govinfo:USCOURTS-casd-3_25-md-03149-1

-1- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
 
 
 
 
 
 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF CALIFORNIA 
 
IN RE: POWERSCHOOL 
HOLDINGS, INC. AND 
POWERSCHOOL GROUP, LLC 
CUSTOMER SECURITY BREACH 
LITIGATION. 
) 
) 
) 
) 
) 
) 
) 
) 

 
ORDER GRANTING IN PART AND 
DENYING IN PART DEFENDANT 
BAIN CAPITAL’S MOTION TO 
DISMISS (TRACK 1) 
 
[Dkt. 286] 
 
I. INTRODUCTION 
This multidistrict litigation arises from a data breach involving Defendants 
PowerSchool Holdings, Inc. and PowerSchool Group, LLC (collectively, 
“PowerSchool”). PowerSchool provides cloud-based data management software for 
students and educators for K-12 students and educators and stores sensitive student 
medical, academic, and other personally identifiable information in a searchable format. 
Defendant Bain Capital (“Bain”) is an investment firm that acquired a 51-percent 
majority ownership stake in PowerSchool. Plaintiffs allege that Bain implemented data-
management changes that compromised cybersecurity protections, contributing to a 
breach that exposed the personal information of approximately 50 million individuals. 
Bain moves to dismiss all claims against it. For the reasons set forth below, the 
Court GRANTS IN PART and DENIES IN PART Bain’s motion. 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 1 of 29
 
-2- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
II. BACKGROUND1 
Bain initiated merger and acquisition discussions with PowerSchool, a 
Sacramento-based provider of educational software, in August 2022. See Consolidated 
Individual Users Class Action Complaint, Dkt. 259 (“MC”) at ¶¶ 14, 50, 71. Schools 
and school-district customers provide PowerSchool with sensitive personally identifiable 
information (“PII”), which PowerSchool stores and maintains. (Id. ¶¶ 54, 56, 897.) 
In early 2024, during merger negotiations, PowerSchool announced plans to 
offshore its cybersecurity and IT functions. (Id. ¶¶ 72–74, 80, 90.) In January 2024, 
under Bain’s direction, the company expanded its cybersecurity operations to India. (Id. 
¶ 73.) By March 2024, PowerSchool began reducing its workforce. (Id. ¶¶ 73–74, 81–
84, 101–02.) 
On June 6, 2024, Bain agreed to acquire majority ownership of PowerSchool. The 
Merger Agreement granted Bain contractual consent rights over capital expenditures 
exceeding $5 million, material vendor contracts, and major workforce changes. (Id. ¶¶ 
852–86.) The agreement recognized data security as a material aspect of PowerSchool’s 
business, included data-protection obligations, and stated that neither party controlled the 
other’s operations before closing. (Id. ¶¶ 96–98.) 
Unauthorized system access began in August 2024, and data exfiltration occurred 
on September 4, 2024. (Id. ¶¶ 125, 134, 136.) The merger closed on October 1, 2024, 
 
1 See Retail Prop. Trust v. United Bhd. Of Carpenters & Joiners of Am., 768 F.3d 938, 945 (9th Cir. 
2014), the following facts are drawn from the Consolidated Master Complaint (“MC”) (Dkt. 259) and 
are accepted as true for purposes of this motion. 
2 “Bain’s strategic discussions and business planning with PowerSchool culminated in a Merger 
Agreement signed on June 6, 2024. From that point forward, PowerSchool was required to consult Bain 
Capital prior to making any changes to operational, cybersecurity, and financial decisions, such as 
restrictions on hiring, engaging, or terminating any ‘current or former director, officer, employee, or 
individual independent contractor’ above a certain base compensation, as well as restriction on incurring 
capital expenses above a certain amount. Furthermore, Bain secured veto rights before the merger 
officially closed on October 1, 2024, granting Bain strategic control over PowerSchool’s key decisions 
months in advance. As a result, Bain began shaping the company’s operations longer before December 
2024 data breach. . . .” 
 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 2 of 29
 
-3- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
when Bain replaced PowerSchool’s board and assumed operational control. (Id. ¶¶ 85, 
91–92.) 
Following the acquisition, Bain directed PowerSchool to offshore cybersecurity, 
engineering, and IT functions to contractors, including Movate. (Id. ¶¶ 79–80, 106, 108, 
110, 163.) This offshoring required data-management tools that enabled vendors to 
bypass consent protocols and access protected school district computers directly. (Id. ¶¶ 
197, 201, 998.) 
On December 20, 2024, the criminal group ShinyHunters used stolen Movate 
employee credentials to access PowerSchool’s student information system through its 
PowerSource portal. (Id. ¶¶ 10, 21, 25, 127.) PowerSchool discovered the breach on 
December 28, 2024, and notified customers on January 7, 2025. (Id. ¶¶ 122–23.) The 
breach compromised approximately 50 million individuals’ data, including social security 
numbers, medical information, financial information, addresses, disability records, and 
custody information. (Id. ¶¶ 1–2, 10, 122–23, 143, 197, 998.) 
III. APPLICABLE LAW 
To survive a motion to dismiss, a complaint “must contain sufficient factual 
matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft 
v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 
570 (2007)). A claim has facial plausibility when the plaintiff pleads “factual content 
that allows the court to draw the reasonable inference that the defendant is liable for the 
misconduct alleged.” Iqbal, 556 U.S. at 678. If the plaintiff’s explanation is plausible, 
the complaint survives a motion to dismiss under Rule 12(b)(6), regardless of whether 
there is a more plausible alternative explanation. Id. 3 Thus, a “Rule 12(b)(6) motion 
tests the sufficiency of a complaint; it does not . . . resolve contests surrounding the facts, 
the merits of the claim, or the applicability of defenses.” W. Ins. Co. v. Frontier Homes, 
 
33 Twombly, 550 U.S. at 556 (“[A] well-pleaded complaint may proceed even if it strikes a savvy judge 
that actual proof of those facts is improbable, and that a recovery is very remote and unlikely.”) 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 3 of 29
 
-4- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
LLC, No. EDCV 17-2181-R 2018 WL 8220544, at *2 (C.D. Cal. Mar. 27, 2018) (quoting 
King v. Rubenstein, 825 F.3d 206, 214 (4th Cir. 2016)). Rule 9(b) requires fraud or 
mistake claims to be pleaded “with particularity,” including statutory consumer 
protection claims based on alleged deception. Kearns v. Ford Motor Co., 567 F.3d 1120, 
1125–26 (9th Cir. 2009). 
Plaintiffs contend that determining the applicable is premature at this stage, as it 
requires a detailed analysis that is more appropriate for later stages of litigation when 
both parties can present relevant evidence. In re Accellion, Inc. Data Breach Litig., No. 
21-cv-01155-EJD 2024 WL 4592367, at *2 (N.D. Cal. Oct. 28, 2024). 
IV. DISCUSSION 
Bain seeks dismissal on multiple grounds: lack of Article III standing, lack of 
personal jurisdiction, and failure to state a claim under Rule 12(b)(6). The Court 
addresses each in turn. 
A. Article III Standing 
Bain Capital urges dismissal asserting that the plaintiffs lack Article III standing. 
“[T]hose who seek to invoke the jurisdiction of the federal courts must satisfy the 
threshhold [sic] requirement imposed by Article III of the Constitution by alleging an 
actual case or controversy.” City of Los Angeles v. Lyons, 461 U.S. 95, 101 (1983). 
Article III standing requires plausible allegations that: (1) the plaintiff suffered an injury 
in fact that is concrete, particularized, and actual or imminent; (2) the injury is fairly 
traceable to the defendant; and (3) a favorable decision would likely redress the injury. 
TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021); Friends of the Earth, Inc. v. 
Laidlaw Env’t Servs., Inc., 528 U.S. 167, 180–81 (2000). 
 Both sides agree this is the standard. Instead, the parties disagree about the nature 
and qualities of an injury-in-fact in a data breach case and what court decisions guide the 
decision-making. These issues are discussed and addressed at length in the companion 
Order deciding Powerschool Holdings, Inc.’s and Powerschool Group, LLC’s Motion to 
Dismiss and that reasoning is adopted here. Consistent therewith, Plaintiffs have at this 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 4 of 29
 
-5- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
point in the litigation plausibly alleged facts demonstrating all of the standing 
requirements of Article III and compensable damages to proceed to class certification and 
summary judgment. 
B. Personal Jurisdiction Over Bain 
Bain moves to dismiss for lack of personal jurisdiction, arguing that Plaintiffs fail 
to allege sufficient minimum contacts with California. The Court holds that it may 
exercise specific personal jurisdiction over Bain. 
Courts in the Ninth Circuit evaluate three factors when determining whether to 
exercise specific personal jurisdiction: 
(1) whether [the defendant] has either purposefully (a) directed its 
activities towards California or initiated a transaction with a California 
resident or (b) availed itself of the privileges and benefits of California 
permitting it to benefit from the protections of California laws; (2) whether 
[plaintiff’s] claims arise out of [defendant’s] activities related to California; 
and (3) whether the assertion of jurisdiction by the [district court] is 
reasonable and comports with fair play and substantial justice. 
 
Glob’l Commodities Trading Grp., Inc. v. Beneficio de Arroz Choloma, S.A., 972 F.3d 
1101, 1107 (9th Cir. 2020). The Court addresses each factor below, preceded by a 
threshold question concerning the non-California transferor courts. 
1. Non-California Transferor Courts 
Bain argues that Plaintiffs have failed to establish personal jurisdiction in the non-
California transferor courts from which actions were transferred to this MDL. In MDL 
proceedings, personal jurisdiction over a defendant “must exist in the district where [the 
action] is filed” because the transferee court’s jurisdiction derives from and is 
coextensive with that of the transferor courts. In re Delta Dental Antitrust Litig., 509 F. 
Supp. 3d 1377, 1379–80 (J.P.M.L. 2020). The Complaint contains no allegations that 
Bain has independent minimum contacts with Connecticut, Illinois, Michigan, 
Minnesota, Missouri, New York, or North Carolina. 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 5 of 29
 
-6- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Plaintiffs respond by alleging that PowerSchool acted as Bain’s agent, whose 
contacts may be imputed to Bain. (Dkt. 259 ¶¶ 38, 40.) Under Ninth Circuit law, 
“[w]here one corporation is controlled by another, the former acts not for itself but as 
directed by the latter, the same as an agent, and the principal is liable for the acts of its 
agent within the scope of the agent’s authority.” Pac. Can Co. v. Hewes, 95 F.2d 42, 46 
(9th Cir. 1938). While “[t]he existence of a parent-subsidiary relationship is insufficient, 
on its own, to justify imputing one entity’s contacts with a forum state to another for the 
purpose of establishing personal jurisdiction,” contacts may be imputed where a true 
agency relationship is established. Ranza v. Nike, Inc., 793 F.3d 1059, 1070 (9th Cir. 
2015). 
As discussed infra., the Court holds that Plaintiffs have adequately alleged an 
agency relationship between Bain and PowerSchool at the pleading stage. The complaint 
alleges that Bain exercised control over PowerSchool’s key strategic decisions—
including cybersecurity operations, workforce decisions, and capital expenditures—both 
before and after the merger closed. (Dkt. 259 ¶¶ 38, 40, 73, 85-86, 90, 103-08.) 
PowerSchool, as “the leading provider of cloud-based software for K-12 education in the 
United States” serving over 18,000 customers across North American (Id. at ¶¶ 49–58), 
has substantial contacts with each of the non-California transferor states. Taking 
Plaintiffs’ agency allegations as true, as the Court does at this stage, PowerSchool’s 
contacts with the transferor states may be imputed to Bain for jurisdictional purposes. 
See Ranza, 793 F.3d at 1070-71. 
Bain’s motion to dismiss for lack of personal jurisdiction as to Plaintiffs who filed 
in non-California transferor courts is DENIED. 
2. Purposeful Availment 
Plaintiffs allege that Bain purposefully directed its activities toward California and 
availed itself of the benefits and protections of California law. The allegations support 
this conclusion on two independent grounds: merger-related contacts and operational 
control. 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 6 of 29
 
-7- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Merger Contacts. Bain approached PowerSchool— a California-headquartered 
company—about a business merger in August 2022. (Dkt. 259 at ¶ 14.) Negotiations 
intensified in early 2024 and continued for four months, culminating in the June 6, 2024, 
execution of the Merger Agreement. (Id. ¶¶ 71, 85.) These negotiations involved 
multiple meetings and communications, at least some of which occurred in California, as 
described in PowerSchool’s preliminary proxy statement incorporated by reference into 
the Complaint.
4 
Operational Control. Beyond the merger negotiations, Plaintiffs allege that Bain 
directed activities to California by exerting control over PowerSchool’s operations. In 
January 2024, Bain directed PowerSchool’s operations to expand outsourcing to India 
and implement cost-cutting measures affecting cybersecurity staff, including layoffs as 
part of its offshore expansion. (Dkt. 259 ¶¶ 73, 81, 101–08.) In October 2024, 
immediately after the merger closed, Bain replaced PowerSchool’s entire board of 
directors. (Id. ¶ 91.) Throughout this period, Bain failed to assess the data-breach risks 
associated with the offshore expansion it was directing. (Id. ¶ 99.) As the Supreme 
Court has held, “a corporation can purposefully avail itself of a forum by directing its 
agents or distributors to take action there.” Daimler AG v. Bauman, 571 U.S. 117, 135 
n.13 (2014). That is what Plaintiffs allege here. 
Bain contends that it cannot be subject to jurisdiction based on conduct predating 
its October 1, 2024, acquisition. This argument fails for two reasons. First, purposeful 
availment does not require formal ownership; it requires purposeful direction of activities 
toward the forum. See Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 
(9th Cir. 2004). Bain’s two-year course of merger negotiations with a California-
headquartered company, culminating in the June 6, 2024, Merger Agreement, constitutes 
purposeful direction toward California irrespective of when formal ownership transferred. 
 
4 See Id. ¶ 14 & n.38 (citing PowerSchool’s July 23, 2024, preliminary proxy statement.) 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 7 of 29
 
-8- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Second, Plaintiffs allege that the Merger Agreement granted Bain “de facto operational 
control” over PowerSchool during the interim period, including consent rights over 
capital expenditures, material vendor contracts, and headcount changes. (Dkt. 259 ¶¶ 85–
86.) These contractual rights—exercised over a California company —further support 
purposeful availment independently. Moreover, while unauthorized data access may 
have first occurred in August 2024, the Data Breach continued through December 2024, 
after Bain’s acquisition closed. (MC ¶¶ 125, 134–35.) Bain’s post-acquisition conduct in 
California thus independently supports jurisdiction. 
Bain’s reliance on Williams v. Yamaha Motor Co., 851 F.3d 1015 (9th Cir. 2017), 
is misplaced. In Williams, the plaintiff relied solely on the subsidiary’s activities to 
establish jurisdiction over the parent company. (Id. at 1022–25.) Here, by contrast, 
Plaintiffs allege Bain’s own California-related activities: conducting merger negotiations 
with a California-based company, obtaining contractual control rights over that company 
during the interim period, and exerting control over that company’s California operations 
after the acquisition closed. Plaintiffs have adequately alleged purposeful availment. 
3. Relatedness 
Courts in the Ninth Circuit apply a “but for” test to determine whether claims arise 
out of forum-related activities. Ballard v. Savage, 65 F.3d 1495, 1500 (9th Cir. 1995). 
Under this test, “any event in the causal chain leading to the plaintiff’s injury is 
sufficiently related to the claim to support the exercise of specific jurisdiction.” 
Dudnikov v. Chalk & Vermilion Fine Arts, Inc., 514 F.3d 1063, 1078 (10th Cir. 2008); 
accord Menken v. Emm, 503 F.3d 1050, 1058 (9th Cir. 2007). 
Bain argues that its merger negotiations are too attenuated from a cyberattack 
perpetrated by third-party hackers to satisfy the relatedness requirement. The Court 
disagrees. The Ninth Circuit’s “but for” test is deliberately broad, requiring only that the 
claim would not have arisen “but for” the defendant’s forum contacts. Ballard, 65 F.3d 
at 1500. Plaintiffs do not allege that Bain committed the cyberattack. Rather, they allege 
that Bain’s California-directed decisions— including directing PowerSchool to offshore 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 8 of 29
 
-9- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
cybersecurity functions, implementing cost-cutting measures that reduced IT staff, and 
failing to assess data-breach risks—created the vulnerabilities that the hackers exploited. 
(Dkt. 259 ¶¶ 73, 81, 99, 101–15.) These decisions that Plaintiffs allege made the Data 
Breach possible. The intervening criminal act does not break the causal chain for 
purposes of specific jurisdiction when the defendant’s own form-directed conduct created 
the conditions that the third party exploited.5 See Dudnikov, 514 F.3d at 1078. 
Bain’s reliance on Walsh v. LG Chem Ltd., 834 Fed. App’x 310 (9th Cir. 2020), is 
unavailing. In Walsh, the plaintiff alleged only that the defendant marketed its product in 
the United States generally—not in the forum state —and the court accordingly found no 
“direct nexus between his injuries and [defendant’s] purported [forum] contacts.” Id. at 
311–12. Here, Plaintiffs allege specific, California-directed conduct by Bain that 
weakened PowerSchool’s data security and proximately caused the Data Breach. The 
distinction is dispositive. 
4. Reasonableness 
Once purposeful availment and relatedness have been established, the forum’s 
exercise of jurisdiction is presumptively reasonable, and the burden shifts to the 
defendant to “present a compelling case that the exercise of jurisdiction would not be 
reasonable.” Schwarzenegger, 374 F.3d at 802. Courts consider seven factors: 
(1) the extent of the defendants’ purposeful interjection into the forum state’s 
affairs; (2) the burden on the defendant of defending in the forum; (3) the 
extent of conflict with the sovereignty of the defendants’ state; (4) the 
forum state’s interest in adj udicating the dispute; (5) the most efficient 
judicial resolution of the controversy; (6) the importance of the forum to 
the plaintiff’s interest in convenient and effective relief; and (7) the 
existence of an alternative forum. 
Core-Vent Corp. v. Nobel Indus. AB, 11 F.3d 1482, 1487–88 (9th Cir. 1993). 
 
5 Dudnikov v. Chalk & Vermilion Fine Arts, 514 F.3d 1063, 1078 (10th Cir. 2008)(citing Mattel, Inc. v. 
Greiner and Hausser GmbH, 354 F.3d 857,864 (9th Cir. 2003)) (“any event in the causal chain leading 
to the plaintiff’s injury is sufficiently related to the claim to support the exercise of specific 
jurisdiction.”); see also, e.g., In re ZF-TRW Airbag Control Units Prods. Liab. Litig., 601 F. Supp. 3d 
625, 702 (C.D. Cal. 2022) (“‘[C]ourts must give real consideration to claims that “relate to” the 
defendant’s forum contacts,’ even if those contacts are not the ‘but for’ cause of the dispute.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 9 of 29
 
-10- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Bain has not met its burden. The Court considers each factor. 
Purposeful Interjection. Bain’s interjection into California is extensive: it 
negotiated a multi-billion-dollar acquisition of a California-headquartered company over 
two years, obtained contractual control rights during the interim period, and directed that 
company’s operations after closing. This factor weighs in favor of jurisdiction. 
Burden on Defendant. A defendant asserting that litigation in the forum would 
be burdensome must offer more than conclusory assertions. Bain states that its burden is 
“high” but identifies no supporting facts. Bain is a sophisticated investment firm 
managing $185 billion in assets with counsel admitted in this district. (Dkt. 256 ¶¶ 66–
70.) This factor weighs in favor of jurisdiction. 
Sovereignty Conflict. Bain fails to demonstrate how litigating in California 
would conflict with the sovereignty of Massachusetts or Delaware, its state of 
incorporation. This factor is neutral. 
Forum State Interest. California’s interest in this litigation is substantial: 
PowerSchool is headquartered here, California residents’ data was compromised, and 
California Plaintiffs seek relief under California law. This factor weighs in favor of 
jurisdiction. 
Efficient Resolution. The JPML’s consolidation of this MDL in this District 
confirms that California promotes efficient judicial resolution. See In re PowerSch. 
Holdings, Inc., 780 F. Supp. 3d 1352, 1355 (J.P.M.L. 2025).
6 This factor weighs in favor 
of jurisdiction. 
Convenient and Effective Relief. California is important to Plaintiffs’ interests 
because PowerSchool is headquartered here and relevant documents and witnesses are 
likely located here. This factor weighs in favor of jurisdiction. 
 
6 Id. (“Centralization in [the Southern District of California] encourages the efficient coordination of 
state and federal proceedings.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 10 of 29
 
-11- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Alternative Forum. While Massachusetts or Delaware might serve as alternative 
forums, the existence of an alternative forum does not render California unreasonable 
when all other factors support jurisdiction. This factor is neutral at best for Bain. 
Six of the seven factors weigh in favor of exercising jurisdiction. Bain has not 
presented a “compelling case” that jurisdiction would be unreasonable.7 
Bain’s motion to dismiss for lack of personal jurisdiction is DENIED. 
C. Theories of Liability 
Before turning to Plaintiffs’ substantive claims, the Court addresses the three 
theories of liability that Plaintiffs assert against Bain— agency, direct liability, and aiding 
and abetting— because these theories underpin several of the claims analyzed below.8, 9 
1. Agency Liability 
Ninth Circuit courts apply common law agency principles from the Restatement 
(Third) of Agency. See Mavrix Photographs, LLC v. LiveJournal, Inc., 873 F.3d 1045, 
1054 (9th Cir. 2017). An actual agency relationship requires “(1) a manifestation by the 
principal that the agent shall act for him; (2) that the agent has accepted the undertaking; 
and (3) that there is an understanding between the parties that the principal is to be in 
control of the undertaking.” Sun Microsystems Inc. v. Hynix Semiconductor Inc., 622 F. 
Supp. 2d 890, 899 (N.D. Cal. 2009); See also Restatement (Third) of Agency § 1.01. 
When assessing whether a principal has sufficient authority to control an agent’s 
actions, the Ninth Circuit considers the following non-exhaustive factors: 
1) the control exerted by the employer, 2) whether the one employed is 
engaged in a distinct occupation, 3) whether the work is normally done 
under the supervision of an employer, 4) the skill required, 5) whether the 
 
7 See Schwarzenegger, 374 F.3d at 802 “If the plaintiff succeeds in satisfying both of the first two 
prongs, the burden then shifts to the defendant to ‘present a compelling case’ that the exercise of 
jurisdiction would not be reasonable.” 
8The theories of liability discussed here also inform the personal jurisdiction analysis in Part IV.B.1, as 
well as the negligence, CCPA, UCL, and unjust-enrichment claims addressed in Parts IV.D—G 
9 (See Opp. at 15; Reply at 4.) Plaintiffs originally alleged alter ego liability against Bain but have since 
abandoned that theory. The Court therefore does not address alter ego. 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 11 of 29
 
-12- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
employer supplies tools and instrumentalities, 6) the length of time 
employed, 7) whether payment is by time or by the job, 8) whether the work 
is in the regular business of the employer, 9) the subjective intent of the 
parties, and 10) whether the employer is or is not in business. 
United States v. Bonds, 608 F.3d 495, 504 (9th Cir. 2010); see also Restatement 
(Third) of Agency § 7.07(f). 
Here, Plaintiffs allege that Bain “ratified and conditioned its offer on cost reduction 
measures” and PowerSchool assented by agreeing to these measures. (Dkt. 259 at ¶¶ 73, 
80, 90.) Bain obtained “strategic control over PowerSchool’s key decisions” through the 
Merger Agreement. (Id. ¶¶ 73, 90, 103–08.) These decisions— mass IT layoffs and 
offshoring—allegedly left to the breach. (Id. ¶¶ 116–20.)10 Taken together, these 
allegations satisfy the agency framework: Bain manifested that PowerSchool should act 
on its behalf by conditioning the merger on cost-reduction measures; PowerSchool 
accepted the undertaking by implementing those measures; and the Merger Agreement 
reflects an understanding that Bain would control the undertaking. 
The Merger Agreement’s disclaimer of control does not compel a different result at 
this stage. This disclaimer is subject to “all other terms” that allegedly allowed Bain to 
control key operations. Plaintiffs allege that Bain directed specific activities beyond 
general supervision, including offshoring decisions that led to the hiring of Movate. (MC 
¶¶ 73, 90, 103–08.) Because Plaintiffs plausibly allege an agency relationship, Bain’s 
motion to dismiss as to the agency theory is DENIED. 
2. Direct Liability 
A shareholder—whether a natural person or a corporation—“may be liable on the 
ground that such shareholder’s activity resulted in the liability.” United States v. 
Bestfoods, 524 U.S. 51, 65 (1998) (citation omitted). The Ninth Circuit has recognized 
 
10 See, e.g., MC §§ D–J, ¶¶ 14–19, 37–41, 71–74, 81–86, 99–100 (Plaintiffs plausibly identify Bain’s 
specific actions, including directing layoffs of U.S.-based IT staff, outsourcing cybersecurity to the 
Philippines, and failing to prevent contractors like Movate’s employees from having unencrypted access 
to the PowerSchool database, which allegedly allowed the Data Breach to occur). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 12 of 29
 
-13- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
that direct liability may attach where a parent company engages in “day-to-day activities” 
that “might well be properly characterized as inconsistent with the parent corporation’s 
investor status[.]” Harris Rutsky & Co. Inc. v. Bell & Clements Ltd., 328 F.3d 1122, 
1135 (9th Cir. 2003). The question, is whether Bain’s conduct went beyond what an 
ordinary investor would do. 
The Complaint describes conduct that did. Before the merger, Bain exercised 
control through contractual veto rights and workforce directives; after the merger, Bain 
assumed formal control and replaced the board. (Dkt. 259 ¶¶ 93, 107–08.) Through this 
control, Bain allegedly dictated PowerSchool’s daily operations, including the cost-
cutting measures that dismantled the company’s cybersecurity infrastructure and led to 
the Data Breach. (Id.) Bain directed layoffs of at least 5% of PowerSchool’s workforce, 
including critical domestic IT staff, and shifted this labor overseas to Defendant Movate 
in the Philippines—at the expense of adequate staffing and funding for data security 
obligations. (Id. ¶ 101.) These cost-cutting measures resulted in decreased cybersecurity 
practices, including the offshoring of labor with access to Plaintiffs’ sensitive PII, which 
ultimately enabled hackers to infiltrate PowerSchool’s systems and exfiltrate data. (Id. ¶¶ 
101–08.) 
These allegations, if proven, would establish that Bain’s day-to-day involvement, 
operational direction, and cost-cutting activities are inconsistent with mere “investor 
status.” See Bestfoods, 524 U.S. at 72. In In re Packaged Seafood Products Antitrust 
Litig., the court held that an investor’s knowledge of unlawful conduct, combined with its 
active role in managing its investment, was sufficient to state a direct liability claim. No. 
15-md-02670-JLS-MDD, 2022 WL 836951, at *5 (S.D. Cal. Mar. 21, 2022). The facts 
here are similar: at the time of the merger, PowerSchool’s CEO announced that he would 
work “closely with the management at Bain in management and expansion of the 
company.” (Dkt. 259 ¶ 93.) Plaintiffs plausibly allege that Bain was not a distant equity 
holder but rather directed PowerSchool’s day-to-day activities— including dismantling 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 13 of 29
 
-14- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
the company’s cybersecurity protocols and staff— which allegedly led to the Data 
Breach.11 
Bain’s motion to dismiss the direct liability theory is DENIED. 
3. Aiding and Abetting 
Under California law, a defendant may be held liable for aiding and abetting the 
tort of another. See Austin B. v. Escondido Union Sch. Dist., 149 Cal. App. 4th 860, 879 
(2007). “Aiding and abetting” implies “an intentional participation with knowledge of 
the object to be attained.” Lomita Land & Water Co. v. Robinson, 154 Cal. 36, 47 
(1908); Upasani v. State Farm Gen. Ins. Co., 227 Cal. App. 4th 509, 519 (2014). Under 
the common law definition, 
[l]iability may . . . be imposed on one who aids and abets the 
commission of an intentional tort if the person (a) knows the other’s conduct 
constitutes a breach of duty and gives substantial assistance or 
encouragement to the other to so act or (b) gives substantial assistance to the 
other in accomplishing a tortious result and the person’s own conduct, 
separately considered, constitutes a breach of duty to the third person. 
 
Fiol v. Doellstedt, 50 Cal. App. 4th 1318, 1325–26 (1996).
12 A defendant may also be 
liable as an aider and abettor of a negligent act. Navarrete v. Meyer, 237 Cal. App. 4th 
1276, 1290 (2015). The UCL specifically recognizes that “liability can be imposed for 
aiding and abetting a principal violator.” NJOY, LLC v. Imiracle (HK) Ltd., 760 F. Supp. 
3d 1084, 1110 (S.D. Cal. 2024). 
Bain contends Plaintiffs do not sufficiently allege knowledge—that is, that Bain 
knew PowerSchool would be breaching any alleged duty. The Complaint, however, 
supports the inference. Plaintiffs allege that Bain studied and became involved with 
 
11 See In re Packaged Seafood Products Antitrust Litig., 2022 WL 836951, at *10 (“[P]articipation in the 
subsidiary’s wrongdoing supports a finding of the parent company’s liability.”). 
12 See Cesario v. Biocept, Inc., No. 23-cv-1803-WQH-BLM, 2025 WL 525120, at *33 (S.D. Cal. Feb. 
18, 2025), aiding and abetting claims sounding in fraud are subject to Rule 9(b)’s heightened pleading 
standard. 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 14 of 29
 
-15- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
PowerSchool for two years before the merger, during which time Bain gained familiarity 
with PowerSchool’s data-security practices and obligations. (Dkt. 259 ¶¶ 71–84.) 
Plaintiffs further allege that, having taken control of PowerSchool, Bain knew of 
PowerSchool’s misrepresentations and omissions regarding weakened cybersecurity, as 
well as Defendants’ duty to protect Plaintiffs’ sensitive information.
13 (Id. ¶¶ 98–100, 
108, 113–15, 185–88, 1033.)14 
Moreover, Plaintiffs allege that Bain directed PowerSchool to eliminate critical 
U.S.-based workforce and to outsource these responsibilities offshore to Movate for its 
own financial gain— conduct that constitutes “substantial assistance” under the aiding-
and-abetting framework.
15 These allegations plausibly allege both knowledge and 
substantial assistance. 
Bain’s motion to dismiss the aiding-and-abetting claim is DENIED. 
 
 
C. Negligence Claims 
 
Turning to Plaintiffs’ substantive claims, Bain moves to dismiss the claim that 
Bain was negligent. Under California law, negligence requires that a “defendant had a 
 
13 Plaintiffs allege that Bain is a tech-focused investor with expertise in digital technology and 
transformation, which was aware that offshoring on an expedited basis came with significant data 
security risks for PowerSchool’s security system. See In re First Alliance Mortg. Co., 471 F.3d 977, 993 
(9th Cir. 2006) (“Liability may . . . be imposed on one who aids and abets the commission of an 
intentional tort if the person . . . knows the other’s conduct constitutes a breach of a duty and gives 
substantial assistance or encouragement to the other to so act.”) (emphasis added). 
14 For example, Plaintiffs allege that Bain is a tech-focused investor with expertise in digital technology 
and transformation, which was aware that offshoring on an expedited basis came with significant data 
security risks for PowerSchool’s security systems. 
15 See Marcelos v. Dominguez, No. C 08-0056 CW, 2008 WL 2788173, at *10 (N.D. Cal. July 18, 2008) 
(holding that plaintiff sufficiently alleged knowledge where the entity at issue had an active role in 
funding the allegedly fraudulent loan); see also In re First Alliance Mortgage Co., 471 F.3d at 995 
(quoting Casey v. U.S. Bank Nat’l Ass’n, 127 Cal. App. 4th 1138, 1145 (2005)) (“‘[O]rdinary business 
transactions’ a bank performs for a customer can satisfy the substantial assistance element of an aiding 
and abetting claim if the bank actually knew those transactions were assisting the customer in 
committing a specific tort. Knowledge is the crucial element.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 15 of 29
 
-16- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
duty to use due care, that he breached that duty, and that the breach was the proximate or 
legal cause of the resulting injury.” Brown v. USA Taekwondo, 11 Cal. 5th 204, 213 
(2021) (citation omitted). “Recovery for negligence depends as a threshold matter on the 
existence of a legal duty of care.” (Id.) (citation omitted). Once duty is established, 
breach and causation are questions of fact for the jury. Hernandez v. Jensen, 61 Cal. 
App. 5th 1056, 1063 (2021). 
1. Duty 
Bain contends that it owed no duty to protect Plaintiffs from harm caused by third-
party threat actors and that any such duty belongs to PowerSchool alone. (Dkt. 286 at 
39.) The Court rejects this framing. Plaintiffs allege that “PowerSchool and Bain Capital 
owed a duty of care to take reasonable measures to ensure that the agents and associates 
they entrusted with Plaintiffs’ and Class Members PII . . . implement adequate data 
security practices to prevent unauthorized third parties access.” (Dkt. 259 ¶ 776.) So 
framed, the duty alleged is not one “‘to exercise, in his or her activities, reasonable care 
for the safety of others’.” Cabral v. Ralphs Grocery Co. 51 Cal. 4th 764, 768 (2011). It is 
a duty arising from Defendants’ own actions and failures in handling data entrusted to 
them. 
The Complaint supports this characterization. Plaintiffs adequately allege that the 
risk of harm to their data was foreseeable to both Bain and PowerSchool: both 
Defendants understood the importance of data security, data breaches are common, and 
both Defendants could have taken steps to prevent this breach. (Dkt. 259 ¶¶ 1, 9, 32.)
16 
Because the risk of harm was foreseeable and both Defendants’ own conduct created that 
 
16 Dkt. 259 ¶ 9 (Plaintiffs allege that PowerSchool, among other things, “(1) failed to require a multi-
factor authentication procedure to enter its systems; (2) failed to require users to change their passwords; 
and (3) permitted individuals to access PII despite those individuals not needing access to that PII to do 
their jobs. PowerSchool also failed to encrypt PII within its system. Had PowerSchool taken just one of 
these basic security measures, the Data Breach could have been easily averted.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 16 of 29
 
-17- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
risk, Plaintiffs plausibly allege that Bain owed a duty of care to protect Plaintiffs’ PII 
data. 
2. Breach 
To sufficiently plead breach, Plaintiffs “must be clear on the relevant standard of 
care . . . the source of that standard, and what factual allegations show that the duty was 
breached.” Jasso v. Citizens Telecomm. Co., No. 1:06-cv-00393-OWW-DLB, 2007 WL 
97036, at *5 (E.D. Cal. Jan. 9, 2007). 
Plaintiffs satisfy each component. They identify the standard of care— industry 
standards for cybersecurity. They identify the source: industry standard safeguards, 
including multifactor authentication.17 And they allege facts showing breach: that Bain 
had “responsibility, authority, and expertise to ensure that PowerSchool implemented 
basic, industry-standard safeguards— including requiring all their vendors and employees 
to use a multifactor authentication” (Dkt. 259 ¶ 114) and failed to do so. These 
allegations sufficiently state a claim for breach. See In re Data Breach Sec. Litig. Against 
Caesars Ent. Inc., 2025 WL 2393024, at *12. 
3. Causation 
Bain argues that Plaintiffs failed to allege causation because the Complaint does 
not allege that Bain proximately caused the cybersecurity incident. (Dkt. 286 at 40; Dkt. 
361 at 19 n.19.) At the pleading stage, causation requires only a “logical” connection 
between the breach and the alleged harm, which can be established through allegations 
that the “type of information” stolen in a breach “is the same kind needed” to commit 
fraud or identity theft. Stollenwerk v. Tri-West Health Care All., 254 Fed. App’x 664, 
667 (9th Cir. 2007). Causation is generally a question of fact for the jury and typically 
cannot be resolved on a motion to dismiss. See Huynh v. Quora, Inc., 508 F. Supp. 3d 
633, 650–51 (N.D. Cal. 2020) (quoting Lies v. Farrell Lines, Inc., 641 F.2d 765, 770 (9th 
 
17 Dkt. 259 ¶ 114 (Plaintiffs allege that “Bain holds itself out as a sophisticated, tech-focused investor 
with the expertise to guide companies through digital transformation.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 17 of 29
 
-18- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Cir. 1981)); see also In re GEICO Customer Data Breach Litig., 691 F. Supp. 3d 624, 
632 (E.D. N.Y. Aug. 28, 2023). The breach need not be the “sole cause” of the identity 
fraud; it suffices if the breach was a “substantial factor”18 in bringing about the injury 
“without which the injury would not have occurred.” Stollenwerk, 254 Fed. App’x at 667 
(citation omitted). Under California law, a “defendant [who] had a duty to protect the 
plaintiff cannot properly constitute a superseding cause that completely relieves the 
defendant of any responsibility for the plaintiff’s injuries.” Lugtu v. California Highway 
Patrol, 26 Cal. 4th 703, 725 (2001).19 
Here, Plaintiffs allege that Bain’s decisions to export U.S.-based IT staff, cut costs 
on cybersecurity, and offshore cybersecurity functions to the Philippines caused Plaintiffs 
and Class Members harm. (Dkt. 259 ¶¶ 108–11, 794–96.) The causal chain is 
straightforward: Bain directed offshoring and cost-cutting; those decisions weakened 
PowerSchool’s cybersecurity infrastructure; and that weakened infrastructure enabled the 
breach. It is reasonably foreseeable that offshoring IT cybersecurity would increase the 
likelihood of a data breach, and that a threat actor would exploit the resulting 
vulnerabilities. The acts or omissions by Defendant Movate and the threat actors do not 
sever Bain’s potential liability because those acts and omissions were themselves 
foreseeable risks of data breaches and the importance of data security. (Dkt. 259 ¶ 114.) 
Plaintiffs have sufficiently alleged causation, particularly in the absence of MFA 
requirements and other security measures. 
 
 
4. Damages 
 
18 Id. 
19 See also Henry v. Superior Court, 160 Cal. App. 4th 440, 449 (2008) (“[A] negligent tortfeasor is 
generally liable for all damage of which his negligence is a proximate cause . . . [A] tortfeasor may not 
escape this responsibility simply because another act . . . may also have been a cause of the injury.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 18 of 29
 
-19- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Bain argues that Plaintiffs’ damages are not recoverable because they are “too 
attenuated” and “not fairly traceable” to Bain’s conduct. (Dkt. 286.) Bain relies on Vavak 
v. Abbott Lab’y, Inc., No. CV 10-01995-SVW-JCX, 2011 WL 13130493 (C.D. Cal. Mar. 
7, 2011), where the court dismissed a product liability claim because the plaintiff did not 
allege purchase of the formula that was part of the recall or that caused the infant’s 
sickness. Id. at *5. 
Vavak is distinguishable. There, the connection between the defendant’s product 
and the plaintiff’s injury was absent. Here, Plaintiffs allege that all their data was subject 
to the Data Breach— a direct connection between Bain’s alleged conduct and the resulting 
harm. Plaintiffs have sufficiently alleged damages to survive a motion to dismiss their 
negligence claims. The motion to dismiss the negligence claim is DENIED. 
5. Negligence Per Se 
Plaintiffs agreed to voluntarily dismiss their standalone negligence per se claims 
under California, Massachusetts, and Michigan state law because those states do not 
recognize negligence per se as an independent cause of action. (ECF No. 307.) As a 
result, only the negligence per se claim based on New York law remains (Count II). The 
parties also agreed that the substance of Plaintiffs’ negligence per se allegations would be 
incorporated into Plaintiffs’ other negligence claim (Count I). (Id.; see Dkt. 259 ¶¶ 800-
827.)
20 Consistent with the parties’ agreement, the Court permitted Plaintiffs to maintain 
 
20 See Dent v. National Football League, 968 F.3d 1126, 1130 (9th Cir. 2020) (quoting 
Johnson v. Honeywell International Inc., 101 Cal. Rptr. 3d 726, 731 (Ct. App. 2009)) 
(recognizing that “negligence per se . . . creates an evidentiary presumption that affects 
the standard of care in a cause of action for negligence”); see also In re Accellion, Inc. 
Data Breach Litig., 713 F. Supp. 3d 580, 639–40 (N.D. Cal. 2024) (allowing negligence 
per se allegations under the FTC Act, HIPAA, and other statutes to support elements of 
negligence claim under California law); Randall v. Michigan High School Athletic Ass’n, 
965 N.W.2d 690, 703 (Mich. Ct. App. 2020) (“When a plaintiff proves that an actor has 
violated the terms of a statute,” the violation serves as “prima facie evidence of 
negligence.”); Lev v. Beverly Enterprises-Massachusetts, Inc., 929 N.E.2d 303, 313 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 19 of 29
 
-20- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
their negligence per se allegations under the respective state statutes and industry 
standards as pled within their negligence claim. 
Concerning the New York law-based claim, Powerschool argues that the federal 
statutes Plaintiffs rely on do not provide a basis for a negligence per se claim because the 
federal statutes do not provide a private cause of action. Reply Mem. in Support of 
MTD, Dkt. 360 at 21. One court applying New York law found that negligence per se 
could not be based on federal statutes that do not confer a private right of action such as 
HIPAA and the FTC. See Cohen v. Ne. Radiology, P.C., No. 20 CV 1202 (VB), 2021 
WL 293123, at *7 (S.D.N.Y. Jan. 28, 2021) (“And several New York courts have 
concluded that neither HIPAA nor the FTC Act can sustain a negligence per se claim.”). 
Other courts applying New York law have come to the opposite conclusion. See e.g., In 
re Cap. One Consumer Data Sec. Breach Litig., 488 F. Supp. 3d 374, 407–08 (E.D. Va. 
2020) (“[B]ecause New York law would permit the Plaintiffs to assert a negligence per se 
claim premised on a federal statute and because Plaintiffs have adequately done so 
here—importing the standard of care from the FTC Act—Plaintiffs have plausibly 
alleged a claim for negligence per se under New York law.”). Under New York law, 
even if a statute does not provide a private cause of action, it may still serve as a 
predicate for a negligence per se claim. German by German v. Fed. Home Loan Mortg. 
Corp., 896 F. Supp. 1385, 1397 (S.D.N.Y. 1995) (“Although a statutory scheme intended 
for the protection of a particular class does not expressly provide for civil liability, a court 
may, in furtherance of the statutory purpose, impose negligence per se, or even strict 
liability, for a statutory violation.”) (citing Trimarco v. Klein, 56 N.Y.2d 98, 107, 436 
N.E.2d 502, 506 (1982)). 
Because the Court finds that the federal statutes Plaintiffs identify in their 
Complaint are of the type which would serve as a basis for negligence per se under New 
 
(Mass. 2010) (“[T]he violation of a statute, ordinance, regulation, or policy is relevant 
because it constitutes some evidence of a defendant’s negligence.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 20 of 29
 
-21- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
York state law, Bain’s motion to dismiss the remaining negligence per se claim (Count 
II) is DENIED. 
6. Negligent Training and Supervision 
To state a claim for negligent training and supervision, Plaintiffs must allege that 
“an employer may be liable to a third person for the employer’s negligence in hiring or 
retaining an employee who is incompetent or unfit. . . . Negligence liability will be 
imposed upon the employer if it knew or should have known that hiring the employee 
created a particular risk or hazard and that particular harm materializes.” Delfino v. 
Agilent Tech., Inc., 145 Cal. App. 4th 790, 815 (2006). “Liability for negligent 
supervision and/or retention of an employee is one of direct liability for negligence, not 
vicarious liability.”21 Id. 
Here, Plaintiffs allege that Bain exerted control over PowerSchool before and after 
the merger. (Dkt. 259 ¶¶ 38–40, 71–75, 85–86, 109–13, 127–33, 998.) But Plaintiffs do 
not plausibly allege that Bain hired or supervised Powerschool’s IT employees. Another 
step removed is the allegation that an employee hired by Defendant Movate was 
negligently hired or trained by Bain. Bain’s authority over PowerSchool may have given 
it leverage to impose on Powerschool decisions as to whom to hire and where to hire 
subcontractors, but to impose upon Bain liability for those decisions goes well beyond 
the accepted concepts of tort liability for negligent hiring or supervision. 
Bain’s motion to dismiss the negligent training and supervision claim is 
GRANTED. 
 
21 Federico v. Superior Court (Jenry G.), 59 Cal. App. 4th 1207, 1213 (1997) (“An employer may be 
liable to a third person for the employer’s negligence in hiring or retaining an employee who is 
incompetent or unfit. . . . The rule of direct employer liability under the Restatement Second of Agency 
section 213 is: A person conducting an activity through servants or other agents is subject to liability for 
harm resulting from his conduct if he is negligent or reckless. . . .(b) in the employment of improper 
persons or instrumentalities in work involving risk of harm to others. . . As explained in comment (d): 
The principal may be negligent because he has reason to know that the. . . agent, because of his qualities, 
is likely to harm others in view of the work or instrumentalities entrusted to him.”) (citation and internal 
quotes omitted) (citation modified) 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 21 of 29
 
-22- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
E. California Consumer Privacy Act Claim 
Bain argues that the California Consumer Privacy Act (“CCPA”) claim must be 
dismissed for improper shotgun pleading under Rule 8 and for failure to state a claim 
under the plain language of the statute. (Dkt. 286 at 42–43.) Bain also separately argues 
that Plaintiffs have not alleged facts establishing that Bain operates as a “business” within 
the meaning of the CCPA. Id. 
 The CCPA provides a private right of action when “[a]ny consumer whose 
nonencrypted and nonredacted information, as defined in [Section 1798.81.5(d)(1)(A) of 
the California Civil Code] . . . is subject to an unauthorized access and exfiltration, theft, 
or disclosure as a result of the business’ violation of the duty to implement and maintain 
reasonable security procedures appropriate to the nature of the information to protect the 
personal information may institute a civil action . . . .” Cal. Civ. Code § 1798.150(a)(1). 
A plaintiff invoking this provision must therefore allege that (1) the defendant is a 
“business” under the CCPA, (2) the plaintiff’s “personal information” as defined in 
Section 178.81.5(d)(1)(A) was nonencrypted and nonredacted, (3) that information was 
subject to unauthorized access, and (4) the unauthorized access resulted from the 
business’s failure to implement and maintain reasonable security procedures. 
 Section 1798.81.5(d)(1)(A) defines “personal information” to include an 
individual's first name or first initial and last name in combination with data elements 
such as driver’s license numbers, government identification numbers, or account numbers 
with security codes permitting financial account access— when not encrypted or redacted. 
 The CCPA defines “business” as a for-profit entity “that collects consumers’ 
personal information or on the behalf of which that information is collected and that 
alone, or jointly with others, determines the purpose and means of the processing of 
consumers’ personal information.” Cal. Civ. § 1798.140(c)(1). The entity must also 
satisfy at least one of three revenue or data-volume thresholds: (1) have annual gross 
revenues of more than $25 million, (2) annually buy, receive, sell, or share personal 
information of 50,000 or more consumers, households, or devices, or (3) derive 50% or 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 22 of 29
 
-23- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
more of annual revenues from selling consumers’ personal information. Id. § 
1798.140(c)(1)(A)-(C). 
 Here, Plaintiffs allege that the information exposed in the Data Breach 
constitutes “personal information” as defined in Section 1798.81.5. (Dkt. 259 ¶¶ 123–25.) 
Specifically, the Data Breach exposed names and sensitive information, including “social 
security numbers, dates of birth, addresses, phone numbers, emails, photo identification, 
tax information numbers, health histories, and other medical information” (Id. ¶¶ 248, 
975).22,23 
Although Plaintiffs have adequately alleged the exposure of qualifying personal 
information, the CCPA claim does not survive a threshold step: Plaintiffs have not 
plausibly alleged that Bain is a “business” under the statute. To qualify as a “business,” 
an entity must “collect[] consumers’ personal information, or on the behalf of which that 
information is collected” and must “alone, or jointly with others, determine[] the 
purposes and means of the processing of consumers’ personal information.” Cal. Civ 
Code § 1798.140(c)(1); See Karter v. Eriq Sys., No. 2:21-cv-01682-CJC-AGR, 2021 WL 
4353274, at *2 (C.D. Cal. July 16, 2021). 
Plaintiffs contend that Bain was involved in the collection and processing of 
personal information through its control of PowerSchool. These allegations, however, 
amount to creative factual attenuations that do not cross the threshold of plausibility. Bain 
is an investment firm. It does not collect or process student information at schools. The 
 
22 Dkt. 259 ¶ 975 (“The Data Breach exposed PII and PHI, including, but not limited, name, social 
security numbers, dates of birth, addresses, phone numbers, emails, photo identification, tax information 
numbers, health histories, and other medical information.”). 
23 Dkt. 259 ¶ 998 (“Criminal threat actors accessed and viewed, and continue to access and view, 
Plaintiffs’ and California Subclass members’ individually identifiable medical information. The Data 
Breach threat actors gained access to Defendants’ SIS data using an ‘export data manager’ customer 
support tool, PowerSource. PowerSource contains a maintenance access tool that allows PowerSchool 
engineers to access Customer SIS for ongoing support and to troubleshoot performance issues. Using 
this tool, the attacker exported the PowerSchool SIS ‘Students’ and ‘Teachers’ database tables, which 
included Plaintiffs’’ individually identifiable medical records, to a CSV file, which was then stolen.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 23 of 29
 
-24- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
assertion that Bain— by virtue of its investment relationship with PowerSchool—collects 
or determines the purposes and means of processing consumers’ personal information is 
not plausible on the facts alleged. Plaintiffs strains to connect the alleged facts to a viable 
cause of action. 
Because Plaintiffs have not plausibly alleged that Bain qualifies as a “business” 
under Cal. Civ. Code § 1798.140(c)(1), the CCPA claim cannot proceed against Bain. 
Accordingly, Bain’s motion to dismiss the CCPA claim is GRANTED. 
F. California Unfair Competition Law Claim 
California’s UCL prohibits “any unlawful, unfair or fraudulent business act or 
practice.” Cal. Bus. & Prof. Code § 17200. Bain argues that Plaintiffs’ UCL claim fails 
because Plaintiffs did not plead with “particularity” any direct liability in violation of 
Rules 8 and 9(b), relying on Kearns v. Ford Motor Co., 567 F.3d 1120, 1125 (9th Cir. 
2009). This argument fails for two reasons.24 
First, it misapplies Kearns. That case addressed a UCL claim predicated on the 
“fraudulent” prong, where the plaintiff alleged affirmative misrepresentations.25 Here, 
California Plaintiffs assert only violations of the UCL’s “unlawful” and “unfair” prongs. 
(MC ¶¶ 1023–24.) They do not allege that Bain made fraudulent misrepresentations to 
 
24 In re Solara Med. Supplies, LLC Customer Data Sec. Breach Litig., 613 F. Supp. 3d 1284, 1303 (S.D. 
Cal. 2020). The court held that plaintiffs in a putative class action adequately stated a UCL claim under 
the unlawful prong against the medical supply company following a cybersecurity incident that may 
have compromised personal information. The complaint identified violations of multiple statutes, 
including the California Consumer Records Act, satisfying the requirement of predicate unlawful 
conduct. Cal. Bus. & Prof. Code §17200 et seq.; Cal. Civ. § 1798.82. 
25 See Kearns, 567 F.3d at 1127 (“Because the Supreme Court of California has held that nondisclosure 
is a claim for misrepresentation in a cause of action for fraud, it (as any other fraud claim) must be 
pleaded with particularity under Rule 9(b). Therefore, Kearns’s contention that his nondisclosure claims 
need not be pleaded with particularity is unavailing. Kearns’s claims of nondisclosure were couched in 
general pleadings alleging Ford’s intent to conceal from customers that CPO vehicles were essentially 
the same as ordinary used vehicles. Such general pleadings do not satisfy the heightened pleading 
requirements of Rule 9(b). Therefore, we hold that Kearns’s nondisclosure claims are claims of fraud 
and were properly dismissed for not being sufficiently pleaded.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 24 of 29
 
-25- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
consumers; rather, they allege Bain engaged in unlawful and unfair business practices by 
gutting cybersecurity protections and facilitating a massive data breach. 
This distinction is dispositive. As the court held in In re Zoom Video Commc’n 
Inc. Priv. Litig., “UCL claims of unlawful or unfair conduct are not subject to Rule 9(b) . 
. . .Only claims sounding in fraud[,]” which Plaintiffs do not bring, “are subject to the 
heightened pleading requirements of Rule 9(b).” 525 F. Supp. 3d 1017, 1045 (N.D. Cal. 
2021). This principle was reaffirmed in E.H. v. Meta Platforms, Inc., where the court 
held that plaintiffs asserting only “unlawful” and “unfair” UCL claims “do not need to 
meet Rule 9(b) or identify misrepresentations based on their claims that [defendant’s] 
conduct is unfair or illegal under the UCL.” No. 23-cv-05489-TSH, 2024 WL 557728, at 
*3 (N.D. Cal. Feb. 12, 2024). Rule 9(b)’s particularity requirement exists to provide 
defendants notice of specific fraudulent statements or omissions; where the claim rests on 
unlawful or unfair conduct independent of any alleged misrepresentation, that rationale 
does not apply. 
Second, because Rule 9(b) does not apply, California Plaintiffs need only satisfy 
the standard pleading requirements of Rule 8(a). Their allegations suffice because they 
“identify the particular section of the statute that was violated” and “describe with 
reasonable particularity the facts supporting the violation[s].” In re Anthem, Inc. Data 
Breach Litig., 162 F. Supp. 3d 953, 989 (N.D. Cal. 2016) (internal quotation omitted) 
(citation omitted). California Plaintiffs identify violations of Section 5(a) of the FTC Act 
and California Civil Code § 1798.81.5, and they describe in detail how Bain’s layoffs, 
outsourcing decisions, and authorization of unsupervised remote access led to the breach. 
Bain’s motion to dismiss the UCL claim is DENIED. 
G. Unjust Enrichment 
Plaintiffs assert a claim for unjust enrichment against Bain. California construes 
unjust enrichment claims as seeking quasi-contractual restitution. Astiana v. Hain 
Celestial Grp., Inc., 783 F.3d 753, 762 (9th Cir. 2015). A court may “construe the cause 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 25 of 29
 
-26- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
of action as a quasi-contract claim seeking restitution.” Id (citation omitted).26 To 
succeed, Plaintiffs must show that Bain received and unjustly retained benefits that 
rightfully belonged to Plaintiffs.27 
Plaintiffs have plausibly stated this claim. They allege that Bain received a benefit 
through its majority ownership of PowerSchool and that PowerSchool implemented 
Bain’s cost-cutting measures, creating a financial benefit for Bain at the expense of 
adequate data security. Through Bain’s intertwined relationship with PowerSchool, 
Plaintiffs plausibly allege unjust enrichment via the agency theory sustained above. See 
Supra Part IV.C.1. 
Bain’s motion to dismiss the unjust enrichment claim is DENIED. 
H. Declaratory Judgment and Injunctive Relief 
The Declaratory Judgment Act provides a remedy, not an independent cause of 
action. City of Reno v. Netflix, Inc., 52 F.4th 874, 878–79 (9th Cir. 2022). Pursuant to 
the Act, “[i]n a case of actual controversy within its jurisdiction . . . any court of the 
United States, upon the filing of an appropriate pleading, may declare the rights and other 
legal relations of any interested party seeking such declaration, whether or not further 
relief is or could be sought.” 28 U.S.C. § 2201(a). Declaratory relief must be predicated 
upon an “actual controversy,” which is “definite and concrete . . . real and substantial.” 
Aetna Life Ins. Co. v. Haworth, 300 U.S. 227, 240–41 (1937); cf. Owens v. Wells Fargo 
Bank, N.A., No. 08-cv-01050-LHK, 2009 WL 3353313, at *4–7 (N.D. Cal. Oct. 16, 
2009) (dismissing declaratory relief claim where underlying claims failed). 
Because Plaintiffs’ negligence claims and other claims survive—establishing the 
requisite “actual controversy”—and because Plaintiffs’ declaratory -judgment claims are 
 
26 See Munoz v. MacMillan, 195 Cal. App. 4th 648, 661 (2011) (“Common law principles of restitution 
require a party to return a benefit when the retention of such benefit would unjustly enrich the recipient; 
a typical cause of action involving such remedy is ‘quasi-contract.’“). 
27 Echo & Rig Sacramento, LLC v. AmGuard Ins. Co., 698 F. Supp. 1210, 1218 (E.D. 2023), under 
California law, when a plaintiff alleges unjust enrichment, a court may construe the cause of action as a 
quasi-contract claim seeking restitution. 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 26 of 29
 
-27- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
predicated on those claims, Plaintiffs have sufficiently stated a claim for declaratory 
relief. Bain’s motion to dismiss the claim is DENIED. 
I. Shotgun Pleading 
Pursuant to Rule 8(a)(2), a pleading must contain a “short and plain statement of 
the claim showing that the pleader is entitled to relief.” While this standard “does not 
require ‘detailed factual allegations,’ . . . it demands more than an unadorned, the-
defendant-unlawfully-harmed-me-accusation.” Iqbal, 556 U.S. at 677-78. The pleading 
must contain more than “labels and conclusions” or “naked assertion[s] devoid of further 
factual enhancement.” Id. (quoting Twombly, 550 U.S. at 557) (internal quotations 
omitted)). 
Bain argues that Plaintiffs improperly “group pled” Bain into all allegations against 
PowerSchool. (Dkt. 286 at 45.) This argument ignores the sections of the Consolidated 
Master Complaint that detail Bain’s specific alleged involvement and the failures that led 
to the Data Breach and Plaintiffs’ resulting harm. (MC §§ D–J, ¶¶ 14–19, 37–41.) 
Bain’s argument also overlooks two points. First, Bain’s, PowerSchool’s, and 
Movate’s combined data security failures plausibly contributed to the lapse in sound 
security practices that increased the chances of the resulting Data Breach. Plaintiffs have 
plausibly pled liability against Bain as a joint tortfeasor—a theory that, by its nature, 
involves allegation against multiple defendants within the same counts.
28 Second, 
Bain’s argument that Plaintiffs cannot plead claims against both PowerSchool and Bain 
in the same counts absent alter ego or agency liability is moot given the Court’s findings 
on agency and direct liability. 
Bain relies on Better Homes Realty, Inc. v. Watmore, No. 16-cv-01607-BAS-DHB, 
2017 WL 1400065 (S.D. Cal. Apr. 18, 2017), and Doe v. Camp Pendleton & Quantico 
 
28 See Honeycutt v. United States, 581 U.S. 443, 447–48 (2017) (“[T]wo or more defendants [who] 
jointly cause harm, each defendant is held liable for the entire amount of the harm; provided, however, 
that the plaintiff recover only once for the full amount.”). 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 27 of 29
 
-28- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Hous. LLC, No. 19-cv-02466-GPC-MSB, 2020 WL 1890576 (S.D. Cal. Apr. 16, 2020). 
Both cases are distinguishable. In Better Homes and Doe, the pleadings lacked plausible 
allegations as to the individual defendants and were “broad” and “conclusory.” Here, 
Plaintiffs have adequately pled that Bain was the majority owner of PowerSchool and, 
through this majority ownership, instituted cost-cutting measures that resulted in 
decreased cybersecurity control by exporting IT and account security functions to Movate 
in the Philippines. These are specific, factually grounded allegations— not the kind of 
conclusory group pleading that Better Homes and Doe condemned. 
Bain’s motion to dismiss on shotgun-pleading grounds is DENIED. 
/// 
/// 
/// 
V. CONCLUSION 
For the foregoing reasons, the Court ORDERS as follows: 
1. Bain’s motion to dismiss for lack of Article III standing is DENIED. 
2. Bain’s motion to dismiss for lack of personal jurisdiction is DENIED. 
3. Bain’s motion to dismiss on agency, direct liability, and aiding and abetting 
theories is DENIED. 
4. Bain’s motion to dismiss Plaintiffs’ negligence claim is DENIED. 
5. Bain’s motion to dismiss negligence per se claim is DENIED. 
6. Bain’s motion to dismiss Plaintiffs’ negligent training and supervision claim is 
GRANTED. 
7. Bain’s motion to dismiss Plaintiffs’ CCPA claim is GRANTED. 
8. Bain’s motion to dismiss Plaintiffs’ UCL claim is DENIED. 
9. Bain’s motion to dismiss Plaintiffs’ unjust enrichment claim is DENIED. 
10. Bain’s motion to dismiss Plaintiffs’ claim for declaratory judgment and 
injunctive relief is DENIED. 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 28 of 29
 
-29- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
11. Bain’s motion to dismiss on shotgun-pleading grounds is DENIED. 
IT IS SO ORDERED. 
DATED: March 18, 2026 
 HON. ROGER T. BENITEZ 
United States District Judge 
 
Case 3:25-md-03149-AJB-MSB Document 434 Filed 03/18/26 PageID.<pageID> 
Page 29 of 29

Passage view · GavelSight