “arise out” of forum-related activities, Plaintiff must 21 show that he would not have suffered an injury “but for” Netgain’s “forum related 22 conduct.” Myers v. Bennett L. Offs., 238 F.3d 1068, 1075 (9th Cir. 2001). Plaintiff argues 23 he has made his prima facie case for relatedness because (1) “Netgain staffs its California 24 office with IT personnel providing IT services for multiple customers, including California 25 healthcare providers impacted by the same Data Breach that impacted Lee and the 26 Nationwide Class Members,” and (2) Plaintiff “alleges that it was due to these very IT 27 services, including Defendant’s negligence and data security failures provided to its 28 customers nationwide (including out of its California office), that the Data Breach 1 occurred.” ECF No. 14 at 6. 2 As noted above, however, Plaintiff acknowledges that he does not know whether the 3 data breach occurred but for the acts or omissions of Netgain in, or directed at, California. 4 Moreover, Plaintiff’s argument does not match his allegations. In support of his argument, 5 Plaintiff cites paragraph 11 of his Complaint, in which he alleges “[d]ue to Defendants’ 6 negligence and data security failures, cyber criminals obtained and now possess everything 7 they need to commit personal and medical identity theft and wreak havoc on the financial 8 and personal lives of hundreds of thousands of individuals for decades to come.” Plaintiff 9 also cites paragraph 74, in which he alleges that Netgain owed various duties of care 10 regarding the safekeeping of Plaintiff’s PMI. Neither of these paragraphs suggests the data 11 breach would not have occurred but for the acts or omission of Netgain vis-à-vis its 12 activities in, or directed at, California. See Toretto, 2020 WL 1288478, at *5 (finding lack 13 of specific jurisdiction in data breach case because “it is not at all evident that, absent 14 [defendant’s] contractual agreements to provide services to California entities, Plaintiffs’ 15 claims would not have arisen”). Accordingly, Plaintiff has not made a prima facie showing 16 of relatedness. 17 4. Reasonableness 18 Because Plaintiff cannot satisfy the first two elements of the specific jurisdiction 19 test, the burden does not shift to Netgain to show that jurisdiction would be unreasonable. 20 See, e.g., Willis v. Princess Cruise Lines, No. 2:19-cv-06278-SVW-FFM, 2020 WL 21 5353984, at *6 (C.D. Cal. May 29, 2020). Assuming Plaintiff had shown purposeful 22 direction and relatedness, most of the reasonableness factors would likely weigh in favor 23 of declining specific jurisdiction over Netgain. The Ninth Circuit applies a seven-part 24 balancing test to determine whether a case satisfies the “fair play and substantial justice” 25 element: 26 (1) the extent of the defendants’ purposeful injection into the forum state’s affairs; (2) the burden on the defendant of defending in the forum; (3) the 27 extent of conflict with the sovereignty of the defendant’s state; (4) the forum 28 state’s interest in adjudicating the dispute; (5) the most efficient judicial 1 resolution of the controversy; (6) the importance of the forum to the plaintiff’s interest in convenient and effective relief; and (7) the existence of an 2 alternative forum. 3 4 Dole, 303 F.3d at 1114. 5 By allegedly failing to protect CareSouth’s patients’ PMI, the extent of Netgain’s 6 purposeful injection into California’s affairs is minimal. There is no allegation or evidence, 7 for example, that Netgain had reason to believe CareSouth’s patients, or former patients, 8 were in California. It also seems burdensome that Netgain would have to defend against 9 claims related to a data breach in any state where it had employees, regardless of whether 10 the data breach was in any way linked to that state. Furthermore, California’s interest in 11 adjudicating this dispute is not strong given that Plaintiff is from South Carolina, his claims 12 arise mostly, if not entirely,7 under South Carolina law, and arise from a data breach of a 13 Minnesota company that possessed South Carolina patients’ PMI. South Carolina or 14 Minnesota would clearly be more efficient and important alternative forums for resolving 15 this controversy.8 16 B. Jurisdictional Discovery 17 Finally, Plaintiff argues that “[i]f the Court requires a further factual showing that 18 the Data Breach would not have occurred but for Netgain’s conduct in the forum state, then 19 it should permit limited discovery on these narrow issues prior to a preliminary hearing.” 20 ECF No. 14 at 9. “[W]here pertinent facts bearing on the question of jurisdiction are in 21 dispute, discovery should be allowed.” Am. W. Airlines, Inc. v. GPA Grp., Ltd., 877 F.2d 22 793, 801 (9th Cir. 1989). A district court has the discretion to permit or deny jurisdictional 23 discovery. Boschetto v. Hansing, 539 F.3d 1011, 1020 (9th Cir. 2008). A court may deny 24 25 7 Plaintiff does not specify which state’s law applies to his common law claims. 26

27 8 Netgain states that it is the defendant “in a consolidated action in Minnesota alleging putative classes that if certified would include his claims and the classes he purports to 28 1 a request to conduct jurisdictional discovery if “a plaintiff’s claim of personal jurisdiction 2 appears to be both attenuated and based on bare allegations in the face of specific denials 3 made by the defendants,” Caddy, 453 F.3d at 1160, or “it is clear that further discovery 4 would not demonstrate facts sufficient to constitute a basis for jurisdiction,” Laub v. U.S. 5 Dep’t of Interior, 342 F.3d 1080, 1093 (9th Cir. 2003) (quotation marks omitted). Plaintiff 6 is required to establish a “colorable basis” for personal jurisdiction before a court grants 7 jurisdictional discovery. See Mitan v. Feeney, 497 F. Supp. 2d 1113, 1119 (C.D. Cal. 2007). 8 “This ‘colorable’ showing should be understood as something less than a prima facie 9 showing, and could be equated as requiring the plaintiff to come forward with ‘some 10 evidence’ tending to establish personal jurisdiction over the defendant.” Id. (citations 11 omitted). 12 In support of his request for jurisdictional discovery, Plaintiff essentially argues that 13 jurisdictional discovery might reveal that: (1) the data breach originated in California due 14 to acts and omissions in the San Diego office; (2) the system’s “weak point” was in the San 15 Diego office; (3) Netgain’s negligence and data security failures were “nationwide;” 9 (4) 16 the San Diego office possessed or controlled the compromised PMI; and (5) the San Diego 17 office was responsible for Plaintiff’s or other class members’ PMI. ECF No. 14 at 8–9. 18 “Such an approach smacks of a fishing expedition – in other words, it appears that Plaintiff 19 is seeking jurisdictional discovery based on a mere ‘hunch,’ which courts have found to be 20 insufficient.” Jeong, 2022 WL 174236, at *16 (citing Boschetto, 539 F.3d at 1020). As 21 noted above, Plaintiff provides no actual evidence that the data breach occurred in 22 California or affected persons in California. As also noted above, Plaintiff does not argue 23 or allege that any breach notification letters were sent to anyone in California. Plaintiff’s 24 only allegation specifically related to personal jurisdiction is that Netgain “conducts much 25

26 27 9 It is not clear that a “nationwide” security failure would confer specific jurisdiction. See Caces-Tiamson, 2020 WL 1322889, at *3 (“Nor can specific jurisdiction be based on the 28 1 || of its business in” California. Compl. ¥ 28. 2 Overall, Plaintiff's request for jurisdictional discovery is not based on evidence that 3 ||the evidence presented by Netgain is false or inaccurate. Accordingly, Plaintiffs request 4 || for jurisdictional discovery is based on speculation, and Plaintiff has therefore not met his 5 || burden of showing some evidence of personal jurisdiction. See Baton, 2021 WL 5226315, 6 *14. Additionally, because jurisdictional discovery is unwarranted, it would be futile for 7 || Plaintiff to attempt to amend his Complaint to assert specific jurisdiction. See id. 8 IV. CONCLUSION 9 For the foregoing reasons, Netgain’s motion to dismiss for lack of personal 10 jurisdiction [ECF No. 12] is GRANTED. Plaintiff's Complaint is DISMISSED with 11 || prejudice and without leave to amend. Plaintiff’s request for jurisdictional discovery 1s 12 DENIED. This order is not intended to preclude Plaintiff from pursuing his claim in 13 || another state or joining a pending claim in another state. 14 IT IS SO ORDERED. 15 || Dated: April 1, 2022 NO 16 Qe | 17 Honorable Linda Lopez ig United States District Judge 19 20 21 22 23 24 25 26 27 28

12