govinfo:USCOURTS-casd-3_25-md-03149-2

-1- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
 
 
 
 
 
 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF CALIFORNIA 
 
IN RE: POWERSCHOOL 
HOLDINGS, INC. AND 
POWERSCHOOL GROUP, LLC 
CUSTOMER SECURITY BREACH 
LITIGATION., 
 
) 
) 
) 
) 
) 
) 
) 

 
ORDER GRANTING IN PART AND 
DENYING IN PART BAIN 
CAPITAL’S MOTION TO DISMISS 
(TRACK 2) 
 
[ECF No. 303 ] 
 
Defendant Bain Capital’s motion to dismiss under Rules 12(b)(2) and 12(b)(6) is 
denied in part and granted in part. The motion is denied as to: (1) personal jurisdiction 
over Bain with respect to the Direct Action Plaintiffs; (2) the direct-liability claims for 
intentional interference with contractual relations; (3) the Class Action Plaintiffs’ 
negligence claim; and (4) the Class Action Plaintiffs’ request for declaratory and 
injunctive relief. 
The motion is granted without prejudice as to: (1) personal jurisdiction over Bain 
with respect to the Class Action Plaintiffs; (2) the Direct Action Plaintiffs’ alter ego 
theories; (3) the Class Action Plaintiffs’ CFAA conspiracy claim; (4) the Class Action 
Plaintiffs’ CDAFA claim; (5) negligence per se; and (6) the Class Action Plaintiffs’ 
unjust-enrichment claim. 
 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 1 of 25
 
-2- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
BACKGROUND 
A. Factual Allegations 
This multidistrict litigation arises from an alleged data breach involving 
Defendants PowerSchool Holdings, Inc. and PowerSchool Group, LLC (collectively, 
“PowerSchool”). PowerSchool provides cloud-based data-management software for K-
12 students and educators and stores sensitive student medical, academic, and other 
personally identifiable information. Plaintiffs allege that Defendant Bain Capital 
(“Bain”), an investment firm that acquired a 51-percent majority ownership stake in 
PowerSchool, implemented data-management changes that compromised cybersecurity 
protections and contributed to a breach exposing the personal information of 
approximately 50 million individuals. 
Bain initiated merger and acquisition discussions with PowerSchool, a 
Sacramento-based provider of educational software, in August 2022. (Dkt. 263 ¶ 98.) 
Schools and school-district customers provide PowerSchool with sensitive personally 
identifiable information (“PII”), which PowerSchool stores and maintains. (Id. ¶¶ 1, 38, 
170; Dkt. 288 ¶¶ 2, 10.) 
The Track 2 or school entity Plaintiffs allege that in early 2024, during merger 
negotiations, PowerSchool announced plans to offshore its cybersecurity and IT 
functions. It is alleged that Bain imposed on PowerSchool these cost-cutting measures 
for its workforce. (Dkt. 288 ¶¶ 58, 62, 65; Dkt. 263 ¶¶ 7, 102, 104, 105.) 
On June 6, 2024, Bain agreed to acquire a majority ownership stake in 
PowerSchool. (Dkt. 342 at 17; Dkt. 388 at 1.) The Merger Agreement provided that 
before closing, neither party had “the right to control or direct the business or operations” 
of the other. (Dkt. 303 at 7; Dkt. 379 at 24.) Plaintiffs contend that during the interim 
period, PowerSchool could not implement layoffs affecting 50 or more employees 
without Bain’s express permission. (Dkt. 342 at 18.) Plaintiffs also rely on the 
agreement’s representations regarding compliance with data protection obligations. (Dkt. 
342 at 17-18.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 2 of 25
 
-3- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Plaintiffs allege that unauthorized system access began in August 2024, with data 
exfiltration occurring later.1 (Dkt. 288 ¶ 62; Dkt. 263 ¶¶ 46-47.) The acquisition closed 
on October 1, 2024, when Bain replaced PowerSchool’s board and assumed operational 
control. (Dkt. 263 ¶ 17; Dkt. 288 ¶ 56.) 
Following the acquisition, Bain directed PowerSchool to offshore cybersecurity, 
engineering, and IT functions to contractors, including Defendant Movate. (Dkt. 288 ¶¶ 
65, 70-72; Dkt. 263 ¶¶ 7, 104, 163.) According to the Complaints this offshoring 
required data-management tools that enabled vendors to bypass consent protocols and 
access protected school district computers directly. (Dkt. 288 ¶¶ 70-74; Dkt. 263 ¶¶ 46, 
196, 198.) 
In December 2024, hackers used stolen Movate employee credentials to access 
PowerSchool’s student information system through its PowerSource portal. (Dkt. 288 ¶ 
72.) PowerSchool discovered the breach on December 28, 2024, and notified customers 
on January 7, 2025. (Dkt. 288 ¶¶ 5, 8, 31; Dkt. 263 ¶¶ 40, 41, 48.) The breach 
compromised approximately 50 million individuals’ data, including Social Security 
numbers, medical and financial information, addresses, disability records, and custody 
information. (Dkt. 288 ¶¶ 7, 25, 33; Dkt. 263 ¶¶ 42, 45, 48.) 
B. Procedural History 
On April 8, 2025, the Judicial Panel on Multidistrict Litigation transferred this 
matter to this Court. (Dkt. 1.) The litigation is organized into two tracks: Track 1 
(Individual User Class Action) and Track 2 (School Direct Actions). 
As relevant here, Track 2 encompasses both the Class Action Plaintiffs, who 
pursue claims directly against Bain, and Direct Action Plaintiffs, who pursue claims 
against Bain under both alter ego and direct liability theories. 
The Class Action Plaintiffs pursue direct claims against Bain for intentional 
 
1 Dkt. 263 ¶ 17 (“[T]he first know incident of unauthorized access occurred on August 16, 2024, and on 
September 17, 2024, the earliest known date of unauthorized access attributable to the Threat Actors.”) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 3 of 25
 
-4- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
interference with contractual relations (Count 2), negligence (Count 3), conspiracy to 
violate the Computer Fraud and Abuse Act (“CFAA”), 18 U.S.C. § 1030 (Count 4), 
violation of the California Comprehensive Data Access and Fraud Act (“CDAFA”), Cal. 
Penal Code § 502 (Count 5), unjust enrichment (Count 7), and declaratory and injunctive 
relief (Count 8).
2 
Direct Action Plaintiffs assert intentional interference with contractual relations as 
their sole direct-liability claim against Bain, with the remainder of their counts 
proceeding against Bain solely on an alter ego theory of vicarious liability.3 
Bain moves to dismiss all claims asserted against it under Rules 12(b)(2) and 
12(b)(6). 
LEGAL STANDARDS 
A. Rule 12(b)(6) 
To survive a motion to dismiss, a complaint “must contain sufficient factual 
matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft 
v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 
570 (2007)). A claim has facial plausibility when the plaintiff pleads “factual content 
that allows the court to draw the reasonable inference that the defendant is liable for the 
misconduct alleged.” Iqbal, 556 U.S. at 678. If the plaintiff’s explanation is plausible, 
the complaint survives regardless of whether a more plausible alternative explanation 
exists. Id.4 A “Rule 12(b)(6) motion tests the sufficiency of a complaint; it does not . . . 
resolve contests surrounding the facts, the merits of the claim, or the applicability of 
 
2 (Dkt. 303, Ex. A.), Class Action Plaintiffs confirmed they do not pursue alter ego or 
other vicarious liability theories against Bain. 
3 (See Dkt. 379 at 1.), Track 1 Individual User Plaintiffs previously abandoned their alter 
ego claims against Bain. 
4 Twombly, 550 U.S. at 556 (“[A] well-pleaded complaint may proceed even if it strikes a 
savvy judge that actual proof of those facts is improbable, and that a recovery is very 
remote and unlikely.”) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 4 of 25
 
-5- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
defenses.” W. Ins. Co. v. Frontier Homes, LLC, No. EDCV 17-2181-R, 2018 WL 
8220544, at *2 (C.D. Cal. Mar. 27, 2018). 
B. Rule 9(b) 
Rule 9(b) requires fraud or mistake claims to be pleaded “with particularity,” 
including statutory consumer protection claims based on alleged deception. Kearns v. 
Ford Motor Co., 567 F.3d 1120, 1125–26 (9th Cir. 2009). 
C. Rule 12(b)(2) 
When a defendant moves to dismiss under Rule 12(b)(2) and the motion is decided 
on written submissions, the plaintiff “need only make a prima facie showing of 
jurisdictional facts.” Glob. Commodities Trading Grp., Inc. v. Beneficio de Arroz 
Choloma, S.A., 972 F.3d 1101, 1106 (9th Cir. 2020). The Court takes uncontroverted 
allegations as true and resolves genuine factual disputes in the plaintiff’s favor. Id. 
In multidistrict litigation, personal jurisdiction over a defendant “must exist in the 
district where [the action] is filed.” In re Delta Dental Antitrust Litig., 509 F. Supp. 3d 
1377, 1379–80 (J.P.M.L. 2020). Plaintiffs must establish personal jurisdiction in the 
transferor forums—California for the Direct Action Plaintiffs and New Jersey and New 
York for the Class Action Plaintiffs. California’s and New Jersey’s long-arm statutes 
extend to the limits of federal due process. See Cal. Civ. Proc. Code § 410.10; N.J. Ct. R. 
4:4-4(b)(1). 
General jurisdiction exists where a defendant is “at home”— typically, its state of 
incorporation or principal place of business. Daimler AG v. Bauman, 571 U.S. 117, 137 
(2014). Specific jurisdiction requires: “(1) [t]he non-resident defendant must 
purposefully direct his activities or consummate some transaction with the forum . . . ; (2) 
the claim must be one which arises out of or relates to the defendant’s forum-related 
activities; and (3) the exercise of jurisdiction must comport with fair play and substantial 
justice.” Schwarzenegger v. Fred Martin Motor Co., 374 F.3d 797, 802 (9th Cir. 2004). 
D. Choice of Law 
Plaintiffs argue that a choice of law determination is premature at this stage 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 5 of 25
 
-6- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
because it is a “fact-intensive exercise better suited for later stages of litigation when the 
parties may present evidence on the issue.” In re Accellion, Inc. Data Breach Litig., No. 
21-cv-01155-EJD, 2024 WL 4592367, at *2 (N.D. Cal. Oct. 28, 2024). At this stage, the 
Court need not definitively resolve all choice-of-law questions where the parties agree 
that the relevant standards are materially similar or where the result would be the same 
under the standards cited by the parties. 
DISCUSSION 
I. PERSONAL JURISDICTION 
A. General Jurisdiction 
Bain is a limited partnership organized in Delaware with its principal place of 
business in Massachusetts. (Dkt. 263 ¶ 18.) Plaintiffs do not dispute those facts or 
meaningfully respond to Bain’s general-jurisdiction argument. General jurisdiction, 
therefore, does not exist over Bain in California, New Jersey, or New York. See Stichting 
Pensioenfonds ABP v. Countrywide Fin. Corp., 802 F. Supp. 2d 1125, 1132 (C.D. Cal. 
2011) (non-opposition may be construed as waiver). 
B. Direct Action Plaintiffs (California) 
The Direct Action Plaintiffs have made a prima facie showing of specific 
jurisdiction in California. 
1. Purposeful availment 
The Court agrees with Bain that a parent-subsidiary or investor-portfolio company 
relationship alone cannot serve as the basis for specific jurisdiction. See Williams v. 
Yamaha Motor Co., 851 F.3d 1015, 1022–25 (9th Cir. 2017). But the Direct Action 
Complaint goes beyond describing a simple investment relationship. It alleges with 
specificity that Bain began “exercising direct control over PowerSchool’s decision-
making” before the merger closed, including by issuing an August 13, 2024, “layoff 
order” that “eliminated around 175 critical staff” and “basically gutted” PowerSchool’s 
California-based departments. (Dkt. 288 ¶¶ 58, 60, 62; Dkt. 263 ¶¶ 17, 102.) It further 
alleges that Bain orchestrated plans to “boost[] PowerSchool’s headcount in India and 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 6 of 25
 
-7- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
other low-cost locations” and “moved swiftly to execute” those offshoring plans.5 
Taken as true, those allegations specify particular directives that Bain allegedly 
issued, the California-based workforce they targeted, and the operational effects those 
directives caused at PowerSchool’s California operations. At this stage, that is enough to 
establish that Bain “deliberately reached out beyond [its] home” to direct conduct in 
California and created “continuing relationships and obligations” in the forum. 
Yamashita v. LG Chem, Ltd., 62 F.4th 496, 503 (9th Cir. 2023); Silk v. Bond, 65 F.4th 
445, 457 (9th Cir. 2023). 
2. Relatedness 
The Direct Action Plaintiffs also meet the relatedness requirement. They allege 
that Bain’s layoff orders targeting California-based staff and its directive to offshore 
operations “directly undermined cybersecurity” and caused the data breach.6 Those 
allegations support a reasonable inference that the alleged injury is the type of harm that 
would “tend to be caused” by dismantling a company’s in-forum security infrastructure. 
See Yamashita, 62 F.4th at 505–06; Briskin v. Shopify, Inc., 135 F.4th 739, 760 (9th Cir. 
2025). 
Bain’s reliance on Walsh v. LG Chem Ltd., 834 F. App’x 310, 312 (9th Cir. 2020), 
is misplaced. In Walsh, the complaint did not establish a direct connection between the 
defendant’s forum contacts and the injury. In this case, the Direct Action Complaint 
clearly links Bain’s California-centered decisions to the breach. 
3. Reasonableness 
Because the Direct Action Plaintiffs satisfy the first two prongs, the burden shifts 
to Bain to “present a compelling case” that jurisdiction would be unreasonable. 
Schwarzenegger, 374 F.3d at 802. Bain has not made that showing. Its discussion of 
reasonableness is undeveloped and unsupported by evidence. The allegations instead 
 
5 (Dkt. 288 ¶¶ 65–66, 70–72.) 
6 (Dkt. 288 ¶¶ 65–66, 70–72.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 7 of 25
 
-8- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
describe significant and deliberate intervention in California. Bain identifies no specific 
financial or logistical burden associated with litigating in California. California has a 
substantial interest in resolving disputes arising from conduct allegedly directed at a 
California-based company’s workforce and operations. The MDL posture of this case 
also promotes efficiency. 
Accordingly, Bain’s motion to dismiss for lack of personal jurisdiction is denied as 
to the Direct Action Plaintiffs. 
C. Class Action Plaintiffs (New Jersey and New York) 
The result is different for the Class Action Plaintiffs. Their complaint alleges that 
personal jurisdiction is proper in California, but it contains no allegations showing that 
Bain is subject to personal jurisdiction in New Jersey or New York.7 The four theories 
they advance do not change that result. 
1. Successor liability 
The undisputed transactional structure shows that BCPE Polymath Merger Sub, 
Inc. merged into PowerSchool Holdings, Inc., with PowerSchool continuing as the 
surviving corporation. (Dkt. 342 at 8.) PowerSchool thus remains a separate legal entity. 
When the predecessor survives as its own corporation, courts have refused to apply 
successor liability for jurisdictional reasons. See Komaiko v. Baker Techs., Inc., 2020 
WL 1915884, at *10–12 (N.D. Cal. Apr. 20, 2020); Long Side Ventures LLC v. 
Hempacco Co., 2023 WL 6386888, at *13 (S.D.N.Y. Sept. 29, 2023); Ferry v. Black 
Diamond Video, Inc., 2016 WL 3381237, at *10–11 (D.N.J. June 14, 2016). The 
jurisdictional gap for successor liability does not exist here. 
2. Calder Effects Test 
The “express aiming” requirement requires more than just knowing that the 
plaintiff lives in or has connections to the forum. See Kalter v. Keyfactor, Inc., 2022 WL 
 
7 (Dkt. 263 ¶¶ 23, 26, 138.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 8 of 25
 
-9- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
658976, at *2–3 (S.D. Cal. Mar. 4, 2022). An investment firm’s awareness that a 
portfolio company maintains contracts within forum states does not constitute evidence 
that the firm expressly aimed its conduct towards those states. See IMO Indus., Inc. v. 
Kiekert AG, 155 F.3d 254, 266 (3d Cir. 1998). The Class Complaint does not specify any 
conduct by Bain directed at New Jersey or New York independent of PowerSchool’s 
actions. 
3. Pendent Personal Jurisdiction 
Pendent personal jurisdiction requires an independent basis for jurisdiction over at 
least one claim. The Class Action Plaintiffs assert that Bain does not contest jurisdiction 
over the CFAA claim. Bain’s reply states that it objects to jurisdiction over all claims.
8 
The CFAA also contains no special jurisdictional provision that would, in and of itself, 
establish jurisdiction here. Because the CFAA claim must satisfy the same jurisdictional 
requirements, and those requirements are not met, pendent personal jurisdiction does not 
apply. 
4. Jurisdictional Discovery 
Although the current allegations are inadequate, the Court will permit limited 
jurisdictional discovery. The record raises factual questions about Bain’s corporate and 
partnership relationships with PowerSchool, how liabilities were allocated after the 
merger, and Bain’s authority over PowerSchool’s operations in New Jersey and New. 
Since Bain controls this information, limited discovery is appropriate. See Munenzon v. 
Peters Advisors, LLC, 2022 WL 1486195, at *5–7 (D.N.J. May 10, 2022); Cohodes v. 
MiMedx Grp., Inc., 2022 WL 15523079, at *3 (N.D. Cal. Oct. 27, 2022). 
Accordingly, Bain’s motion to dismiss for lack of personal jurisdiction is granted 
without prejudice concerning the Class Action Plaintiffs. The Class Action Plaintiffs are 
permitted to undertake limited jurisdictional discovery focused on Bain’s corporate 
 
8 (Dkt. 303 at 10-17; Dkt. 379 at 30.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 9 of 25
 
-10- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
arrangements with PowerSchool, the allocation of liabilities pursuant to the merger, and 
Bain’s decision-making authority over PowerSchool’s operations in New Jersey and New 
York. 
II. ALTER EGO (DIRECT ACTION PLAINTIFFS ONLY) 
The Direct Action Plaintiffs contend that Bain may be held liable under an alter 
ego theory by attributing PowerSchool’s conduct and forum contacts to Bain. Class 
Action Plaintiffs do not pursue an alter ego theory and have confirmed that point. (Dkt. 
303 at 4–5; Ex. A.) The Court therefore limits this analysis to the Direct Action 
Plaintiffs. 
The parties disagree on which jurisdiction’s alter ego law applies but agree that the 
doctrine is substantially the same in the relevant jurisdictions. (Dkt. 303 at 18 n.17.) 
Direct Action Plaintiffs cite authority indicating that New York, Delaware, Utah, 
Vermont, Wisconsin, Virginia, Illinois, South Carolina, Pennsylvania, Oklahoma, Idaho, 
Tennessee, and Arizona law is materially similar to California’s. (Dkt. 344 at 9–16.
9) 
Because the parties agree, and because the cited authorities support that premise, the 
Court applies California’s two-prong test under Sonora Diamond Corp. v. Superior Ct., 
83 Cal. App. 4th 523, 538 (2000): unity of interest and ownership and inequitable result. 
A. Unity of Interest and Ownership 
To establish an alter ego relationship under California law, a plaintiff must show: 
(1) “such a unity of interest and ownership between the corporation and its equitable 
owner that the separate personalities of the corporation and the shareholder do not in 
reality exist,” and (2) “an inequitable result if the acts in question are treated as those of 
the corporation alone.” Id. at 538. Alter ego is an “extreme remedy, sparingly used.” Id. 
at 539. The corporate form is disregarded only in exceptional cases, and the burden of 
 
9 Lincoln Imps. Inc. v. Weaver Flower Co., No. SACV 11–1098–JST (ANX), 2012 WL 1048531, at *4 
(C.D. Cal. March 27, 2012) (finding that party adequately pleaded an alter ego claim by alleging failure 
to adequately capitalize, disregard for corporate formalities, and the potential unjust result of upholding 
the corporate veil.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 10 of 25
 
-11- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
proof rests heavily on the party seeking to pierce the corporate veil. Santa Clarita Org. 
for Plan. & Env’t v. Castaic Lake Water Agency, 1 Cal. App. 5th 1084, 1105 (2016). The 
degree of control required is exacting: a plaintiff must plead “manipulative control” such 
that “a parent dictates every facet of the subsidiary’s business— from broad policy 
decisions to routine matters of day-to-day operation.” Gerritsen v. Warner Bros. Ent. 
Inc., 116 F. Supp. 3d 1104, 1138 (C.D. Cal. 2015). A threshold requirement is 
ownership. SEC v. Hickey, 322 F.3d 1123, 1130 (9th Cir. 2003). 
1. Pre-acquisition conduct 
A key requirement of alter ego liability is that the alleged alter ego “must own at 
least part of a corporation.” Hickey, 322 F.3d at 1130 (“[A]n individual must own at least 
a portion of a corporation before an alter ego relationship is deemed to exist under 
California law.”). Direct Action Plaintiffs allege that Bain’s involvement went beyond 
passive investment and that Bain controlled PowerSchool’s decisions, set policies, and 
offshored cybersecurity to external contractors, granting them access to Plaintiffs’ PII and 
PHI. (Dkt. 288 ¶¶ 56, 70-74.) But before October 1, 2024, Bain and PowerSchool 
appeared to have been engaged in an arm’s-length transaction as independent parties. 
The Merger Agreement, incorporated by reference, states that Bain did not have “the 
right to control or direct the business or operations of” PowerSchool prior to the closing. 
(Dkt. 303 at 7.) 
As a matter of law, allegations of control during a time when the alleged alter ego 
had no ownership interest cannot prove the unity of interest needed for an alter ego 
relationship. See Hickey, 322 F.3d at 1130. To the extent the Direct Action Plaintiffs 
rely on pre-acquisition control allegations, those allegations are either conclusory or 
implausible in view of the Merger Agreement. See Paulsen v. CNF Inc., 559 F.3d 1061, 
1071 (9th Cir. 2009). 
2. Post-acquisition conduct 
The post-acquisition allegations also fall short. The Direct Action Complaint 
alleges that Bain “dictated” policies and business decisions and acted as “the controlling 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 11 of 25
 
-12- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
alter ego of PowerSchool.” (Dkt. 288 ¶¶ 58, 87.) Those assertions are too conclusory. 
The complaint does not provide sufficient detail as to when Bain gave specific directives, 
what those directives required, or how Bain’s conduct differed from ordinary ownership 
oversight. Under New York law, “conclusory allegations of dominance and control will 
not suffice to defeat a motion to dismiss.” Reynolds v. Lifewatch, Inc., 136 F. Supp. 3d 
503, 525 (S.D.N.Y. 2015). 
The Court also considers what the complaint does not allege: no commingling of 
funds, no shared corporate records, assets, offices, employees, directors, or officers, no 
diversion of funds, and no disregard of corporate formalities. See Wechsler v. Macke 
Int’l Trade Inc., 327 F. Supp. 2d 1139, 1144 (C.D. Cal. 2004); Reynolds, 136 F. Supp. 3d 
at 525, 527. Nor does the complaint plausibly allege the sort of ongoing manipulative 
control necessary to pierce the corporate veil. A parent’s involvement in “financing and 
macro-management” of its affiliates, without more, does not establish alter ego. See 
ViaSat, Inc. v. Space Sys./Loral, Inc., 2012 WL 12844738, at *5 (S.D. Cal. July 30, 
2012); Ranza v. Nike, Inc., 793 F.3d 1059, 1075 (9th Cir. 2015). 
3. Conduit theory 
The Direct Action Plaintiffs emphasize that Bain used PowerSchool as a conduit. 
(Dkt. 344 at 18, 20–24.) That theory is not sufficiently pleaded. For the period before 
October 1, 2024, the theory fails because Bain lacked an ownership interest and the 
Merger Agreement disclaimed control. After October 1, 2024, the allegations remain 
limited and conclusory. The fact that Bain replaced PowerSchool’s board and 
participated in high-level decisions is a typical exercise of ownership, not the pervasive 
operational domination required for alter ego liability. Morgan Creek, 217 Cal. App. 4th 
at 1109; Gerritsen, 116 F. Supp. 3d at 1138–39. 
The authorities cited by the Direct Action Plaintiffs—Laguna v. Coverall N. Am., 
Inc., No. 09CV2131 JM (RBB), 2009 WL 5125606, at *2 (S.D. Cal. Dec. 18, 2009), Blue 
Line Foodservice Distribution, Inc. v. Cathcart, No. 24-CV-1250W-MMP, 2025 WL 
1265859, at *11 (S.D. Cal. Apr. 30, 2025), and Connecticut Gen. Life Ins. Co. v. Earl 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 12 of 25
 
-13- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Scheib, Inc., No. 11CV788AJB(WVG), 2012 WL 12868358, at *3 (S.D. Cal. May 22, 
2012)— involved materially different allegations, such as commingling of funds, asset 
diversion, a disregard of corporate formalities, or sole ownership. Those allegations are 
absent here. 
4. Undercapitalization theory 
The undercapitalization theory fares no better. Direct Action Plaintiffs allege that 
Bain “saddled PowerSchool with substantial debt” and left it “undercapitalized and 
underinsured.” (Dkt. 288 ¶¶ 57, 89.) A corporation is undercapitalized when it is unable 
to meet debts reasonably expected to arise in the ordinary course of business. In re 
Hydroxycut Mktg. & Sales Pracs. Litig., 810 F. Supp. 2d 1100, 1123 (S.D. Cal. 2011). 
Even a debt-to-capital ratio approaching ninety percent does not, by itself, establish 
undercapitalization. In re Packaged Seafood Prods. Antitrust Litig., 338 F. Supp. 3d 
1118, 1154–55 (S.D. Cal. 2018). The complaint does not allege that PowerSchool cannot 
pay its debts as they become due, lacks the capital to operate normally, or is judgment-
proof. Bare allegations of financial pressure are insufficient. 
B. Inequitable Result 
The complaint also fails to satisfy the second prong of Sonora Diamond. It does 
not allege that Bain used the October 2024 transaction to avoid liabilities, divert assets, or 
engage in bad-faith conduct designed to prevent PowerSchool from satisfying its 
obligations. Difficulty in enforcing a judgment is not enough. Sonora Diamond, 83 Cal. 
App. 4th at 538–39. Plaintiffs’ assertion that respecting the corporate form would be 
“unconscionable” is conclusory. 
Because the Direct Action Plaintiffs have not adequately pleaded alter ego, 
PowerSchool’s forum contacts cannot be attributed to Bain on that theory, and the claims 
proceeding solely against Bain on an alter ego basis must be dismissed. 
Although the present allegations are insufficient, the record raises factual questions 
regarding Bain’s corporate and partnership arrangements with PowerSchool, the extent of 
Bain’s operational control after October 1, 2024, and the allocation of liabilities under the 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 13 of 25
 
-14- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
merger. Those facts are within Bain’s possession and control. See Bell Atl. Bus. Sys. 
Servs. v. Hitachi Data Sys. Corp., 849 F. Supp. 702, 707 (N.D. Cal. 1994). This case is 
unlike Spy Optic, where the jurisdictional allegations were weak and the defendants 
submitted specific denials supported by evidence. 2020 WL 1849672, at *9 (S.D. Cal. 
Apr. 13, 2020). 
Accordingly, Bain’s motion to dismiss only the alter ego theories of the Direct 
Action Plaintiffs as to New York and New Jersey is granted without prejudice. The 
Direct Action Plaintiffs may conduct limited jurisdictional discovery related to Bain’s 
corporate arrangements with PowerSchool, the allocation of liabilities under the merger, 
and Bain’s decision-making authority over PowerSchool’s operations after October 1, 
2024. 
III. DIRECT-LIABILITY CLAIMS AGAINST BAIN 
A. Intentional Interference with Contractual Relations 
Both sets of Plaintiffs assert direct liability claims against Bain for intentional 
interference with contractual relations. The parties agree that the elements are materially 
consistent across the potentially applicable jurisdictions. A plaintiff must allege: (1) the 
existence of a valid contract between the plaintiff and a third party; (2) the defendant’s 
knowledge of the contract; (3) the defendant’s intentional procurement of the third 
party’s breach without justification; (4) actual breach; and (5) resulting damages. See e.g., 
Plasticware, LLC v. Flint Hills Res., LP, 852 F. Supp. 2d 398, 404 (S.D.N.Y. 2012). 
For purposes of this motion, Bain does not dispute the first two elements: the 
existence of valid contracts and Bain’s knowledge of them. (Dkt. 342 at 16; Dkt. 344 at 
28.) The dispute concerns procurement, intent, justification, causation, and breach. 
Plaintiffs adequately plead each element. 
1. Procurement 
Both complaints allege that Bain interfered with PowerSchool’s contracts with 
Plaintiffs by directing, encouraging, and pressuring PowerSchool to cut cybersecurity 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 14 of 25
 
-15- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
spending, reduce cybersecurity staff, and outsource operations to subcontractors.10 Bain 
argues that those allegations are conclusory and contradicted by the Merger Agreement’s 
“No Control” clause. (Dkt. 303 at 6–7, 29–30.) 
Plaintiffs, however, point to specific interim operating covenants in the Merger 
Agreement that allegedly prevented PowerSchool from implementing layoffs affecting 
fifty or more employees without Bain’s explicit permission during the period between 
signing and closing. (Dkt. 342 at 18.) The Direct Action Plaintiffs further allege that 
Bain issued a layoff order in August 2024, eliminating approximately 175 employees. 
(Dkt. 288 ¶¶ 58, 60, 62.) 
At the pleading stage, Plaintiffs plausibly allege procurement of a breach. The “No 
Control” clause functions as a general disclaimer; the interim operating covenants are 
specific contractual provisions that gave Bain approval rights over layoffs above a 
defined threshold. Reading those provisions together and drawing reasonable inferences 
in Plaintiffs’ favor, the existence of those consent rights, combined with the alleged 
August 2024 layoffs, supports a plausible inference that Bain directed or approved the 
conduct which resulted in PowerSchool’s breach of its contracts with Plaintiffs. 
2. Intent 
Plaintiffs also adequately plead intent. The required mental state is satisfied if the 
defendant desired the breach or knew that interference was certain or substantially certain 
to occur as a result of its conduct. Quelimane Co. v. Stewart Title Guar. Co., 19 Cal. 4th 
26, 56 (1998). Intent may be pleaded generally. Fed. R. Civ. P. 9(b); see also Sun Life 
Assur. Co. of Canada v. Imperial Premium Fin., LLC, 904 F.3d 1197, 1215 (11th Cir. 
2018). 
Plaintiffs allege that Bain knew of PowerSchool’s cybersecurity-related contractual 
obligations and nevertheless directed PowerSchool to cut cybersecurity costs, fire 
 
10 (Dkt. 288. ¶¶ 55,58, 61, 63, 69, 71, 249; Dkt. 263 ¶¶ 7, 163-64 .) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 15 of 25
 
-16- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
cybersecurity staff, and outsource cybersecurity work. (Dkt. 288 ¶¶ 250–51; Dkt. 263 ¶¶ 
7, 163.) These are not generic allegations of cost-cutting. They concern security-related 
directives made with knowledge of the corresponding contractual duties. From those 
facts, a factfinder could infer that Bain knew its directives were likely to materially 
hinder PowerSchool’s performance. See Quelimane, 19 Cal. 4th at 56; Kronos, Inc. v. 
AVX Corp., 81 N.Y.2d 90, 94 (1993). 
3. Justification 
Whether Bain’s conduct was justified cannot be resolved on the pleadings. Under 
California law, “it is not necessary that defendant’s conduct be wrongful apart from the 
interference with the contract itself.” Quelimane, 19 Cal. 4th at 55. And whether a 
defendant acted with justification is generally “a matter for trial—not resolution on a 
motion to dismiss.” Id. at 56–57. 
4. Causation and breach 
Plaintiffs also plausibly allege causation and breach. They allege that Bain ordered 
layoffs of cybersecurity staff and outsourced cybersecurity functions to offshore 
contractors, including Defendant Movate, leaving PowerSchool’s security teams 
understaffed. They further allege that the December 2024 breach was carried out using 
stolen Movate credentials.11 That causal chain is sufficient at the pleading stage. See 
Bank of N.Y. v. Fremont Gen. Corp., 523 F.3d 902, 909–10 (9th Cir. 2008); Rutherford v. 
Owens-Illinois, Inc., 16 Cal. 4th 953, 969 (1997). 
Bain argues that unauthorized access began in August 2024, before the merger 
closed in October 2024. (Dkt. 303 at 34.) But Plaintiffs allege that Bain’s causal 
actions—including its approval of layoffs under the interim operating covenants and 
related directives— took place from June to October 2024, overlapping with the alleged 
initial intrusion. Whether Bain’s conduct preceded, followed, or coincided with the 
 
11 (Dkt. 288 ¶¶ 72–73.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 16 of 25
 
-17- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
intrusion is a factual question not suitable for resolution on a motion to dismiss. 
Plaintiffs also adequately allege breach. Both complaints identify contractual 
obligations in the PowerSchool Master Service Agreements with Plaintiffs requiring 
industry-standard security measures, including access controls, data encryption in transit 
and at rest, password rotation, monthly review of access credentials, multi-factor 
authentication, endpoint protection, and related safeguards. (Dkt. 288 ¶¶ 49, 53, 336; 
Dkt. 263 ¶¶ 1, 30, 68.) Plaintiffs allege that PowerSchool failed to maintain those 
standards. At this stage, Plaintiffs may plausibly assert that the staffing and outsourcing 
measures allegedly directed by Bain contributed to that failure. 
Accordingly, Bain’s motion to dismiss the direct-liability claims for intentional 
interference with contractual relations is denied. 
B. CFAA Conspiracy (Class Action Count 4) 
Class Action Plaintiffs assert a federal CFAA claim against Bain under 18 U.S.C. § 
1030(g), citing the conspiracy provision in § 1030(b). They have confirmed they do not 
pursue direct-liability theories under §§ 1030(a)(2)(C) or (a)(5)(C). (Dkt. 342. at 22.12) 
To plead civil conspiracy under § 1030(b), a plaintiff must allege that the 
defendant and a co-conspirator “reached some explicit or tacit understanding or 
agreement” to commit a CFAA violation. Alfus v. Pyramid Tech. Corp., 745 F. Supp. 
1511, 1521 (N.D. Cal. 1990); NetApp, Inc. v. Nimble Storage, Inc., 41 F. Supp. 3d 816, 
835–36 (N.D. Cal. 2014). 
The Class Complaint does not plausibly allege such an agreement. It asserts that 
Bain and PowerSchool “entered into a common scheme to access information” (Dkt. 263 
¶ 206) and that Bain “knowingly authorized or ratified PowerSchool’s use of a Backdoor 
 
12 See Stichting Pensioenfonds ABP v. Countrywide Fin. Corp., 802 F. Supp. 2d 1125, 
1132 (C.D. Cal. 2011), By failing to respond to Bain’s arguments regarding direct 
liability under §§ 1030(a)(2)(C) and (a)(5)(C), Class Action Plaintiffs have waived those 
theories. 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 17 of 25
 
-18- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Access Tool that bypassed bargained-for consent and access protocols.” (Id. ¶¶ 203–06). 
Those allegations are too conclusory. A “common scheme” allegation is the sort of bare 
assertion NetApp found insufficient. 41 F. Supp. 3d at 836–37. Allegations of 
authorization, ratification, or oversight, without more, do not establish a conspiratorial 
agreement directed toward unlawful computer access. The Merger Agreement’s 
disclaimer of Bain’s control over PowerSchool’s pre-closing operations further 
undermines the plausibility of any agreement during that period. 
The intent allegations are likewise inadequate. The CFAA requires intentional 
unauthorized access. 18 U.S.C. §§ 1030(a)(2)(C), (a)(5)(C). To establish liability for 
conspiracy, Plaintiffs must plausibly allege that Bain intended to advance the unlawful 
objective. See Contreras v. Dowling, 5 Cal. App. 5th 394, 416–17 (2016). Even 
accepting the allegations that Bain “was aware, or recklessly disregarded” PowerSchool’s 
commitments and “knowingly authorized or ratified” the use of the access tool, those 
allegations do not plausibly show that Bain intended to commit unauthorized computer 
access. Knowledge of a portfolio company’s operations and contracts, standing alone, 
does not establish the specific intent the CFAA requires. See Kirby ex rel. Kirby 2014 Tr. 
v. AT&T Corp., 2022 WL 17184565, at *5–6 (S.D. Cal. Nov. 23, 2022). 
Finally, conspiracy liability under § 1030(b) cannot stand in the absence of 
sufficient allegations of an underlying substantive CFAA violation by PowerSchool 
itself. See Welenco, Inc. v. Corbell, 126 F. Supp. 3d 1154, 1176 (E.D. Cal. 2015). To the 
extent the predicate CFAA theory against PowerSchool is deficient, the derivative 
conspiracy theory against Bain necessarily fails as well. 
Accordingly, Bain’s motion to dismiss the CFAA conspiracy claim is granted 
without prejudice. 
C. CDAFA (Class Action Count 5) 
The Class Action Plaintiffs also assert a claim under the CDAFA, Cal. Penal Code 
§ 502, invoking §§ 502(c)(3), (c)(6), and (c)(7). The CDAFA allegations are 
insufficiently pleaded to Bain. 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 18 of 25
 
-19- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
The operative allegations largely track the statutory language, alleging that 
PowerSchool and Bain acted “knowingly” and “without permission” to “access[], us[e], 
or damage[]” data and “caus[e] unauthorized access.” (Dkt. 263 ¶ 222.) Such allegations 
primarily restate the statute. See Whitaker v. Tesla Motors, Inc., 985 F.3d 1173, 1176–77 
(9th Cir. 2021). 
The allegation that Bain “knowingly authorized” and “directed” the Backdoor Tool 
(Dkt. 263 ¶¶ 7, 203) is itself conclusory. The complaint does not identify with sufficient 
factual detail what Bain did to deploy, direct, or cause deployment of the tool or why it 
would cause deployment. And because the tool was allegedly installed during the pre-
closing period, the Merger Agreement’s “No Control” clause further undermines the 
plausibility that Bain directed that conduct at that time. 
The CDAFA claim also relies on impermissible group pleading. The operative 
allegations are directed at “Defendants” collectively. Because the Class Action Plaintiffs 
disclaim alter ego and other vicarious-liability theories as to Bain, they must plead Bain-
specific conduct. They do not. See Doe v. Camp Pendleton & Quantico Hous. LLC, 
2020 WL 1890576, at *7 (S.D. Cal. Apr. 16, 2020); Horton v. NeoStrata Co. Inc., 2016 
WL 11622008, at *3–4 (S.D. Cal. Nov. 22, 2016). 
Accordingly, Bain’s motion to dismiss the CDAFA claim is granted without 
prejudice. 
D. Bain-Specific Pleading 
Because the Class Action Plaintiffs disclaim any alter ego or other vicarious-
liability theory as to Bain, their direct claims against Bain must rest on Bain-specific 
conduct. “Lumping” multiple defendants together with broad allegations does not 
provide the notice Rule 8 requires. See Camp Pendleton, 2020 WL 1890576, at *7; 
Better Homes Realty, Inc. v. Watmore, 2017 WL 1400065, at *4 (S.D. Cal. Apr. 18, 
2017); Horton, 2016 WL 11622008, at *3–4. 
That deficiency warrants dismissal of the CFAA and CDAFA counts, but it does 
not justify dismissal of the remaining direct-liability claims at this stage. Although those 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 19 of 25
 
-20- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
remaining counts sometimes refer to “Defendants” collectively, the complaint elsewhere 
attributes specific conduct to Bain—namely, reducing cybersecurity spending and 
staffing, outsourcing cybersecurity functions to contractors including Movate, and 
implementing cost-cutting measures that allegedly benefited Bain financially.13 Those 
allegations are sufficient to provide Bain notice of the conduct at issue 
E. Negligence (Class Action Count 3) 
Plaintiffs plausibly state a negligence claim against Bain. To state a claim for 
negligence, Plaintiffs must allege duty, breach, causation, and damages. Brown v. USA 
Taekwondo, 11 Cal. 5th 204, 213 (Cal. 2021); Regents of University of California v. 
Superior Court, 4 Cal. 5th 607, 619 (Cal. 2018). 
1. Duty 
Bain argues that it had no duty to protect Plaintiffs from harm caused by third-
party threat actors and that any such duty rests solely with PowerSchool. (Dkt. 303 at 
46.) The Court disagrees. Plaintiffs do not allege a generalized duty to prevent all third-
party misconduct. Rather, they allege that Bain, through its own decisions, contributed to 
creating the cybersecurity vulnerabilities that enabled the breach. On that theory, the 
asserted duty arises from Bain’s own conduct in directing or controlling the security-
related decisions at issue. See Cabral v. Ralphs Grocery Co., 51 Cal. 4th 764, 768 
(2011). 
Plaintiffs also adequately plead foreseeability. They allege that Bain understood 
the importance of data security, knew that student PII data is valuable and targeted by 
criminals, that data breaches were a common and foreseeable risk, and nonetheless 
directed reductions in cybersecurity staffing and outsourced cybersecurity functions to 
unguarded contractors whose credentials were later used to access the system.
14 
Accepting those allegations as true, Plaintiffs plausibly allege that Bain owed a duty of 
 
13 (Dkt. 263 ¶¶ 47, 87, 89, 92, 99–101, 103, 126, 163, 168–83, 246–62.) 
14 (Dkt. 263 ¶¶ 1, 32, 47, 87, 89, 92, 163.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 20 of 25
 
-21- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
reasonable care in directing the security measures and contractor access it allegedly put in 
place. 
2. Breach 
Plaintiffs also plausibly allege breach. They identify the relevant standard of care 
as basic, industry-standard cybersecurity protections, including access controls, credential 
review, multi-factor authentication, endpoint protection, and related safeguards. They 
allege that Bain had the authority and responsibility to ensure that PowerSchool 
implemented those protections, but instead directed decisions that weakened them 
through cost-cutting and outsourcing. At the pleading stage, that is sufficient. See In re 
Data Breach Sec. Litig. Against Caesars Ent. Inc., 2025 WL 2393024, at *8. 
3. Causation 
Causation ordinarily presents a factual question not suitable for resolution on a 
motion to dismiss. See Huynh v. Quora, Inc., 508 F. Supp. 3d 633, 650–51 (N.D. Cal. 
2020) (quoting Lies v. Farrell Lines, Inc., 641 F.2d 765, 770 (9th Cir. 1981)); see also In 
re GEICO Customer Data Breach Litig., 691 F. Supp. 3d 624, 632 (E.D.N.Y. 2023). 
Here, Plaintiffs allege a plausible causal chain: Bain directed offshoring and cost-
cutting affecting cybersecurity; those decisions weakened PowerSchool’s cybersecurity 
infrastructure; and the breach was later carried out using stolen Movate credentials after 
cybersecurity functions had been outsourced to that contractor.15 At the pleading stage, 
that is enough. The involvement of Movate or third-party threat actors does not break the 
chain of causation because, on Plaintiffs’ theory, those were foreseeable consequences of 
weakened cybersecurity controls over valuable and sensitive data. See Lugtu v. 
California Highway Patrol, 26 Cal. 4th 703, 725 (2001). 
4. Damages 
Bain also argues that Plaintiffs’ damages are too indirect and not adequately tied to 
 
15 (Dkt. 263 ¶¶ 47, 87, 89, 92, 163.) 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 21 of 25
 
-22- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Bain’s conduct. The Court disagrees. Plaintiffs allege that data was exfiltrated in the 
breach and that they suffered resulting harm. At the pleading stage, those alleged losses 
are sufficiently direct to support a negligence claim. Vavak v. Abbott Lab’y, Inc., No. CV 
10-01995-SVW-JCX, 2011 WL 13130493 (C.D. Cal. Mar. 7, 2011), is distinguishable 
because there the defendant’s product was not connected to the plaintiff’s injury. Here, 
Plaintiffs allege a direct link between Bain’s challenged conduct, the weakening of 
PowerSchool’s cybersecurity, the breach, and the resulting harm. 
Accordingly, Bain’s motion to dismiss the negligence claim is denied. 
Bain also joins PowerSchool’s arguments that the negligence claim is barred by the 
economic loss doctrine under New Jersey and California law and is duplicative of 
contract claims under New York law. (Dkt. 379 at 22 n.21; Dkt. 303 at 44 n.31.) 
Because those arguments were developed in separate briefings and adopted by Bain 
through joinder rather than independent analysis, the Court reserves ruling on those 
grounds. Nothing in this Order precludes Bain from raising those arguments at the 
appropriate time. 
F. Negligence Per Se 
Class Action Plaintiffs claim that Bain is liable under the doctrine of negligence per se 
based on violating data protection laws. (Dkt. 302) Bain argues these statutes do not 
impose duties on it, and Plaintiffs do not respond adequately. (Dkt. 303 at 45 n.33; Dkt. 
379 at 22 n.21.) For negligence per se, the defendant must violate a law protecting the 
plaintiff’s class from the harm suffered. See Software Designs & Application, LTD v. 
Hoefer & Arnett, Inc., 49 Cal. App. 4th 474, 482 (Cal. Ct. App. 1996). Plaintiffs cite 
statutes imposing obligations on data collectors, but it is not alleged that Bain collected or 
handled the PII data; PowerSchool did. (Dkt. 263 ¶¶ 172(b)–(h), 173.) Each of these 
provisions, however, imposes obligations on entities that collect, store, maintain, or 
process personal data. See Modisette v. Apple Inc., 30 Cal. App. 5th 136, 152 (2018) 
(proximate causation is an issue of law “where the facts are such that the only reasonable 
conclusion is an absence of causation”). An investor in a data handler is not necessarily 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 22 of 25
 
-23- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
liable. Plaintiffs also cannot argue Bain oversaw PowerSchool’s operations to extend 
obligations. Even if statutes applied, causation is speculative: Plaintiffs link Bain’s cost-
cutting policies to PowerSchool’s violations, but this is unsupported. Bain’s motion to 
dismiss the negligence per se claim is granted. 
G. Unjust Enrichment (Class Action Count 7) 
Bain argues Count 7 should be dismissed for two reasons. First, Bain contends that 
unjust enrichment is not a standalone cause of action under the law invoked by the 
Plaintiffs. Second, Bain argues Plaintiffs do not plausibly allege that Bain received or 
retained any direct benefit at Plaintiffs’ expense. Bain emphasizes that any payments 
made by Plaintiffs were payments made under contracts with PowerSchool, not Bain, and 
that Plaintiffs’ overpayment allegations concern PowerSchool alone. (Dkt. 303 at 48-49; 
Dkt. 388 at 8.) 
In opposition, Plaintiffs argue that unjust enrichment may proceed through a quasi-
contract theory and does not require privity. Plaintiffs further contend they sufficiently 
allege Bain received a benefit because Bain “received some of the money that Plaintiffs 
paid to PowerSchool” and also benefitted from cost-cutting measures that allegedly 
improved Bain’s bottom line. (Dkt. 342 at 33-34.) 
In reply, Bain argues that Plaintiffs still do not identify any non-conclusory factual 
allegations showing that Plaintiffs conferred any benefit on Bain, in contrast to 
PowerSchool. Bain further argues that the authorities Plaintiffs cite do not cure that 
defect because, unlike here, those cases involved allegations that the defendant itself was 
paid by the plaintiff or directly profited from storing or retaining the plaintiff’s data. 
(Dkt. 379 at 25-26; Dkt. 388 at 8.) 
The Court agrees with Bain that Count 7 is not plausibly pleaded. Even assuming 
Plaintiffs may seek restitutionary relief under an unjust-enrichment or quasi-contract 
theory, the allegations described in the briefing do not plausibly demonstrate that Bain 
received and unjustly retained a concrete benefit conferred by Plaintiffs. Plaintiffs’ 
theory remains that their schools paid money directly to PowerSchool under software 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 23 of 25
 
-24- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
contracts and that Bain, by virtue of its relationship with PowerSchool, indirectly 
benefited from those payments and from alleged cost-cutting. But Plaintiffs seem not to 
identify any non-conclusory factual allegations showing what benefit was actually 
transferred to Bain, how Plaintiffs themselves conferred that benefit on Bain rather than 
PowerSchool, or how Bain’s alleged gain was anything more than an attenuated 
downstream consequence of payments made to another entity. (Dkt. 303 at 49; Dkt. 379 
at 25-26.) 
Plaintiffs’ response does not cure that deficiency. Their assertion that Bain 
received “some of the money” paid to PowerSchool and profited from reduced security 
spending remains stated at a high level of generality and without factual allegations that 
would make it plausible that Plaintiffs directly or specifically conferred a benefit on Bain. 
And Plaintiffs’ own theory, as presented in the briefing, depends on contracts and 
payments involving PowerSchool, not Bain. (Dkt. 342 at 33-34; Dkt. 303 at 49.) 
Accordingly, Bain’s motion to dismiss Count 7 for unjust enrichment is granted. 
H. Declaratory Judgment and Injunctive Relief (Class Action Count 8) 
The Declaratory Judgment Act provides a remedy, not an independent cause of 
action. City of Reno v. Netflix, Inc., 52 F.4th 874, 878–79 (9th Cir. 2022). Declaratory 
relief requires an “actual controversy” that is “definite and concrete . . . real and 
substantial.” Aetna Life Ins. Co. v. Haworth, 300 U.S. 227, 240–41 (1937). 
Because Plaintiffs’ negligence claim survives, an actual controversy remains. 
Plaintiffs’ request for declaratory relief is predicated on that surviving claim, which is 
sufficient at this stage. For the same reason, Plaintiffs’ request for injunctive relief may 
proceed as a form of prospective relief tied to a surviving substantive claim. 
Accordingly, Bain’s motion to dismiss the claim for declaratory judgment and 
injunctive relief is denied. 
IV. LEAVE TO AMEND AND DISCOVERY SCHEDULE 
All dismissals in this Order are without prejudice. Under Ninth Circuit law, leave 
to amend should be granted unless the pleading cannot be cured by additional factual 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 24 of 25
 
-25- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
allegations. See Cook, Perkiss & Liehe, 911 F.2d 242, 247 (1990). The Court concludes 
that the deficiencies identified here are factual rather than legal defects. Bain’s request 
for dismissal with prejudice is therefore denied. 
V. CONCLUSION 
For the reasons set forth above, Bain’s motion to dismiss is denied in part and 
granted in part as follows: 
The motion is DENIED as to: 
1. personal jurisdiction over Bain with respect to the Direct Action Plaintiffs; 
2. the direct liability claims for intentional interference with contractual relations; 
3. the Class Action Plaintiffs’ negligence claim; and 
4. the Class Action Plaintiffs’ request for declaratory and injunctive relief. 
The motion is GRANTED without prejudice as to: 
1. personal jurisdiction over Bain with respect to the Class Action Plaintiffs; 
2. the Direct Action Plaintiffs’ alter ego theories; 
3. the Class Action Plaintiffs’ CFAA conspiracy claim; 
4. the Class Action Plaintiffs’ CDAFA claim; 
5. negligence per se; and 
6. the Class Action Plaintiffs’ unjust-enrichment claim. 
IT IS SO ORDERED. 
DATED: March 18, 2026 
 HON. ROGER T. BENITEZ 
United States District Judge 
 
Case 3:25-md-03149-AJB-MSB Document 435 Filed 03/18/26 PageID.<pageID> 
Page 25 of 25

Passage view · GavelSight