govinfo:USCOURTS-casd-3_25-md-03149-7

-1- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
 
 
 
 
 
 
UNITED STATES DISTRICT COURT 
SOUTHERN DISTRICT OF CALIFORNIA 
 
IN RE: POWERSCHOOL 
HOLDINGS, INC. AND 
POWERSCHOOL GROUP, LLC 
CUSTOMER SECURITY BREACH 
LITIGATION. 
 
) 
) 
) 
) 
) 
) 
) 
) 
) 
) 
) 

 
ORDER GRANTING IN PART AND 
DENYING IN PART DEFENDANT 
MOVATE, INC.’S MOTION TO 
DISMISS THE CONSOLIDATED 
INDIVIDUAL USERS CLASS 
ACTION COMPLAINT 
(TRACK 1) 
 
[ECF No. 317] 
I. INTRODUCTION 
Plaintiffs, both individually and on behalf of similarly situated class members, 
bring this lawsuit against Defendants PowerSchool Holdings, Inc. and PowerSchool 
Group, LLC (collectively “PowerSchool”), Bain Capital, LP (“Bain”), and Movate, Inc. 
(“Movate”). Plaintiffs claim that the Defendants did not adequately protect Personally 
Identifiable Information (“PII”) and Private Health Information (“PHI”) stored in 
PowerSchool’s software products. 
Movate seeks dismissal under Federal Rules 12(b)(1), (2),(5), and (6), arguing: (1) 
lack of personal jurisdiction; (2) claims by 51 new plaintiffs lack subject-matter 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 1 of 37
 
-2- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
jurisdiction; (3) Plaintiffs lack Article III standing; and (4) the Complaint fails to state a 
claim. (ECF No. 317.) This Order applies only to Movate. 
For the reasons set out below, Movate’s motion is DENIED AS MOOT as to 
subject-matter jurisdiction and service of process; DENIED as to personal jurisdiction; 
DENIED as to Article III standing; DENIED as to negligence; DENIED as to 
negligence per se; DENIED as to negligent hiring and supervision; GRANTED as to 
invasion of privacy; DENIED as to breach of fiduciary duty; GRANTED as to unjust 
enrichment; and GRANTED as to declaratory judgment. 
II. BACKGROUND1 
Movate is a Delaware corporation headquartered in Texas. It functions as a global 
outsourcing firm. Around July 2024, PowerSchool hired Movate to provide technical 
support, customer service, network operations, and platform configuration for its online 
platform. According to the Complaint, PowerSchool gave Movate employees extensive 
access to the SIS and sensitive PII of students, their families, faculty, and teachers. 
Around December 28, 2024, PowerSchool detected a data breach affecting 
students, parents, faculty, and teachers. Plaintiffs claim that the stolen data included 
contact information such as names and addresses, Social Security numbers, grades, and 
medical details like special needs and vaccination records. Plaintiffs also allege that 
unknown threat actors obtained this information through an unspecified method and that 
PowerSchool paid a ransom to keep the stolen data from being released. PowerSchool 
publicly confirmed the breach on January 7, 2025. 
 
1 (ECF No. 259 ¶ 4) PowerSchool, a California-based company, offers educational 
software nationwide, including enrollment, curriculum, teacher recruitment, and its 
Student Information System (SIS) with students’ data. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 2 of 37
 
-3- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Plaintiffs claim that PowerSchool knew, or should have known, that it lacked basic 
cybersecurity protections for SIS, thereby increasing the risk of a breach. Among other 
things, Plaintiffs allege that PowerSchool did not require multi-factor authentication, did 
not require password changes, and allowed access to PII and PHI2 by individuals who did 
not need that information to perform their jobs. 
Regarding the breach, Plaintiffs claim that the attackers used the credentials of 
Rayson Cruz, a Movate employee in the Philippines with access to PowerSchool’s SIS. 
Multiple school districts reportedly identified a “Remote Support connection from the 
user ‘Rayson Cruz’” as a key sign of compromise. Plaintiffs also assert that Movate 
failed to implement basic, industry-standard security measures, including credential 
rotation, multi-factor authentication, restrictions on employee access to PII, and proper 
training and supervision for employees and vendors. 
In July 2025, 19-year-old college student Matthew D. Lane pleaded guilty to 
federal charges related to the PowerSchool cyberattack. Plaintiffs claim, however, that 
an unknown number of threat actors might still have the stolen PII and PHI and could use 
it indefinitely to cause harm through tactics such as phishing, hacking, fraudulent benefit 
claims, tax fraud, extortion, or opening and compromising financial accounts. 
Plaintiffs argue that, in addition to existing cases of fraud and identity theft, there 
is a significant risk of future harm because their Social Security numbers and other 
sensitive data may have been compromised. They also state that the Defendants delayed 
notifying affected individuals of the breach by approximately two weeks, which 
prevented them from taking protective measures sooner. 
 
 
2 (ECF No. 262 at 2-3) Notice of Errata. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 3 of 37
 
-4- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
III. APPLICABLE LAW 
Under Rule 12(b)(1), a complaint may be dismissed when it fails to allege facts 
sufficient to establish subject-matter jurisdiction. In re Dynamic Random Access Memory 
(DRAM) Antitrust Litig., 546 F.3d 981, 984–85 (9th Cir. 2008). Article III standing 
requires a plaintiff to allege facts showing an injury in fact that is fairly traceable to the 
defendant’s conduct and likely to be redressed by a favorable decision. Spokeo, Inc. v. 
Robins, 578 U.S. 330, 338–39 (2016). 
Under FRCP Rule 12(b)(2), “[i]n general, the court may exercise personal 
jurisdiction over an out of state defendant consistent with both the forum state’s long-arm 
statute and constitutional due process.” Palomar Health v. Am. Guar. & Liab. Ins. Co., 
2021 WL 4035005, at *2 (S.D. Cal. Sept. 3, 2021), aff’d, 2022 WL 3006356 (9th Cir. 
July 28, 2022). “Where . . . the motion is based on written materials and affidavits rather 
than an evidentiary hearing, a plaintiff is only required to make a ‘prima facie showing of 
jurisdictional facts to withstand the motion to dismiss.’” Id.; Schwarzenegger v. Fred 
Martin Motor Co., 374 F.3d 797, 800 (9th Cir. 2004); Tokio Marine & Nichido Fire Ins. 
Co. v. Precision Trucking, 2009 U.S. Dist. LEXIS 139910, at *7 (S.D. Cal. Oct. 16, 
2009). 
 In determining whether a plaintiff has satisfied his burden, uncontroverted 
allegations in the complaint are taken as true. Id. On the other hand, bare bones 
assertions of minimum contacts with the forum or legal conclusions unsupported by 
specific factual allegations do not carry a plaintiff’s pleading burden. Id. (citing Swartz v. 
KPMG LLP, 476 F.3d 756, 766 (9th Cir. 2007)). 
Specific jurisdiction requires a showing that: (1) the defendant purposefully 
availed itself of the forum or purposefully directed its activities toward the forum; (2) the 
claim arises out of or relates to the forum-related conduct; and (3) the exercise of 
jurisdiction would be reasonable. Schwarzenegger, 374 F.3d at 802. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 4 of 37
 
-5- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
 
Under Rule 12(b)(5), Plaintiffs bear the burden of showing that service was valid 
under Rule 4. Brockmeyer v. May, 383 F.3d 798, 801 (9th Cir. 2004). 
A motion to dismiss under FRCP 12(b)(6) tests the legal sufficiency of the claims 
alleged in the complaint. Under FRCP 8, a complaint should include a “short and plain 
statement of the claim showing that the pleader is entitled to relief,” and may be 
dismissed under Rule 12(b)(6) if the plaintiff fails to state a cognizable legal theory or 
has not alleged sufficient facts to support such a theory. Somers v. Apple, Inc., 729 F.3d 
953, 959 (9th Cir. 2013). The court construes the alleged facts in the light most favorable 
to the plaintiff. See Retail Prop. Trust v. United Bhd. of Carpenters & Joiners of Am., 
768 F.3d 938, 945 (9th Cir. 2014). However, “courts are not bound to accept as true a 
legal conclusion couched as a factual allegation.” Iqbal, 556 U.S. at 678. 
To survive a motion to dismiss, a complaint must state a claim to relief that is 
plausible on its face. Iqbal, 556 U.S. at 678 (quoting Bell Atl. Corp. v. Twombly, 550 
U.S. 544, 570 (2007)). A claim has “facial plausibility when the plaintiff pleads factual 
content that allows the court to draw the reasonable inference that the defendant is liable 
for the misconduct alleged.” Twombly, 550 U.S. at 556. If the plaintiff’s explanation is 
plausible, the complaint survives a motion to dismiss under Rule 12(b)(6), “regardless of 
whether there is a more plausible alternative explanation.” Iqbal, 556 U.S. at 678. 
Thus, a “Rule 12(b)(6) motion tests the sufficiency of a complaint; it does not . . . 
resolve contests surrounding the facts, the merits of the claim, or the applicability of 
defenses.” W. Ins. Co. v. Frontier Homes, LLC, 2018 WL 8220544, at *2 (C.D. Cal. 
Mar. 27, 2018) (quoting King v. Rubenstein, 825 F.3d 206, 214 (4th Cir. 2016)). 
 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 5 of 37
 
-6- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
IV. DISCUSSION 
A. Article III Standing 
Movate argues there is no Article III standing. “[T]hose who seek to invoke the 
jurisdiction of the federal courts must satisfy the threshhold [sic] requirement imposed by 
Article III of the Constitution by alleging an actual case or controversy.” City of Los 
Angeles v. Lyons, 461 U.S. 95, 101 (1983). Article III standing requires plausible 
allegations that: (1) the plaintiff suffered an injury in fact that is concrete, particularized, 
and actual or imminent; (2) the injury is fairly traceable to the defendant; and (3) a 
favorable decision would likely redress the injury. TransUnion LLC v. Ramirez, 594 U.S. 
413, 423 (2021); Friends of the Earth, Inc. v. Laidlaw Env’t Servs., Inc., 528 U.S. 167, 
180–81 (2000). 
 Both sides agree this is the standard. Instead, the parties disagree about the nature 
and qualities of an injury-in-fact in a data breach case and what court decisions guide the 
decision-making. These issues are discussed and addressed at length in the companion 
Order deciding Powerschool Holdings, Inc.’s and Powerschool Group, LLC’s Motion to 
Dismiss and that reasoning is adopted here. Consistent therewith, Plaintiffs have at this 
point in the litigation plausibly alleged facts demonstrating all of the standing 
requirements of Article III and compensable damages to proceed to class certification and 
summary judgment. 
B. Associational Standing 
To establish associational standing, a plaintiff must show: (1) its members would 
otherwise have standing to sue in their own right; (2) the interests it seeks to protect are 
germane to the organization’s purpose; and (3) neither the claim asserted nor the relief 
requested requires the participation of individual members in the lawsuit. “An 
association has standing to bring suit on behalf of its members when its members would 
otherwise have standing to sue in their own right, the interests at stake are germane to the 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 6 of 37
 
-7- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
organization's purpose, and neither the claim asserted nor the relief requested requires the 
participation of individual members in the lawsuit.” Friends of the Earth, Inc. v. Laidlaw 
Env't Servs. (TOC), Inc., 528 U.S. 167, 181 (2000) (citing Hunt v. Washington State 
Apple Advertising Comm'n, 432 U.S. 333, 343 (1977)). 
Movate argues that the Providence Teachers Union (PTU) lacks associational 
standing because it has not identified an injured constituent. (ECF Nos. 317 at 8; 369 at 
7.) Movate relies on In re Equifax, Inc., Customer Data Security Breach Litigation, 371 
F. Supp. 3d 1150, 1165 (N.D. Ga. 2019), where the court found that the organization’s 
failure to identify any injured constituent defeated associational standing. 
Beginning with the first prong, the PTU alleges that its members provided medical 
information that was entered into PowerSchool’s SIS and was compromised in the 
breach. (ECF No. 259 ¶ 749.) PTU further alleges that its members suffered concrete 
injuries, including the diversion of resources in response to the breach. (MC ¶¶ 34, 750.) 
Unlike in Equifax, where the organization failed entirely to identify injured constituents, 
PTU’s allegations identify both the type of data compromised and the resulting injuries 
its members suffered. Movate’s reliance on Equifax is therefore misplaced. PTU has 
adequately alleged that its members would have standing to sue in their own right. 
As to the second and third prongs, Plaintiffs allege common legal and factual 
questions, including those related to damages. (MC ¶ 763.) These interests are germane 
to PTU’s organizational purpose, and the common questions can be resolved without 
requiring the participation of individual union members in the lawsuit. 
Accordingly, the Court finds that at this stage, PTU has made a plausible showing 
of associational standing to survive a motion to dismiss. Movate’s motion to dismiss for 
lack of Article III standing is DENIED. 
C. Subject-Matter Jurisdiction and Service of Process 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 7 of 37
 
-8- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Movate contends that the Court lacks subject-matter jurisdiction over 51 newly 
added plaintiff groups because they were not transferred to this Court by the Judicial 
Panel on Multidistrict Litigation and did not initially file short-form complaints under the 
Court’s Direct Filing Order. (ECF No. 317 at 12.) Movate separately contends that these 
Plaintiffs have not been properly served under Rule 12(b)(5). (ECF No. 317 at 8 n.5.) 
Both arguments are moot. On October 10, 2025, Plaintiffs filed a Short Form 
Complaint with the Clerk’s Office per the Direct Filing Order, and provided it to 
Movate’s counsel on October 13, 2025. (ECF No. 353 at 3.) The filing cured the 
procedural deficiency underlying both arguments. 
Movate’s motion to dismiss for lack of subject-matter jurisdiction and insufficient 
service of process is DENIED AS MOOT. 
D. Personal Jurisdiction 
Movate is a Delaware corporation with its principal place of business in Texas. 
The Court therefore lacks general jurisdiction over Movate, and Plaintiffs do not contend 
otherwise. The question is whether the Court may exercise specific jurisdiction. 
1. Purposeful Availment 
The parties dispute whether purposeful direction or purposeful availment provides 
the correct analytical framework. Plaintiffs rely on purposeful direction, arguing that this 
is a tort case and that Movate’s conduct was aimed at California. (ECF No. 353 at 3–9.) 
Movate responds that the case sounds in negligence and that purposeful availment is the 
more appropriate framework. (ECF Nos. 317 at 9–12; 369 at 3–6.) The Court agrees 
with Movate. In cases involving negligence or contract-like conduct, courts analyze 
whether the defendant engaged in acts demonstrating purposeful availment rather than 
Calder-style purposeful direction. See Schwarzenegger v. Fred Martin Motor Co., 374 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 8 of 37
 
-9- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
F.3d 797, 802–03 (9th Cir. 2004); Holland Am. Line Inc. v. Wartsila N. Am., Inc., 485 
F.3d 450, 460 (9th Cir. 2007); Matter of Star & Crescent Boat Co., 549 F. Supp. 3d 1145, 
1162 (S.D. Cal. 2021). 
The “‘purposeful availment’ requirement ensures that a defendant will not be haled 
into a jurisdiction solely as a result of ‘random,’ ‘fortuitous,’ or ‘attenuated’ contacts, or 
of the ‘unilateral activity of another party or a third person.’” Burger King Corp. v. 
Rudzewicz, 471 U.S. 462, 475 (1985) (internal citations omitted). A showing of 
purposeful availment “typically consists of evidence of the defendant’s actions in the 
forum, such as executing or performing a contract there.” Schwarzenegger, 374 F.3d at 
802. 
Under that framework, Plaintiffs have made a prima facie showing. Plaintiffs 
allege that Movate entered into a contract with PowerSchool, a California-based 
company, to provide technical support, customer service, network operations, and 
configuration services for PowerSchool’s SIS. (ECF No. 259 ¶¶ 20, 47, 116–20.) 
Plaintiffs further assert that, under that contract, Movate accessed California computer 
systems, including PowerSchool’s SIS, and provided services to PowerSchool’s 
California school-district customers. (ECF No. 353 at 5–7.) 
Movate argues that entering into a contract with PowerSchool does not, by itself, 
constitute purposeful availment. (ECF Nos. 317 at 9–12; 369 at 3–6.) Movate contends 
that Plaintiffs have not alleged that Movate negotiated, executed, or performed the 
contract in California, and that the contract covered a nationwide software platform rather 
than a California-specific project. These arguments are unpersuasive at this stage. 
Although Movate performed its contractual obligations remotely, it knew or reasonably 
should have known that by entering into a contract with PowerSchool, it would be 
assuming control over sensitive personal information belonging to students, teachers, and 
parents in California. The fact that the contract may have encompassed other states does 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 9 of 37
 
-10- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
not shield Movate from jurisdiction in California. If it did, no state could exercise 
personal jurisdiction over Movate simply because it entered into a nationwide contract. 
Moreover, by continually accessing and maintaining the personal information of 
California residents through PowerSchool’s SIS, Movate sustained an ongoing 
relationship connected to California that goes beyond the sort of random, fortuitous, or 
attenuated contacts that Burger King holds insufficient. See Burger King, 471 U.S. at 
475–76, 480. Accordingly, Plaintiffs have adequately alleged purposeful availment. 
2. Relatedness 
Under the second prong, the Court must determine whether Plaintiffs’ claims arise 
from or relate to Movate’s forum-related activities. This inquiry turns on whether 
Plaintiffs would not have been injured “but for” the defendant’s forum-related conduct. 
See Panavision Int’l, L.P. v. Toeppen, 141 F.3d 1316, 1322 (9th Cir. 1998). 
Plaintiffs allege that the breach occurred through the misuse of credentials 
belonging to Rayson Cruz, a Movate employee in the Philippines who had access to 
PowerSchool’s SIS. (ECF No. 259 ¶¶ 116–20.) Plaintiffs further allege that Movate 
failed to implement basic, industry-standard security measures--including credential 
rotation, multi-factor authentication, restrictions on employee access to PII, and adequate 
training and supervision--that would have prevented or mitigated the breach. (ECF No. 
259 ¶¶ 123–28.) These injuries resulted from Movate’s performance under its contract 
with a California-based company, pursuant to which it provided services to California-
based customers and accessed systems containing the sensitive information of California 
residents. Accepting those allegations as true, Plaintiffs’ claims stem directly from 
Movate’s forum-related conduct and demonstrate the “something more” required. See 
Panavision Int’l, L.P. v. Toeppen, 141 F.3d 1316, 1322 (9th Cir. 1998). Thus, relatedness 
has been adequately pled. 
3. Reasonableness 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 10 of 37
 
-11- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Once the first two prongs are satisfied, the forum’s exercise of jurisdiction is 
presumptively reasonable, and the burden shifts to the defendant to present a compelling 
case that jurisdiction would be unreasonable. Glob. Commodities Trading Grp., Inc. v. 
Beneficio de Arroz Choloma, S.A., 972 F.3d 1101, 1107 (9th Cir. 2020); Roth v. Garcia 
Marquez, 942 F.2d 617, 625 (9th Cir. 1991). Courts consider seven factors: (1) the extent 
of the defendant’s purposeful interjection into the forum state’s affairs; (2) the burden on 
the defendant of defending in the forum; (3) the extent of conflict with the sovereignty of 
the defendant’s state; (4) the forum state’s interest in adjudicating the dispute; (5) the 
most efficient judicial resolution of the controversy; (6) the importance of the forum to 
the plaintiff’s interest in convenient and effective relief; and (7) the existence of an 
alternative forum. CollegeSource, Inc. v. AcademyOne, Inc., 653 F.3d 1066, 1079 (9th 
Cir. 2011); see also Burger King, 471 U.S. at 476–77. 
Movate has not met its burden. The Court considers the relevant factors. 
Movate’s interjection into California is substantial: it contracted with a California-
headquartered company, accessed California computer systems containing the sensitive 
data of California residents, and provided ongoing services to California school districts. 
California’s interest in adjudicating claims involving the alleged compromise of sensitive 
information belonging to its residents is significant. The JPML’s consolidation of this 
MDL in this District confirms that California promotes efficient judicial resolution. 
Movate does not argue that litigating in California would create a conflict with the 
sovereignty of Delaware or Texas, nor does it identify specific burdens that would make 
defending here unreasonable. While Delaware or Texas might serve as alternative 
forums, the existence of an alternative forum does not render California unreasonable 
when the other factors support jurisdiction. 
Movate has not presented a compelling case that jurisdiction would be 
unreasonable. Therefore, Movate’s motion to dismiss for lack of personal jurisdiction is 
DENIED. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 11 of 37
 
-12- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
E. Choice of Law 
Movate argues that, under In re Air Crash Disaster Near Chi., Ill., 644 F.2d 594, 
604 n.1, 610 (7th Cir. 1981), the Court must apply the choice-of-law rules of the 
transferor courts, and that the law of the state where each plaintiff suffered injury 
governs. (ECF No. 317 at 13.) Plaintiffs respond that the parties agreed to reserve the 
choice-of-law issue and, for purposes of this motion, to proceed on the common law 
claims under the laws of California, Massachusetts, Michigan, and New York. (ECF No. 
353 at 18–19.) The Court’s prior order reflects that agreement. (See Order Granting 
Joint Mot. to Dismiss Certain Claims Against Movate Without Prejudice, ECF No. 314 
¶¶ 2–3.) Consistent with the parties’ stipulation and the Court’s previous order, the Court 
declines to address broader choice-of-law issues at this time. 
F. Negligence 
To state a claim for negligence, a plaintiff must allege duty, breach, causation, and 
injury. Vasilenko v. Grace Family Church, 3 Cal. 5th 1077, 1083 (2017). Movate moves 
to dismiss on the ground that Plaintiffs fail to adequately allege any element. The Court 
finds that Plaintiffs have stated a plausible negligence claim upon which relief can be 
granted. 
1. Duty 
The threshold question is whether Movate owed Plaintiffs a legal duty of care. 
Under California law, everyone has a general duty to exercise reasonable care for the 
safety of others. Brown v. USA Taekwondo, 11 Cal. 5th 204, 213–14 (2021). Where a 
defendant’s affirmative conduct creates a foreseeable risk of harm, a duty attaches. Id. at 
214; Doe v. Uber Techs., Inc., 2025 WL 80365, at *4 (9th Cir. Jan. 13, 2025). Where the 
defendant did not itself create the risk, a duty to protect may nonetheless arise from a 
special relationship with the plaintiff--one marked by dependency, control, and other 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 12 of 37
 
-13- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
indicia--even absent contractual privity. Brown, 11 Cal. 5th at 215–16; Stasi v. Inmediata 
Health Grp. Corp., 501 F. Supp. 3d 898, 914 (S.D. Cal. 2020). Courts in the data-breach 
context have consistently found that entities with access to sensitive personal information 
owe a duty to protect that information from foreseeable cyberattacks. See In re Accellion, 
Inc. Data Breach Litig., 713 F. Supp. 3d 623, 632 (N.D. Cal. 2024) (file-transfer 
company assumed duty to prevent unauthorized access to personal information it was 
entrusted to transfer); Bass v. Facebook, Inc., 394 F. Supp. 3d 1024, 1039 (N.D. Cal. 
2019) (failure to comply with minimum data-security standards constitutes a classic 
negligence claim); In re Facebook, Inc. Consumer Priv. Litig., 402 F. Supp. 3d 767, 799 
(N.D. Cal. 2019) (defendant had responsibility to handle sensitive information with care); 
Castillo v. Seagate Tech., LLC, 2016 WL 9280242, at *3 (N.D. Cal. Sept. 14, 2016) 
(defendant duty-bound to protect personal identifying information it obtained). Courts in 
other stipulated jurisdictions have reached the same conclusion. See In re USAA Data 
Sec. Litig., 621 F. Supp. 3d 454, 469 (S.D.N.Y. 2022) (duty where custodian of data was 
in the best position to protect information, understood the importance of data security, 
knew it was the target of cyberattacks, and touted its security); Weekes v. Cohen Cleary 
P.C., 723 F. Supp. 3d 97, 103 (D. Mass. 2024) (duty to protect PII from foreseeable 
cyberattacks in data-breach context). 
Movate raises several arguments against the existence of a duty, none of which is 
persuasive at this stage. First, Movate contends it owed no duty because Plaintiffs had no 
direct relationship with Movate. (ECF Nos. 317 at 13–16; 369 at 8–12.) According to 
Movate, Plaintiffs provided their PII to their schools, which contracted with PowerSchool 
for educational software, and PowerSchool then contracted with Movate for limited 
technical support--making Movate “at least three steps removed” from Plaintiffs. Movate 
argues that California law does not extend a duty of care to every downstream entity 
incidentally connected to a contractual relationship. See S. Cal. Gas Leak Cases, 7 Cal. 
5th 391, 401-03 (2019). 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 13 of 37
 
-14- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
This argument misapprehends both the allegations and the applicable law. The 
Complaint alleges that Movate had broad access to and control over Plaintiffs’ Private 
Information. (Compl. ¶¶ 23, 47, 120, 133.) Where a defendant’s affirmative conduct 
creates a foreseeable risk of harm, a legal duty attaches regardless of contractual privity. 
See Brown, 11 Cal. 5th at 214; Accellion, 713 F. Supp. 3d at 632. Movate’s downstream 
position in the contractual chain does not insulate it from a duty arising from its own 
conduct in accessing and failing to safeguard Plaintiffs’ data. 
Second, Movate argues that no special relationship exists because Plaintiffs were 
not dependent on Movate, Movate did not control their data, and Plaintiffs were unaware 
that Movate existed. The Complaint alleges otherwise. Movate contracted to service 
PowerSchool’s school-district customers, affecting Plaintiffs through their enrollment or 
employment in those districts. (Compl. ¶¶ 49–58, 116–20.) To fulfill this contract, 
Movate accessed and controlled Plaintiffs’ Private Information, which formed the 
foundation of PowerSchool’s SIS. (Compl. ¶¶ 23, 47, 120, 133.) Each special-
relationship factor weighs in Plaintiffs’ favor. See Centinela Freeman Emergency Med. 
Assocs. v. Health Net of Cal., Inc., 1 Cal. 5th 994, 1014 (2016). The risk of breach was 
foreseeable: Movate knew that hackers routinely target personal information and knew or 
should have known that school districts have repeatedly experienced well-publicized data 
breaches resulting from compromised credentials. (Compl. ¶¶ 169, 915.) Plaintiffs 
allege actual harm resulting from the breach.3 Movate’s conduct may be considered 
blameworthy if the allegations are proven to be true because, despite understanding the 
sensitivity of the information, Movate outsourced cybersecurity functions to cheaper 
labor and failed to properly train its employees. (Compl. ¶¶ 116–20, 127–33, 794, 998.) 
And a special relationship applies when one party has “superior control over the means of 
protection” and the “the relationship has ‘defined boundaries,’” such that is given to 
 
3 (Compl. ¶¶ 27–31, 139–44, 329, 340, 375, 399, 411, 509, 515, 544, 562, 604, 611, 635, 
641.) 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 14 of 37
 
-15- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
vulnerable population of minor children affected. See Baton v. Ledger SAS, 740 F. Supp. 
3d 847, 907 (N.D. Cal. 2024) (citation omitted). 
Third, Movate contends that Plaintiffs’ cited cases are distinguishable because each 
involved defendants who operated the compromised system, stored the affected data, or 
made direct representations to plaintiffs. See Accellion, 713 F. Supp. 3d at 630–31; In re 
Facebook, Inc. Consumer Priv. User Profile Litig., 655 F. Supp. 3d 899, 902–03 (N.D. 
Cal. 2023). Movate argues its role aligns with Navarro v. Ski Data, 2022 WL 18280359, 
at *10 (C.D. Cal. Dec. 7, 2022), where the court found no duty where defendants did not 
store or possess PII and had no control over the breached system. Movate also 
distinguishes Baton on the ground that the subcontractor there was hired specifically to 
provide data-security consulting services and exercised direct control over the employees 
who stole the data, whereas Movate was hired only to provide customer support. 740 F. 
Supp. 3d at 868–69, 907. 
These distinctions do not carry the day at the pleading stage. Unlike in Navarro, 
Movate is not alleged to have been a passive bystander with no access to the 
compromised data. The Complaint alleges Movate possessed, maintained, and controlled 
Plaintiffs’ Private Information and understood the importance of securing it, having 
advertised compliance with internationally recognized data-security standards including 
ISO 27001:2013 frameworks. (Compl. ¶¶ 23, 47, 118, 120, 133, 780.) And while 
Movate’s role may differ in degree from the subcontractor in Baton, the principle is the 
same: where a subcontractor has access to and control over sensitive data and is 
responsible for implementing security measures, a duty of care arises. See Baton, 740 F. 
Supp. 3d at 907. 
Fourth, Movate contends it had no duty to notify Plaintiffs of the breach because 
PowerSchool, not Movate, was the entity whose data was compromised, and Plaintiffs do 
not allege Movate knew of the breach or concealed it. See Smahaj v. Retrieval-Masters 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 15 of 37
 
-16- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Creditors Bureau, Inc., 131 N.Y.S.3d 817, 824 (Sup. Ct. 2020). Plaintiffs’ negligence 
theory does not rest on a failure to notify. It rests on Movate’s failure to implement 
adequate security measures that would have prevented the breach in the first place. The 
notification argument is therefore not determinative. 
The weight of authority supports the conclusion that entities with access to 
sensitive personal information owe a duty to protect that information from foreseeable 
cyberattacks, regardless of contractual privity. Movate’s attempt to characterize its role 
as merely providing contracted backend services does not negate the duty of care arising 
from its access to and control over Plaintiffs’ Private Information. Accordingly, the 
motion to dismiss on this ground is denied. 
2. Breach 
The pleading standard for breach in data breach negligence cases is not high. 
Courts have recognized that the occurrence of a breach itself permits a reasonable 
inference of inadequate security at the pleading stage. See Schmitt v. SN Servicing Corp., 
2021 WL 3493754, at *5 (E.D. Cal. Aug. 9, 2021) (quoting Flores-Mendez v. Zoosk, Inc., 
2021 WL 308543, at *4 (N.D. Cal. Jan. 30, 2021)). 
Movate argues that even if a duty existed, Plaintiffs fail to allege breach with 
adequate specificity, offering only conclusory assertions without factual support. 
(Compl. ¶ 789.) Here, the Complaint identifies specific security failures: failure to train 
employees to secure credentials; failure to rotate credentials; failure to implement multi-
factor authentication; failure to implement least-privilege access; and failure to restrict 
employee access to Private Information. (Compl. ¶¶ 118, 130, 144 n.90, 776, 780, 916.) 
These failures allegedly enabled cybercriminals to use a Movate employee’s stolen 
credentials to gain unauthorized access and exfiltrate the data of over 50 million students, 
teachers, and parents. (Compl. ¶¶ 21, 131–33, 185, 197.) The Complaint specifically 
alleges that had the Movate employee account required multi-factor authentication, the 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 16 of 37
 
-17- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
breach would not have occurred because a simple username and password would have 
been insufficient for hackers to gain access to PowerSchool’s SIS. (Compl. ¶ 193.) 
Plaintiffs plausibly claim that Movate was aware of the importance of these security 
measures, having advertised compliance with recognized data-security standards. 
(Compl. ¶¶ 118, 163–84, 780.) 
These are not conclusory assertions. They identify concrete deficiencies that, if 
proven, would constitute a breach. See Webb v. Injured Workers Pharmacy, LLC, 2023 
WL 5938606, at *2 (D. Mass. Sept. 12, 2023) (breach where defendant failed to 
implement proper safeguards, especially where best practices were publicly available); 
Hummel v. Teijin Auto. Techs., Inc., 2023 WL 6149059, at *5 (E.D. Mich. Sept. 20, 
2023) (breach where defendant did not encrypt PII); Toretto, 583 F. Supp. 3d at 595 
(allegations sufficient where defendant failed to implement security systems despite 
awareness of cybersecurity threats). Accordingly, the motion to dismiss on this ground is 
denied. 
3. Causation 
Movate argues that Plaintiffs fail to plausibly allege proximate causation because 
the Complaint contains no factual allegations linking any specific Movate act or 
omission--as opposed to third-party hackers or PowerSchool’s own security--to 
Plaintiffs’ injuries. Movate contends that the use of a Movate employee’s credential as 
an entry point does not, by itself, support a reasonable inference of proximate causation. 
(Compl. ¶ 21.) Movate emphasizes that its systems were not breached and that 
PowerSchool owned the underlying platform and controlled core security settings. (ECF 
No. 369 at 9–10, 12–13.) 
This attempt to shift blame to PowerSchool and third-party criminals is unavailing. 
Under California law, when a defendant’s negligence exposes the plaintiff to an 
unreasonable risk of harm from the actions of others, the occurrence of the conduct that 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 17 of 37
 
-18- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
the defendant had a duty to protect against cannot constitute a superseding cause 
relieving the defendant of responsibility. Lugtu v. Cal. Highway Patrol, 26 Cal. 4th 703, 
725 (2001). A negligent tortfeasor is generally liable for all damage of which its 
negligence is a proximate cause, and cannot escape responsibility simply because another 
act may also have contributed to the injury. Henry v. Superior Ct., 160 Cal. App. 4th 
440, 449 (2008). The breach need not be the sole cause of the harm; it suffices if it was a 
substantial factor in bringing about the injury. Stollenwerk v. Tri-West Health Care 
Alliance, 254 F. App’x 664, 667 (9th Cir. 2007). 
The Complaint plausibly alleges that Movate’s security failures caused the breach. 
The entire breach was carried out using the compromised credentials of a single Movate 
employee. (Compl. ¶ 127.) Had the Movate employee account required multi-factor 
authentication, the breach would not have occurred. (Compl. ¶ 193.) Had Movate 
implemented the principle of least privilege, the hackers would not have been able to 
access and exfiltrate Plaintiffs’ Private Information. (Compl. ¶ 197.) Had Movate 
rotated its employees’ credentials on a regular basis, the breach could have been 
prevented. (Compl. ¶ 208.) These allegations establish that but for Movate’s security 
omissions, Plaintiffs’ injuries would not have occurred. (Compl. ¶¶ 127, 128, 131, 913, 
919–21, 923, 1035.) Where the defendant’s negligence created the very risk that 
materialized--unauthorized access through compromised credentials--criminal conduct by 
third parties does not break the causal chain. That Movate’s systems were not themselves 
breached and that PowerSchool owned the underlying platform may bear on the ultimate 
allocation of responsibility. It does not defeat causation at the pleading stage. 
Accordingly, the motion to dismiss on this ground is denied. 
4. Damages 
Movate argues most Plaintiffs do not plead actual, compensable damages, 
contending that allegations of heightened risk of identity theft, time spent monitoring 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 18 of 37
 
-19- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
accounts, emotional distress, and loss of data value are speculative and legally 
insufficient absent actual misuse or economic loss. See Corona v. Sony Pictures Ent., 
Inc., 2015 WL 3916744, at *3-4 (C.D. Cal. June 15, 2015); Pruchnicki v. Envision 
Healthcare Corp., 845 F. App’x 613, 614–15 (9th Cir. 2021). 
Courts have recognized multiple damage categories as cognizable in data-breach 
cases at the pleading stage. Where plaintiffs show a substantial risk of future harm, the 
element of injury is satisfied. In re Shield Health Care Grp., Inc. Data Breach Litig., 721 
F. Supp. 3d 152, 161 (D. Mass. 2024). Courts recognize out-of-pocket expenses incurred 
because of a breach, including time spent reviewing credit accounts. In re Accellion, Inc. 
Data Breach Litig., 713 F. Supp. 3d at 637. The lost benefit of the bargain is sufficiently 
concrete. See Priddy v. Zoll Med. Corp., 2025 WL 975234, at *8 (D. Mass. Mar. 31, 
2025). Loss of personal information constitutes economic injury. See Calhoun v. Google, 
LLC, 526 F. Supp. 3d 605, 636 (N.D. Cal. 2021). Fear, anxiety, and distress resulting 
from a data breach suffice to allege emotional damages at the motion-to-dismiss stage. 
Landon v. TSC Acquisition Corp., 2024 WL 5317240, at *8 (C.D. Cal. Nov. 1, 2024). 
And courts have declined to dismiss invasion-of-privacy claims where, as here, a data 
breach involved medical information. St. Aubin v. Carbon Health Techs., Inc., 2024 WL 
4369675, at *13 (N.D. Cal. Oct. 1, 2024). 
Here, the Complaint alleges that the breach compromised sensitive Private 
Information, including Social Security numbers and medical information. (Compl. ¶¶ 2, 
57, 142, 144.) Plaintiffs detail concrete harms: actual and attempted identity theft, 
fraudulent use of Social Security numbers, compromised financial accounts, fraudulent 
tax activity, disrupted credit histories, and compromised access to benefits and 
employment.4 Many Plaintiffs received alerts that their Private Information was detected 
 
4 (Compl. ¶¶ 27–31, 139–44, 283, 329, 340, 346, 352, 357, 375, 399, 411, 435, 441, 503, 
509, 515, 562, 581, 598, 604, 611, 617, 635, 641.) 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 19 of 37
 
-20- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
on the dark web. (Compl. ¶¶ 295, 357, 399, 470, 544, 611, 635.) Nearly all Plaintiffs 
experienced spam and phishing attempts and incurred expenses for credit monitoring or 
spent time responding to the breach. 5 
These allegations suffice at the pleading stage. A motion to dismiss is not the 
appropriate vehicle to resolve factual disputes about the breach’s scope or corresponding 
damages. Accordingly, the motion to dismiss on this ground is denied. 
5. Conclusion 
For the foregoing reasons, Movate’s motion to dismiss Plaintiffs’ negligence claim 
is DENIED. Plaintiffs have adequately alleged: (1) Movate owed a duty of care arising 
from its access to and control over Plaintiffs’ Private Information and the foreseeability 
of harm; (2) Movate breached that duty by failing to implement basic security measures; 
(3) Movate’s breach proximately caused Plaintiffs’ injuries because the entire breach was 
carried out using a Movate employee’s compromised credentials; and (4) Plaintiffs 
suffered cognizable damages including actual misuse, out-of-pocket expenses, and 
emotional distress. 
G. Negligence Per Se 
Movate moves to dismiss Plaintiffs’ negligence per se claim on multiple grounds: 
(1) the Complaint engages in impermissible group pleading; (2) negligence per se is not 
an independent cause of action; (3) Plaintiffs fail to identify any statute Movate violated; 
(4) the cited statutes lack private rights of action; (5) Plaintiffs do not fall within the 
 
5 (Compl. ¶¶ 290, 302, 307, 313, 324, 340, 363, 369, 381, 387, 393, 405, 423, 427, 453, 
460, 466, 476, 484, 490, 491, 520, 526, 538, 550, 556, 586, 592, 623, 647, 659, 665, 671, 
677, 683, 689, 695, 700, 705, 711, 716, 722, 728, 734, 740, 746.) 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 20 of 37
 
-21- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
protected class or allege the type of harm the statutes address; and (6) Plaintiffs fail to 
plead causation and damages adequately. (ECF Nos. 317 at 19–21; 369 at 14–16.) 
Plaintiffs respond that Count II incorporates Movate-specific allegations from 
elsewhere in the Complaint, that the parties already dismissed the standalone negligence 
per se claims under California, Massachusetts, and Michigan law, and that New York 
recognizes negligence per se and permits statutes such as HIPAA and the FTC Act to 
inform the duty-and-breach analysis. (ECF No. 353 at 26–29.) 
1. Procedural Status and Applicable Law 
As a threshold matter, the parties stipulated to voluntary dismissal of Plaintiffs’ 
standalone negligence per se claims under California, Massachusetts, and Michigan law. 
(ECF No. 314 ¶ 1.) The parties further agreed that the negligence per se allegations 
would be incorporated into Plaintiffs’ other causes of action. (Id.) As Movate notes, that 
leaves only a purported standalone New York negligence per se theory. (ECF No. 369 at 
15 n.14.) 
The Court’s analysis therefore proceeds on two tracks: (1) whether New York 
recognizes a standalone negligence per se claim premised on HIPAA and the FTC Act; 
and (2) whether the alleged statutory violations may inform the standard of care for 
Plaintiffs’ general negligence claims under the four stipulated jurisdictions. 
2. Standalone Negligence Per Se Claim Under New York Law 
a. Whether New York Recognizes Standalone Negligence Per Se 
The parties dispute whether New York recognizes negligence per se as an 
independent cause of action. Movate contends that negligence per se is merely an 
evidentiary doctrine substituting for proof of duty and breach within an otherwise viable 
negligence claim. Plaintiffs respond that New York courts routinely permit standalone 
negligence per se claims where a statute imposes a duty of care. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 21 of 37
 
-22- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
New York law supports Plaintiffs’ position. New York does not distinguish 
between state and federal statutes as a basis for negligence per se claims. See Wedlock v. 
Troncoso, 712 N.Y.S.2d 328, 332 (Cnty. Sup. Ct. 2000). Courts applying New York law 
have held that a statute imposing a duty of care can sustain a negligence per se claim. 
See In re Capital One Consumer Data Sec. Breach Litig., 488 F. Supp. 3d 374, 406–08 
(E.D. Va. 2020) (applying law of New York). As the Appellate Division observed in 
Dane v. Town of Southampton, negligence per se is not liability per se-- the plaintiff must 
still establish that the statutory violation was the proximate cause of the injury. 467 
N.Y.S. 2d 203, 206 (N.Y. App. Div. 1983). That requirement does not negate the 
doctrine’s viability; providing some support that negligence per se operates within the 
traditional negligence framework rather than as strict liability. Accordingly, the Court 
finds that New York recognizes negligence per se as a viable cause of action. 
b. Whether Statutes Lacking Private Rights of Action May 
Support Negligence Per Se 
Next, Movate questions whether federal statutes like HIPAA and the FTC Act--
which do not create a private right of action--may nonetheless establish the standard of 
care for negligence per se purposes. There is a split of authority. 
Movate relies on Smahaj v. Retrieval-Masters Creditors Bureau, Inc., 131 
N.Y.S.3d 817, 827 (N.Y. Sup. Ct. 2020), where a trial court reasoned that if proof of a 
violation of the FTC Act were to establish negligence per se, the plaintiff would 
effectively be afforded a private right of action the statute does not recognize. Movate 
also cites Cohen v. Ne. Radiology, P.C., No. 20 CV 1202 (VB), 2021 WL 293123, at *7 
(S.D.N.Y. Jan. 28, 2021), which dismissed a negligence per se claim predicated on 
HIPAA and the FTC Act on similar reasoning. 
Plaintiffs cite Lugo v. St. Nicholas Associates, 2 Misc. 3d 212, 215, 772 N.Y.S.2d 
449, 453 (Sup. Ct. N.Y. Cnty. 2003), aff’d, 18 A.D.3d 341, 795 N.Y.S.2d 227 (1st Dep’t 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 22 of 37
 
-23- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
2005), for the proposition that even where a statute does not provide a private right of 
action, its standard of care may be relevant for purposes of negligence. Plaintiffs also 
rely on In re Capital One, 488 F. Supp. 3d at 407–08, where the court held that New 
York law permits a negligence per se claim premised on the FTC Act’s standard of care. 
The Court finds Plaintiffs’ authorities more persuasive for two reasons. First, 
unlike Smahaj, Lugo received appellate affirmance, lending it greater precedential weight 
within New York’s judicial hierarchy. Cohen relied on Smahaj without addressing or 
distinguishing Lugo’s appellate-affirmed holding. This Court finds the reasoning of a 
state appellate decision more authoritative on questions of New York negligence law than 
an unreviewed trial court decision. 
Second, and more fundamentally, Smahaj’s reasoning conflates two distinct 
concepts: using a statute to create direct liability and using a statute to define the standard 
of care within an independent tort claim. Under the negligence per se doctrine, the tort of 
negligence--not the statute--provides the vehicle of recovery. The statute defines the 
applicable standard of care rather than creating liability directly. Plaintiffs do not seek to 
enforce HIPAA or the FTC Act as such; they seek to recover in tort for negligent 
conduct, with the statutory standard informing what constitutes reasonable care. This 
approach does not circumvent Congress’s decision to withhold a private enforcement 
mechanism because the elements of the negligence claim--including proximate causation 
and damages--must still be independently established. As the New York Court of 
Appeals has recognized, even where a statute does not expressly provide for civil 
liability, a court may, in furtherance of the statutory purpose, impose negligence per se 
for a statutory violation. See German by German v. Fed. Home Loan Mortg. Corp., 896 
F. Supp. 1385, 1396-97 (S.D.N.Y. 1995) 
Accordingly, the Court holds that HIPAA and the FTC Act may support Plaintiffs’ 
negligence per se claim under New York law. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 23 of 37
 
-24- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
c. Whether the Complaint Identifies Movate-Specific Statutory 
Duties 
Movate argues that Plaintiffs do not identify any statutory provision Movate 
specifically violated, contending that the Complaint’s references to HIPAA, the FTC Act, 
COPPA, and FERPA pertain exclusively to PowerSchool’s conduct. 
The Complaint adequately identifies Movate-specific statutory duties. Plaintiffs 
allege that HIPAA requires covered entities and their business associates, “like 
PowerSchool and Movate,” to reasonably protect confidential data. (MC ¶ 807.) The 
Complaint further alleges that Movate breached duties including the failure to train 
employees to secure credentials and implement the principle of least privileges for data-
system access. (MC ¶ 789.) Accepted as true, these allegations identify Movate-specific 
conduct rather than relying solely on group pleading. Accordingly, Movate’s group-
pleading argument is unpersuasive. 
d. Protected Class and Type of Harm 
Movate argues that Plaintiffs do not plausibly allege they fall within the class of 
persons the cited statutes protect or that their injuries constitute the type of harm the 
statutes are intended to address. See Randall v. Mich. High School Athletic Ass’n, 334 
Mich. App. 697, 720 (2020). 
Plaintiffs respond that they are within the class of persons that Section 5 of the 
FTC Act, the HIPAA Privacy and Security Rules, COPPA, FERPA, industry standards, 
and state consumer protection statutes were intended to protect. (MC ¶ 816.) Plaintiffs 
further allege that the harm they suffered is the type of harm the statutes were designed to 
guard against. (MC ¶ 817.) These statutes regulate the protection of personal and health 
information from unauthorized access and disclosure-- which is the harm Plaintiffs 
allege. The Complaint alleges that HIPAA requires covered entities and their business 
associates to implement safeguards protecting electronic health information from 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 24 of 37
 
-25- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
unauthorized access (MC ¶ 807), and that Plaintiffs’ protected health information was 
compromised due to inadequate security measures. At the pleading stage, these 
allegations plausibly establish that Plaintiffs fall within the protected class and suffered 
the type of harm the statutes address. Whether Plaintiffs can ultimately prove these 
elements presents a factual question unsuitable for resolution on a motion to dismiss. 
e. Causation and Damages 
Movate contends that Plaintiffs fail to adequately allege that any statutory violation 
by Movate proximately caused their injuries or that they suffered cognizable damages. 
The Court disagrees. As mentioned earlier, Plaintiffs allege that cybercriminals accessed 
PowerSchool’s systems using a Movate employee’s stolen credentials (Compl. ¶¶ 21, 
131–33) and that Movate’s failure to implement adequate security measures--including 
multi-factor authentication, credential rotation, and least-privilege access controls--
enabled the breach. (Compl. ¶¶ 193, 197, 208, 789.) These allegations, accepted as true, 
establish a plausible causal chain between Movate’s alleged statutory violations and 
Plaintiffs’ injuries. Plaintiffs further allege specific categories of harm, including actual 
identity theft, fraudulent use of Social Security numbers, compromised financial 
accounts, and out-of-pocket expenses for credit monitoring. (Compl. ¶¶ 923–24.) These 
allegations suffice at the pleading stage. The Court’s analysis of causation and damages 
in the negligence section applies with equal force here. 
3. Incorporation into General Negligence Claims 
Regardless of the standalone claim’s viability, the parties’ stipulation preserved the 
negligence per se allegations for incorporation into Plaintiffs’ general negligence claims. 
(ECF No. 314 ¶ 1.) Plaintiffs may rely on statutory violations as evidence of the 
applicable standard of care within their general negligence claims. See Accellion, 713 F. 
Supp. 3d at 639; Lugo, 772 N.Y.S.2d at 453. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 25 of 37
 
-26- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
The Michigan Supreme Court’s decision in Meyers v. Rieck is instructive for 
claims governed by Michigan law. There, the court held that a violation of a statutory 
duty constitutes negligence per se such that its breach establishes the first two elements of 
negligence: duty and breach of duty. 509 Mich. 460, 472, 983 N.W.2d 747, 754 (2022). 
As the only state supreme court decision among the authorities cited by either party, 
Meyers confirms that statutory violations may inform the standard of care for Plaintiffs’ 
incorporated negligence claims under Michigan law. Neither party has cited authority 
suggesting that California or Massachusetts would reach a different conclusion, and the 
Court declines to assume those jurisdictions would depart from the prevailing approach. 
Therefore, Movate’s motion to dismiss the negligence per se claim (Count II) is 
DENIED. 
H. Negligent Hiring and Supervision 
Movate moves to dismiss Plaintiffs’ negligent hiring and supervision claim, 
arguing that Plaintiffs fail to adequately allege duty, knowledge of the risk, causation, or 
damages. (ECF Nos. 317 at 21–22; 369 at 16–17.) 
An employer may be liable for harm caused by negligent hiring, supervision, or 
retention of an incompetent employee. Diaz v. Tesla, Inc., 598 F. Supp. 3d 809, 832–33 
(N.D. Cal. 2022); Mueller v. Brannigan Bros. Rests. & Taverns LLC, 323 Mich. App. 
566, 574 (2018); Gray v. Schenectady City Sch. Dist., 86 A.D.3d 771, 773 (N.Y. App. 
Div. 2011); Theisz v. Mass. Bay Transp. Auth., 103 Mass. App. Ct. 822, 826 (2024). 
Movate contends that a plaintiff must allege facts showing the employer knew or should 
have known that retaining the employee created a risk of a particular harm and that the 
harm materialized. Diaz, 598 F. Supp. 3d at 832–33. Plaintiffs respond that negligent 
supervision is not an intentional tort but is analyzed like all other negligence claims, 
requiring proof of duty, breach, causation, and damages. Prime Rate Premium Fin. Corp. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 26 of 37
 
-27- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
v. Larson, 226 F. Supp. 3d 858, 870 (E.D. Mich. 2016); accord Ehrens v. Lutheran 
Church–Mo. Synod, 269 F. Supp. 2d 328, 334 (S.D.N.Y. 2003). 
Plaintiffs allege that Movate, acting as PowerSchool’s agent, owed non-delegable 
duties to Plaintiffs to hire competent employees and agents and to train and supervise 
them to ensure they recognized their obligations to Plaintiffs. (Compl. ¶ 913.) Plaintiffs 
further allege that Movate’s failure to adequately train and supervise its employees 
concerning data security foreseeably caused the breach. (Compl. ¶¶ 32, 882, 884, 916, 
919.) Their theory goes beyond a propensity claim against a single employee. The 
Complaint alleges systemic failures in training and oversight, including failure to enforce 
credential rotation, failure to restrict employee access to sensitive data, and failure to 
train staff in basic data-security practices. 
Movate argues that the Complaint contains no facts suggesting Movate was on 
notice of a risk specific to the employee whose credentials were compromised. Some 
courts have dismissed negligent hiring claims for failure to allege such knowledge. See 
Lee v. Albarran, 2024 WL 4987310, at *6 (S.D.N.Y. Dec. 5, 2024) (dismissing for failure 
to allege how employer knew or should have known about employee’s propensity for the 
conduct that caused injury); Palmer v. Alameda Cnty., 2019 WL 5626633, at *4 (N.D. 
Cal. Oct. 31, 2019) (requiring allegations that defendant knew or should have known 
employee was incompetent or otherwise likely to cause injury); Brandon v. Quicken 
Loans, Inc., 2021 WL 1015830, at *3 (E.D. Mich. Feb. 22, 2021); Doe v. Brandeis Univ., 
718 F. Supp. 3d 83, 92–94 (D. Mass. 2024). 
Plaintiffs rely on Baton v. Ledger SAS, 740 F. Supp. 3d 847 (N.D. Cal. 2024), and 
In re Bank of America California Unemployment Benefits Litigation, 674 F. Supp. 3d 884 
(S.D. Cal. 2023). Movate correctly observes that Baton addressed only a general 
negligence claim, not negligent hiring or supervision. Nevertheless, Baton’s analysis is 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 27 of 37
 
-28- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
instructive here because both cases involved allegations that a subcontractor’s inadequate 
security practices enabled a data breach. 
While Plaintiffs do not allege that Movate knew of a specific propensity for 
misconduct by the employee whose credentials were compromised, they allege systemic 
failures in training and supervision --including failures to require credential rotation, 
implement multi-factor authentication, and restrict access to sensitive data--that plausibly 
contributed to the breach. (Compl. ¶¶ 913, 916, 919–21.) These are not allegations of an 
isolated lapse by a single employee. They describe organization-wide deficiencies in 
how Movate trained, supervised, and managed employees who had access to the sensitive 
personal information of millions of students, parents, and teachers. The cases Movate 
cites involved the absence of any allegations connecting the employer’s knowledge to the 
employee’s conduct. Here, the Complaint alleges that Movate’s own institutional failures 
--failures that applied to all employees, not just the one whose credentials were 
compromised--created the conditions that made the breach possible. At the pleading 
stage, those allegations allow a reasonable inference of negligent hiring and supervision 
even without allegations of a prior specific tendency toward misconduct by the individual 
employee. See Baton, 740 F. Supp. 3d at 847; In re Bank of Am., 674 F. Supp. 3d at 884. 
Therefore, Movate’s motion to dismiss Plaintiffs’ negligent hiring and supervision 
claim is DENIED. 
I. Invasion of Privacy Claims6 
Movate next moves to dismiss the invasion of privacy claims (Count IV; Count 
XV). PowerSchool Mem. in Support of MTD, ECF No. 285 at 25-28; ECF No. 262 at 2-
3. All Plaintiffs assert a common law invasion of privacy claim, and the California 
Plaintiffs bring an additional invasion of privacy claim under the California Constitution. 
 
6 (ECF No. 262 at 2-3) Notice of Errata. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 28 of 37
 
-29- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
“The California Constitution and the common law set a high bar for an invasion of 
privacy claim. Even disclosure of personal information, including social security 
numbers, does not constitute an ‘egregious breach of the social norms’ to establish an 
invasion of privacy claim.” Low v. LinkedIn Corp., 900 F. Supp. 2d 1010, 1025 (N.D. 
Cal. 2012). 
Under the California Constitution, “[a]ctionable invasions of privacy must be 
sufficiently serious in their nature, scope, and actual or potential impact to constitute an 
egregious breach of the social norms underlying the privacy right.” Id. (citation 
omitted). A common law invasion-of-privacy claim must meet similarly high standards. 
Under a claim for common law invasion of privacy tort, a plaintiff must allege a 
defendant’s intrusion “in a manner highly offensive to a reasonable person.” Id. (citation 
omitted). 
The weakness in Plaintiffs’ claims is that they do not allege that Movate invaded 
private information. Instead, the allegation is that Movate was reckless “by choosing to 
implement low-budget security measures with absolute disregard of its consequences and 
while simultaneously holding itself out to Plaintiffs and Class Members as respecting a 
higher standard of security,” or by knowing or recklessly disregarding “the fact that 
organizations handling personally identifiable information are highly vulnerable to 
cyberattacks and that employing inadequate security and training practices would render 
them especially vulnerable to data breaches.” Compl. ¶¶ 859-861. 
It is not alleged that Movate was the actor that invaded Plaintiffs’ reasonable 
expectation of privacy. Rather, it is alleged that an unrelated criminal data thief invaded 
and exfiltrated Plaintiffs’ highly private information. That is fatal to Plaintiffs’ invasion 
of privacy claims. See e.g., In re Accellion, Inc. Data Breach Litig., 713 F. Supp. 3d 623, 
646 (N.D. Cal. 2024), reconsideration denied, No. 21-CV-01155-EJD, 2024 WL 
4592367 (N.D. Cal. Oct. 28, 2024); In re Shields Health Care Grp., Inc. Data Breach 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 29 of 37
 
-30- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
Litig., 721 F. Supp. 3d 152, 164 (D. Mass. 2024) (applying Massachusetts law); see also 
Polkowski v. Jack Doheny Companies, Inc., No. 2:25-CV-10516, 2025 WL 3079358, at 
*11 (E.D. Mich. Nov. 4, 2025) (applying Michigan invasion of privacy law). 
None of the cases Plaintiffs cite stands for the proposition that a careless holder of 
private information without more may be liable on an invasion of privacy theory. And 
New York does not recognize a claim for common law invasion of privacy. Reeves v. 
City of New York, No. 24-CV-2408 (NRM) (MMH), 2026 WL 309532, at *11 (E.D.N.Y. 
Feb. 5, 2026) (citations omitted). 
Therefore, Movate’s motion to dismiss the invasion of privacy claims (Count IV; 
Count XV) is GRANTED. 
J. Breach of Fiduciary Duty Claim7 
Plaintiffs allege in Count VII that Movate, by “accepting, taking possession, 
collecting, storing, and processing Plaintiffs’ and Class Members’ highly sensitive data . . 
. formed a special relationship and became a guardian of Plaintiffs’ and Class Members’ 
PII.” Plaintiffs allege, inter alia, “Defendants thus had a fiduciary duty to act primarily 
for Plaintiffs and Class Members, (a) for the safeguarding of Plaintiffs’ and Class 
Members’ PII; (b) to timely notify Plaintiffs and Class Members of a Data Breach; and 
(c) to maintain complete and accurate records of what information Defendants store and 
where they store it.” Compl. at ¶¶ 895-907. 
Movate moves to dismiss the claim. Movate says, “[i]t is well-recognized that 
simply maintaining an individual’s confidential information does not create a fiduciary 
relationship.” Mem. in Support of MTD, ECF No. 285 at 28-29 (citing In re Ambry 
Genetics Data Breach Litig., 567 F. Supp. 3d 1130, 1145-46 (C.D. Cal. 2021)). Movate 
 
7 (ECF No. 262 at 2-3) Notice of Errata. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 30 of 37
 
-31- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
cites a similar decision under New York and Michigan law. Plaintiffs remonstrate that 
none of these cases address the unique setting involving minor schoolchildren victims 
who were compelled by law to attend school and, as a result, compelled to use Movate’s 
software product. It is a novel claim, but a plausible one in the specific alleged context. 
It is alleged that Movate knew well that it was maintaining the personal information of 
millions of minor schoolchildren who were in no position to protect themselves from 
Movate’s actions or negligence. Indeed, it was Movate’s prime business. As a matter of 
policy, schoolchildren deserve protection until they reach the age at which they can 
protect themselves. Therefore, Plaintiffs’ claim for breach of fiduciary duty (Count VII) 
is plausibly alleged, and the motion to dismiss is DENIED. 
K. Unjust Enrichment 
Movate seeks to dismiss Plaintiffs’ unjust enrichment claim on three grounds: first, 
that unjust enrichment is not an independent cause of action under California law; 
second, that under Massachusetts and New York law, the claim is duplicative of 
Plaintiffs’ negligence claims; and third, that Plaintiffs have not plausibly alleged any 
benefit conferred on Movate. (ECF Nos. 317 at 23–24; 369 at 18–20.) Plaintiffs argue 
that unjust enrichment is recognized as an independent cause of action, that equitable 
claims can be pleaded in the alternative, and that they sufficiently allege they conferred 
both monetary and non-monetary benefits on Movate, including the value of their PII. 
(ECF No. 353 at 32–34.) 
The initial argument is unsuccessful. California allows for independent claims of 
unjust enrichment. See Hartford Cas. Ins. Co. v. J.R. Mktg. LLC, 61 Cal. 4th 988, 1000 
(2015); see also Bruton v. Gerber Prods. Co., 703 F. App’x 468, 470 (9th Cir. 2017). 
The remaining arguments succeed. 
Under Massachusetts and New York law, unjust enrichment is generally 
unavailable when an adequate legal remedy exists, and the equitable claim duplicates tort 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 31 of 37
 
-32- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
theories. See Tomasella v. Nestlé USA, Inc., 962 F.3d 60, 82–84 (1st Cir. 2020); 
Buoniello v. Ethicon Women’s Health & Urology, 2020 WL 5802276, at *4 (E.D.N.Y. 
Sept. 29, 2020). Movate cited those authorities in both its opening and reply briefs, and 
Plaintiffs did not identify comparable Massachusetts or New York authority to the 
contrary. (ECF Nos. 317 at 23; 369 at 18–19.) Plaintiffs’ reliance on Haas v. Travelex 
Ins. Servs., Inc., 555 F. Supp. 3d 970, 980 (C.D. Cal. 2021), does not change this 
conclusion because Haas focused on California law and alternative pleading, not the 
substantive bar Movate relies on under Massachusetts and New York law. (ECF No. 353 
at 33.) Because Plaintiffs have asserted parallel negligence claims against Movate, their 
unjust enrichment claims under Massachusetts and New York law are barred as 
duplicative. 
Even aside from the duplicativeness bar, the claim fails for a more concrete reason: 
Plaintiffs do not adequately allege a direct benefit conferred on Movate. Movate points 
out that the Complaint states that “Defendant” or “Defendants” received a benefit and 
does not specify any benefit Movate received from the Plaintiffs. (ECF Nos. 317 at 23–
24; 369 at 19.) The Court agrees. The relevant allegations remain overly-generalized. 
(Compl. ¶¶ 829–31, 835.) Plaintiffs claim they paid for services such as data 
management and security, and that Movate benefited as a downstream service provider. 
(ECF No. 353 at 33–34.) That theory is overly attenuated with respect to the facts 
alleged. Plaintiffs do not claim that they paid Movate directly, that Movate directly 
profited from their data, or that Movate otherwise gained a tangible benefit from 
Plaintiffs similar to the direct relationships in the cases Plaintiffs reference. 
Plaintiffs rely on In re Ambry Genetics Data Breach Litigation, 567 F. Supp. 3d 
1130 (C.D. Cal. 2021), In re Anthem, Inc. Data Breach Litigation, 2016 WL 3029783 
(N.D. Cal. May 27, 2016), and Doe v. Meta Platforms, Inc., 690 F. Supp. 3d 1064 (N.D. 
Cal. 2023). As Movate notes, each of those cases involved defendants who directly 
received money or services from plaintiffs or directly monetized plaintiffs’ data. (ECF 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 32 of 37
 
-33- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
No. 369 at 19–20 n.18.) Here, by contrast, Plaintiffs’ relationship was with their schools, 
which contracted with PowerSchool, which in turn contracted with Movate for 
downstream IT support. This chain is significantly more attenuated than in any of 
Plaintiffs’ cited authorities. See Toretto v. Donnelley Fin. Sols., Inc., 583 F. Supp. 3d 
570, 602 (S.D.N.Y. 2022) (dismissing unjust enrichment where plaintiffs attribute 
benefits to a collective entity instead of alleging a specific benefit conferred on an 
individual defendant). 
Plaintiffs’ alternative theory--that their PII itself is the “res” of the unjust 
enrichment claim--does not correct the problem. Although Plaintiffs allege that Movate 
gained reputational and economic value from claiming to follow recognized security 
frameworks (ECF No. 353 at 34), they still do not adequately explain how Movate 
“retained” this benefit in a manner that would be unjust to Plaintiffs specifically, as 
opposed to PowerSchool or the school districts that actually collected and stored 
Plaintiffs’ data. The theory does not plausibly allege that Movate unjustly kept a benefit 
given by Plaintiffs. 
Therefore, Movate’s motion to dismiss the unjust enrichment claim is GRANTED. 
The duplicativeness bar under Massachusetts and New York law indicates a legal defect 
that cannot be fixed by amendment. Therefore, the unjust enrichment claim is 
DISMISSED WITH PREJUDICE to the extent it is based on Massachusetts or New 
York law. However, the benefit-conferred deficiency may be correctable, so the claim is 
DISMISSED WITHOUT PREJUDICE to the extent it is based on California or 
Michigan law, provided Plaintiffs can sufficiently demonstrate a direct benefit conferred 
on Movate. 
L. Declaratory Judgment and Injunctive Relief 
Movate seeks to dismiss Plaintiffs’ declaratory judgment claim under 28 U.S.C. § 
2201 as duplicative of their other causes of action and because declaratory relief is a 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 33 of 37
 
-34- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
remedy rather than an independent cause of action. (ECF Nos. 317 at 24; 369 at 20.) 
Plaintiffs argue that a claim for declaratory relief may proceed at the pleading stage, 
especially when it concerns future harm caused by alleged ongoing deficiencies in data 
security and employee oversight. (ECF No. 353 at 34–35.) 
The Declaratory Judgment Act creates a remedy, not a cause of action. Buck v. 
Am. Airlines, Inc., 476 F.3d 29, 33 n.3 (1st Cir. 2007); accord Jimenez v. OE Fed. Credit 
Union, 2025 WL 2402137, at *9 (N.D. Cal. Aug. 19, 2025). However, Federal Rule of 
Civil Procedure 57 provides that “the existence of another adequate remedy does not 
preclude a declaratory judgment that is otherwise appropriate.” Courts have declined to 
dismiss declaratory relief claims at the pleading stage where they seek forward-looking 
relief distinct from damages for past conduct. See Peralta v. Certified Emp. Screening, 
Inc., 2025 WL 1723142, at *9 (C.D. Cal. May 7, 2025); Reyes v. Nationstar Mortg. LLC, 
2015 WL 4554377, at *7 (N.D. Cal. July 28, 2015). Declaratory relief is inappropriate, 
however, if the claim merely duplicates the relief available through the underlying causes 
of action. See Reyes, 2015 WL 4554377, at *7–8. 
Movate contends that Plaintiffs’ declaratory judgment allegations simply restate 
their negligence claim. Movate cites In re Google Assistant Privacy Litigation, 546 F. 
Supp. 3d 945, 975–76 (N.D. Cal. 2021), which dismissed a declaratory judgment claim as 
duplicative of relief sought under other claims, and Jimenez, where the court dismissed a 
declaratory relief cause of action that merely restated elements of the plaintiff’s 
negligence claim. 2025 WL 2402137, at *9. Movate correctly points out that the 
declaratory relief allegations reiterate the same alleged failures in employee training, 
credential management, and data security that underlie the negligence claim. (ECF No. 
369 at 20.) 
Plaintiffs respond that they seek prospective relief to address Movate’s current and 
continued failure to properly train employees and utilize reasonable measures to provide 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 34 of 37
 
-35- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
adequate data security. (Compl. ¶¶ 879–80, 882, 884, 886.) Plaintiffs argue they seek 
not only a declaration of rights but also prospective injunctive relief to remedy ongoing 
security deficiencies. (Compl. ¶¶ 877, 886–88, 890–99.) In support, Plaintiffs cite 
several data-breach cases permitting declaratory relief to proceed. See Baton v. Ledger 
SAS, 740 F. Supp. 3d 847, 913 (N.D. Cal. 2024) (allegations of continuing inadequate 
security measures sufficient to maintain declaratory relief claim); In re Yahoo! Inc. 
Customer Data Sec. Breach Litig., 313 F. Supp. 3d 1113, 1139 (N.D. Cal. 2018) 
(distinguishing contract claim for past damages from declaratory relief claim for forward-
looking conduct); In re Adobe Sys., Inc. Priv. Litig., 66 F. Supp. 3d 1197, 1222–23 (N.D. 
Cal. 2014) (declaratory relief appropriate to address current and future controversy 
regarding existing security measures). The Adobe court observed that plaintiffs’ claims 
requested the type of relief the Declaratory Judgment Act is designed to provide: a 
declaration that will prevent future harm from ongoing and future violations before the 
harm occurs. Id. at 1222. 
The question here is whether Plaintiffs’ declaratory judgment claim seeks relief 
meaningfully distinct from their negligence claims. It does not. A comparison of the 
allegations reveals substantial overlap: both sets of allegations rest on the same conduct --
inadequate training, deficient security measures, and breach of duties. The defect is not 
just formal. Plaintiffs’ declaratory judgment count does not specify a controversy or 
form of relief that differs from the issues already presented by the negligence-based 
claims. Plaintiffs attempt to characterize the claim as forward-looking, but their forward-
looking allegations largely restate the same failures underlying their negligence claims 
without identifying a distinct prospective controversy that declaratory relief would 
resolve. 
The cases Plaintiffs cite do not lead to a different conclusion. In Baton, Yahoo!, 
and Adobe, plaintiffs sought declarations addressing ongoing security deficiencies 
separate from their damages claims--the courts found the forward-looking relief 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 35 of 37
 
-36- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
sufficiently distinct to justify proceeding. Here, by contrast, Plaintiffs have not 
articulated how their declaratory relief request differs in substance from the remedies 
available through their tort claims. (But see In re Yahoo! Inc. Customer Data Sec. 
Breach Litig., No. 16-MD-02752-LHK, 2017 WL 3727318, at *52–53 (N.D. Cal. Aug. 
30, 2017) (dismissing declaratory-relief claim where plaintiffs offered only conclusory 
allegations without identifying specific laws violated or pleading facts supporting their 
theory).) This case is closer to Jimenez and Reyes, where the declaratory-relief count was 
dismissed as duplicative because it sought no relief beyond what the underlying claims 
already provided, and these decisions are persuasive. See Jimenez, 2025 WL 2402137, at 
*9; Reyes, 2015 WL 4554377, at *8. 
Therefore, Movate’s motion to dismiss Plaintiffs’ declaratory judgment claim is 
GRANTED. Because the defect is substantive--Plaintiffs’ declaratory-relief allegations 
duplicate their negligence claims, which will persist regardless of repleading --the claim 
is DISMISSED WITH PREJUDICE. 
V. CONCLUSION 
For the foregoing reasons, the Court ORDERS as follows: 
1. Movate’s motion to dismiss for lack of subject-matter jurisdiction and insufficient 
service of process is DENIED AS MOOT. 
2. Movate’s motion to dismiss for lack of personal jurisdiction is DENIED. 
3. Movate’s motion to dismiss for lack of Article III standing is DENIED. 
4. Movate’s motion to dismiss the negligence claim is DENIED. 
5. Movate’s motion to dismiss negligence per se claim (Count II) is DENIED. 
6. Movate’s motion to dismiss the negligent hiring and supervision claim is 
DENIED. 
7. Movate’s motion to dismiss the invasion of privacy claims (Count IV; Count XV) 
is GRANTED. 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 36 of 37
 
-37- 
25-md-03149-BEN-MSB 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 
22 
23 
24 
25 
26 
27 
28 
8. Movate’s motion to dismiss the breach of fiduciary duty claim (Count VII) is 
DENIED. 
9. Movate’s motion to dismiss the unjust enrichment claim is GRANTED. The claim 
is DISMISSED WITH PREJUDICE insofar as it is premised on Massachusetts 
or New York law, and DISMISSED WITHOUT PREJUDICE insofar as it is 
premised on California or Michigan law. 
10. Movate’s motion to dismiss the declaratory judgment and injunctive relief claim is 
GRANTED WITH PREJUDICE. 
IT IS SO ORDERED. 
DATED: March 25, 2026 
 HON. ROGER T. BENITEZ 
United States District Judge 
 
 
Case 3:25-md-03149-AJB-MSB Document 445 Filed 03/25/26 PageID.<pageID> 
Page 37 of 37

Passage view · GavelSight