THOMAS W. THRASH, JR., United States District Judge
This is a securities fraud class action. It is before the Court on the Defendants Joint Motion to Dismiss [Doc. 62]. For the reasons set forth below, the Defendants Joint Motion to Dismiss [Doc. 62] is GRANTED in part and DENIED in part.
I. Background
This case arises out of a massive data breach incident. On September 7, 2017, the Defendant Equifax Inc. announced that it was the subject of a data breach affecting more than 148 million Americans (the Data Breach). Criminal hackers breached Equifaxs Computer network and obtained a vast amount of personally identifiable information in the companys custody. The Lead Plaintiff, Union Asset Management Holding AG, seeks to represent a putative class of investors that purchased the securities of Equifax from February 25, 2016 through September 15, 2017. The Plaintiff alleges that the Defendants committed fraud in connection with the Data Breach that caused a loss in value of the classs investments. Specifically, the Plaintiff alleges that the Defendants made multiple false or misleading statements and omissions about the sensitive personal information in Equifaxs custody, the vulnerability of its internal systems to cyberattack, and its compliance with data protection laws and cybersecurity best practices. Despite these assurances, Equifax allegedly failed to take some of the most basic precautions to protect its computer systems from hackers. According to the Plaintiff, these material misrepresentations artificially inflated the value of Equifaxs securities, causing a loss in value of the classs investments when the truth was revealed after the Data Breach.
Equifax is a Georgia corporation with its headquarters in Atlanta, Georgia. It is one of the three largest credit reporting agencies in the world. Equifax operates primarily through four segments: U.S. Information Solutions, a segment that provides products and services to businesses; Equifaxs International operating segment, which includes its Asia, Europe, Latin America, and Canada business units; Equifaxs Workforce Solutions segment, which provides verification and employer services; and Global Consumer Solutions, its direct-to-consumer business that provides consumers with products to protect and monitor their credit and identity. The Defendants Richard F. Smith, John W. Gamble, Jr., Rodolfo O. Ploder, and Jeffrey L. Dodge (the Individual Defendants) were corporate officers at Equifax during the putative class period. The Defendant Richard F. Smith is the former Chief Executive Officer and Chairman of the Board of Directors of Equifax. Smith resigned from both of these positions on September 26, 2017. The Defendant John W. Gamble is the Corporate Vice President and Chief Financial Officer of Equifax. The Defendant Rodolfo O. Ploder is the President of Equifaxs Workforce Solutions operating segment. The Defendant Jeffrey L. Dodge is the Senior Vice President of Investor Relations at Equifax.
As part of its business, Equifax collects, maintains, and sells a huge quantity of personal data about consumers and employees all over the world. This personally identifiable information is highly sensitive. It includes Social Security numbers, addresses, birthdays, employment history, drivers license information, detailed payment history, loans, credit card information, and more. Credit bureaus such as Equifax acquire this information from banks, mortgage lenders, credit card issuers, and other financing companies. This personally identifiable information is a highly valuable target for cybercriminals; it includes some of the most private information about consumers. This information can be used to enter into a mortgage, set up a bank account, change a phone number, and even more.
The Defendants recognized the importance of safeguarding this highly sensitive personal information. In its SEC filings, Equifax acknowledged that it collected and stored sensitive data, including the personally identifiable information of consumers, and stated that safeguarding this data was critical to its business operations and strategy. It noted that its success was dependent upon its reputation as a trusted steward of information. Equifax also acknowledged that it was a valuable target for cybercriminals due to the vast trove of information it collected. In its SEC filings, Equifax recognized that it was regularly the target of criminal hackers, and that a cybersecurity incident could subject it to a variety of serious consequences.
Acknowledging the importance of protecting the data in its custody, the Defendants made a number of statements during the class period regarding Equifaxs networks and the security of the personal data in its custody. According to the Plaintiff, the Defendants issued statements concerning the strength of Equifaxs cybersecurity systems, its compliance with data protection laws, and the integrity of its internal controls. For example, with regard to the strength of its data security, Equifaxs website provided that the company employed strong data security and confidentiality standards and maintained a highly sophisticated data information network that includes advanced security, protections and redundancies. With regard to Equifaxs compliance with data protection laws, regulations, and standards, the Defendants stated in SEC filings that they continuously monitored federal and state legislative and regulatory activities in order to remain in compliance with those laws. The Defendants also certified in SEC filings during the class period that Equifax had effective internal controls that would provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets.
However, despite these assurances, Equifaxs cybersecurity was dangerously deficient. The Data Breach, according to the Plaintiff, was the inevitable result of widespread shortcomings in Equifaxs data security systems. According to the Plaintiffs allegations, Equifaxs data protection measures were grossly inadequate, failed to meet the most basic industry standards, and ran afoul of the well-established mandates of applicable data protection laws. These shortcomings spanned a number of facets of cybersecurity practices, including a failure to implement proper patching protocols, failure to encrypt sensitive information, the storage of sensitive data on public-facing servers, the use of inadequate network monitoring practices, the use of obsolete software, and more. Overall, according to cybersecurity experts, a catastrophic breach of Equifaxs systems was inevitable because of systemic organizational disregard for cybersecurity and cyber-hygiene best practices.
According to the Plaintiff, Equifax failed to implement an adequate patch management process, while also failing to remediate known deficiencies in its cybersecurity infrastructure. The company relied upon a single individual to manually implement its patching process across its entire network. This individual had no way to know where vulnerable software in need of patching was being run on Equifaxs systems. This protocol was far less secure than the automatic patching processes that many other companies, including Equifaxs peers, employ in their systems. According to cybersecurity experts, this patching process fell far short of industry standards.
Equifax also failed to encrypt sensitive data in its custody. According to the Amended Complaint, Equifax admitted that sensitive personal information relating to hundreds of millions of Americans was not encrypted, but instead was stored in plaintext, making it easy for unauthorized users to read and misuse. Not only was this information unencrypted, but it also was accessible through a public-facing, widely used website. This enabled any attacker that compromised the websites server to immediately have access to this sensitive personal data in plaintext. Smith also admitted during congressional testimony that, with respect to its core credit databases, Equifax failed to encrypt any of its data. It also failed to encrypt its highly vulnerable mobile applications, meaning that in addition to keeping sensitive data unencrypted in its own systems, it also failed to encrypt data being transmitted over the internet. This, according to experts, was a major security failure. And, when Equifax did encrypt data, it left the keys to unlocking the encryption on the same public-facing servers, making it easy to remove the encryption from the data. These inadequacies in Equifaxs encryption protocol fell far short of industry standards and data security laws, and showed that Equifax did not know what they were doing with respect to data security.
Moreover, Equifax also failed to implement adequate authentication measures. Authentication measures are mechanisms, such as passwords, that verify that a party attempting to access a system or network is authorized to do so. According to the Amended Complaint, Equifaxs authentication measures were insufficient to protect the sensitive personal data in its custody from unauthorized access. These mechanisms included weak passwords and security questions. For example, Equifax relied upon four digit pins derived from Social Security numbers and birthdays to guard personal information, despite the fact that these weak passwords had already been compromised in previous breaches. Furthermore, Equifax employed the username admin and the password admin to protect a portal used to manage credit disputes, a password that is a surefire way to get hacked. This portal contained a vast trove of personal information. According to cybersecurity experts, these shortcomings demonstrated poor security policy and a lack of due diligence. Equifaxs authentication practices fell short of the data security standards, which recommend the use of multi-factor authentication.
Equifax also failed to adequately monitor its networks and systems, which greatly exacerbated the fallout of the Data Breach. According to the Plaintiff, Equifax failed to establish mechanisms for monitoring its networks and systems to alert when a threat existed. Such mechanisms include maintaining activity logs, setting up processes for tracking malicious scripts, and implementing file integrity monitoring. According to cybersecurity experts, logging is a simple but crucial cybersecurity technique in which a company monitors its systems by continuously logging network access so as to identify unauthorized users. This failure by Equifax greatly compounded the magnitude of the Data Breachs impact. According to experts, a breach as large scale as this one would not have occurred if Equifax had implemented better monitoring systems. If adequate monitoring systems had been in place, Equifax could have identified the breach much earlier and prevented the exfiltration of consumer data from its network. Improved logging techniques also could have enabled Equifax to expel the hackers from its systems and minimize the impact of the breach. Instead, due in part to Equifaxs failure to implement effective logging techniques, hackers were able to continuously access this sensitive personal data for over 75 days. Equifaxs failure to utilize proper network monitoring, one of the most basic cybersecurity practices, demonstrates the fundamental deficiencies in its networks.
Equifaxs handling of the sensitive data in its custody also reflected a poor cybersecurity regime. There were two main shortcomings as to this category. First, Equifax stored sensitive personal information, in unencrypted plaintext form, on public-facing servers and web portals. Second, it failed to partition this sensitive information to limit the exposure if a breach occurred. In contrast, standard security best practices recommend that companies ensure that sensitive data is stored on non-public servers and is inaccessible through public-facing networks. Equifaxs failure to properly segment its networks also contravened standard cybersecurity practices. Experts note that network segmentation, which consists of dividing a network into smaller partitions, isolates critical assets from one another and controls the access to sensitive data. Equifaxs failure to properly handle this sensitive data is another example of the deficiencies in its cybersecurity regime.
Many other aspects of Equifaxs cybersecurity practices were also deficient. According to the Plaintiff, Equifax relied upon outdated security systems and software, allowed its attack surface to grow too big by leaving thousands of servers exposed on the internet; allowed unused data to accumulate and failed to dispose of unneeded data; failed to restrict access to sensitive data to only those employees whose job responsibilities required such access; failed to adequately train its security personnel; failed to perform adequate reviews of its systems, networks, and security; and failed to develop a data breach management plan. However, despite the woeful state of Equifaxs cybersecurity, the Defendants made a number of statements touting the strength of Equifaxs data systems and the cybersecurity practices that it employed.
According to the Plaintiff, the Defendants also ignored a number of warnings that Equifaxs data security measures were inadequate. In 2014, KPMG performed a security audit of Equifax which found that, among other deficiencies, Equifax left encryption keys on the same public servers where encrypted data was stored. Then, in 2016, Equifax hired Deloitte to perform another security audit. Deloitte discovered several problems in its audit, including inadequate patching systems. However, according to former cybersecurity employees at Equifax, the companys management did not take the security audit seriously. Equifax employees and cybersecurity researchers continued to warn Equifax of deficiencies in its cybersecurity protocol. They warned Equifax about its inadequate patching systems, its failure to encrypt sensitive personal data, its storage of personal data on public-facing servers, and more. Furthermore, in March 2017, Equifax hired Mandiant, a cybersecurity firm, to investigate weaknesses in its data protection systems. This investigation, which was described as a top-secret project, was personally overseen by Smith. Mandiant concluded that Equifaxs data protection systems were grossly inadequate. Mandiant specifically identified Equifaxs unpatched systems and misconfigured security policies as indicative of major problems. However, instead of heeding Mandiants advice, Equifax squelched a broader review of Equifaxs security systems.
Equifax also experienced other, smaller data breaches prior to the Data Breach here. According to the Plaintiff, these previous breaches should have warned the Defendants that Equifaxs cybersecurity, including its authentication and network monitoring measures, was severely deficient. In April 2016, hackers breached Equifaxs W2Express website, a service that offers downloadable W-2 forms for companies. The hackers were able to access the W-2 data of hundreds of thousands of employees of numerous companies that contracted with Equifax to use this service. The hackers were able to access this information by entering an employees default PIN code, which was the last four digits of the employees Social Security number and their four-digit birth year. According to cybersecurity experts, these authentication measures fell short of data security best practices. The hackers were also able to remain undetected in Equifaxs networks for approximately one year before they were discovered, which the Plaintiff alleges reflected a failure to employ adequate network monitoring practices. Then, in February 2017, Equifax learned that another breach occurred in its Workforce Solutions segment. From April 2016 to March 2017, hackers were able to obtain wage and W-2 data maintained by Equifaxs TALX division, now called Equifax Workforce Solutions. The hackers were again able to exploit Equifaxs use of personal identifiers and weak four-digit PIN codes to protect this sensitive data. The hackers also were able to remain in Equifaxs network for over a year. Cybersecurity experts opined that Equifaxs authentication protections, which were exploited in this breach, were inadequate and failed to meet basic industry standards. After this incident Equifax promised to make improvements in its cybersecurity defenses, but failed to do so.
On or about March 7, 2017, security firms began issuing warnings that attackers were exploiting a vulnerability in Apache Struts, an open-source software application used to build interactive websites. This software is commonly used for websites where customers submit online forms. Apache Struts is widely used by large businesses, including a substantial percentage of the Fortune 100 companies. Equifax used Apache Struts at this time. Security firms began reporting that Apache Struts was vulnerable to a remote code execution attack. This attack is a dangerous type of exploit that allows attackers to force the vulnerable systems into running computer programs written by the attackers, which can make it easy to either steal data or establish a foothold in the vulnerable system. This weakness in Apache Struts was not just highly dangerous - it was also especially easy to exploit. Due to both the dangerous nature of this vulnerability and the widespread use of Apache Struts in the business community, the vulnerability and the corresponding update to the software aimed at addressing the vulnerability were widely publicized. Both Apache itself and security firms publicized the vulnerability. By March 8, 2017, Apache released updated versions of Apache Struts to mitigate this vulnerability in the software.
In March 2017, hackers breached Equifaxs network using the Apache Struts vulnerability. On or about May 13, 2017, the hackers accessed files containing Equifax usernames and passwords, which they then used to access documents and sensitive information in Equifaxs legacy environment, an area where it stored old data that it no longer used. The attackers accessed numerous databases and compromised multiple systems. The collection of information that the hackers obtained was so large that they had to break it up into smaller pieces to avoid setting off alarms. The hackers ultimately stole the names, Social Security numbers, birthdays, addresses, drivers license information, tax identification numbers, and other personal data of 148 million Americans, as well as personal information of nearly one million foreign consumers and employees. They also obtained the credit card information for 209,000 consumers.
On July 29 and 30 of 2017, Equifax discovered that criminal hackers had gained unauthorized access to its network. Susan Mauldin, Equifaxs Chief Security Officer, notified John Kelly, Equifaxs Chief Legal Officer, about the Data Breach on July 31. Mauldin informed Kelly that personally identifiable information may have been compromised in the Data Breach. Under Equifaxs data security protocol, the chief of security is alerted about any issues, who then determines the severity of the breach. If the chief of security determines the breach to be severe, he or she then informs the executive leadership of the issue. On July 31, Smith was notified about the Data Breach. Kelly told Smith that Chief Information Officer David Webb would meet with him in person to discuss a data security issue. In this meeting, Webb notified Smith of the Data Breach, informing him that it had occurred in an online consumer dispute portal.
On August 2, 2017, Equifax notified the FBI of the Data Breach. It also retained legal counsel to guide its investigation into the breach. The same day, Equifaxs legal counsel retained Mandiant to assist in the investigation into the incident. Experts would later note that these steps suggested that Equifax knew that the Data Breach was serious. In the days immediately following the discovery of the Data Breach, Gamble and Ploder sold more than $ 1 million in Equifax stock. On August 1, Gamble, Equifaxs Chief Financial Officer, sold stock for $ 946,374, representing more than thirteen percent of his holdings. On August 2, Ploder sold stock for $ 250,458, representing four percent of his holdings. These sales were not made pursuant to a Rule 10b5-1 trading plan. Smith would later state in congressional testimony that Ploder and Gamble would have been in many of the meetings he had concerning the Data Breach.
By August 11, 2017, Mandiant confirmed that hackers accessed databases containing a large amount of consumers personally identifiable information. Smith requested a briefing on the Data Breach on August 15, 2017. At this briefing, Smith was informed that it was likely that personally identifiable information had been stolen. On August 16, 2017, at an Equifax investor conference, the Defendants stated that Equifaxs role as a Trusted Steward is a Key Execution Enabler and stated that it was making investments to address critical data security throughout the company. On August 17, 2017, Smith spoke at an event at the Terry College of Business at the University of Georgia. When asked by an audience member how Equifax prepares for data fraud, Smith responded when you have the size database we have, its very attractive for others to try to get into our database, so it is a huge priority for us as you might guess. [ ] [Data fraud] is my number one worry, obviously.
On September 7, 2017, Equifax disclosed the Data Breach to the public for the first time. In a press release after the close of trading that day, Equifax revealed that it had suffered a data breach affecting the personal information of approximately 143 million American consumers. Equifax continued to make subsequent disclosures over the following days, ending on September 15, 2017, providing additional details concerning the Data Breach. The company stated that it had engaged Mandiant, a cybersecurity firm, to conduct a review, and that it had reported the breach to law enforcement. Experts, analysts, and the media immediately began to weigh in, with one analyst describing the breach as one of the biggest cyber-attacks in US history. Cybersecurity experts opined that massive cybersecurity failures on Equifaxs part resulted in the Data Breach, and that its public response and outreach were haphazard and ill-conceived. Financial experts also began to weigh in. Some financial analysts predicted from the outset of this public revelation that, due to the unprecedented size of this incident, Equifaxs stock price would decline. Other analysts predicted that Equifax would incur substantial costs relating to the Data Breach for years to come.
On September 8, 2017, the price of Equifaxs common stock dropped nearly fifteen percent, closing at $ 123.13 per share. There was also an extraordinarily high trading volume of 16.85 million shares of Equifax stock. On Monday, September 11, 2017, in response to more revelations made over the weekend, Equifaxs stock price fell another nine percent to $ 113.32 per share. Over the course of the next few days, more information concerning Equifaxs cybersecurity and the Data Breach was revealed to the public. By September 15, 2017, Equifaxs stock price had fallen to $ 92.98, nearly a thirty-six percent decline since the initial public disclosure of the Data Breach.
On September 8, 2017, this action was commenced. In the Amended Complaint, the Plaintiff asserts one claim for violation of section 10(b) of the Exchange Act and Rule 10b-5 promulgated thereunder against all of the Defendants (Count I), and one claim for violation of section 20(a) of the Exchange Act against the Individual Defendants (Count II). The Plaintiff alleges that the Defendants made false or misleading statements on Equifaxs website, in Equifaxs SEC filings, and at Equifax Investor Conferences and Presentations. According to the Plaintiff, these false or misleading statements concerned the state of Equifaxs cybersecurity, Equifaxs compliance with data protection laws, regulations, and industry best practices, and Equifaxs internal controls. On June 18, 2018, this Court modified the PSLRAs automatic stay of discovery to allow for limited case management and discovery planning activities. The Defendants now move to dismiss.
II. Legal Standard
A complaint should be dismissed under Rule 12(b)(6) only where it appears that the facts alleged fail to state a plausible claim for relief. A complaint may survive a motion to dismiss for failure to state a claim, however, even if it is improbable that a plaintiff would be able to prove those facts; even if the possibility of recovery is extremely remote and unlikely. In ruling on a motion to dismiss, the court must accept the facts pleaded in the complaint as true and construe them in the light most favorable to the plaintiff. Generally, notice pleading is all that is required for a valid complaint. Under notice pleading, the plaintiff need only give the defendant fair notice of the plaintiffs claim and the grounds upon which it rests.
Complaints that allege fraud under federal securities law must satisfy the heightened pleading requirements of both Rule 9(b) and the Private Securities Litigation Reform Act of 1995. Rule 9(b) requires a complaint to state with particularity the circumstances constituting fraud. A complaint satisfies Rule 9(b) if it sets forth precisely what statements or omissions were made in what documents or oral representations, who made the statements, the time and place of the statements, the content of the statements and manner in which they misled the plaintiff, and what benefit the defendant gained as a consequence of the fraud.
The PSLRA also sets forth heightened pleading standards. This law was enacted to cure perceived abuses in prosecuting class actions brought pursuant to federal securities laws. The PSLRA supplements Rule 9(b) in two ways. First, a plaintiff must specify the reason or reasons why the statement is misleading, and, if an allegation regarding the statement or omission is made on information and belief, the complaint shall state with particularity all facts on which that belief is formed. Second, a plaintiff must set forth particular facts that give rise to a strong inference that the defendants acted with the required state of mind. Specifically, it requires that the complaint shall, with respect to each act or omission alleged to violate this chapter, state with particularity facts giving rise to a strong inference that the defendant acted with the required state of mind. A complaint that fails to comply with any of these requirements must be dismissed.
III. Discussion
Section 10(b) of the Exchange Act of 1934 makes it unlawful [t]o use or employ, in connection with the purchase or sale of any security ... any manipulative or deceptive device or contrivance in contravention of such rules and regulations as the Commission may prescribe. Rule 10b-5, promulgated thereunder by the Commission, states:
It shall be unlawful for any person, directly or indirectly, by use of any means or instrumentality of interstate commerce, or of the mails or of any facility of any national securities exchange, (a) To employ any device, scheme, or artifice to defraud, (b) To make any untrue statement of a material fact or to omit to state a material fact necessary in order to make the statements made, in the light of the circumstances under which they were made, not misleading, or (c) To engage in any act, practice, or course of business which operates or would operate as a fraud or deceit upon any person, in connection with the purchase or sale of any security.
To establish a securities fraud claim under these provisions, a plaintiff must allege: (1) a material misrepresentation or omission; (2) made with scienter; (3) a connection with the purchase or sale of a security; (4) reliance on the misstatement or omission; (5) economic loss; and (6) a causal connection between the material misrepresentation or omission and the loss, commonly called loss causation.
The Defendants make four main arguments. First, they argue that the Plaintiff has failed to adequately plead that they made false or misleading statements. Second, they contend that the Plaintiff has failed to plead a strong inference of scienter, as required under the PSLRA. Third, they argue that the Plaintiff fails to adequately plead loss causation, an essential element of a section 10(b) claim. Finally, they argue that the Plaintiffs section 20(a) claim fails. The Court addresses each of these arguments in turn.
A. False or Misleading Statements
The Defendants first argue that the Plaintiff fails to sufficiently plead that the statements in question were false or misleading, as required by the PSLRA. Complaints alleging fraud must meet the heightened-pleading standards of Rule 9(b), which requires that in alleging fraud or mistake, a party must state with particularity the circumstances constituting fraud or mistake. A fraud claim meets the requirements of Rule 9(b) if it sets forth precisely what statements or omissions were made in what documents or oral presentations, who made the statements, the time and place of the statements, the contents of the statements or manner in which they misled the plaintiff, and what the defendants gained as a consequence. Additionally, the PSLRA requires a securities-fraud plaintiff to specify each statement alleged to have been misleading and the reason or reasons why the statement is misleading. To show falsity, one typically juxtaposes an alleged misrepresentation to a contrary true fact. A statement is misleading if in the light of the facts existing at the time of the statement a reasonable investor, in the exercise of due care, would have been misled by it. If an allegation regarding a statement or omission is made on information and belief, the complaint must state with particularity the facts on which the belief is formed.
This securities-fraud case is based primarily on the Defendants alleged misrepresentations during the class period about the security of Equifaxs networks and its efforts to ensure the protection of the data in its custody. The Defendants purported misrepresentations can be grouped into three main categories: (1) statements concerning Equifaxs cybersecurity and its efforts to protect consumer data; (2) statements concerning Equifaxs compliance with data protection laws, regulations, and industry best practices; and (3) statements concerning Equifaxs internal controls. The Defendants make four main arguments in favor of dismissal. First, they argue that many of the Plaintiffs claims allege mere corporate mismanagement. Second, they argue that the Plaintiff has not sufficiently pleaded the falsity of the alleged statements as required by the PSLRA. Third, they argue alleged statements of opinion or belief are not actionable. Fourth, they argue that they were under no duty to disclose the Data Breach prior to September 7, 2017. The Court addresses each of these.
1. Corporate Mismanagement
The Defendants first contend that many of the Plaintiffs allegations concern mere corporate mismanagement, which is not actionable under the federal securities laws. Specifically, the Defendants contend that [a]llegations that Defendants should have implemented different or better security measures to protect data are, at most, allegations of mismanagement, for which the securities laws do not provide a remedy. In Santa Fe Industries, Inc. v. Green , the Supreme Court held that allegations of corporate mismanagement are not actionable under section 10(b) because the federal securities laws do not regulate corporate fiduciary duties. There, the Supreme Court rejected a minority shareholders claim that the companys majority shareholders violated section 10(b) by utilizing a short-form merger to eliminate the minoritys interest. The Court concluded that the transaction at issue was not manipulative or deceptive within the meaning of section10(b), and consequently not actionable. Thus, a plaintiff who alleges mere corporate mismanagement or breach of fiduciary duty does not state a claim under section10(b). From this, the Defendants argue that many of the Plaintiffs claims fail because they merely make hindsight criticisms of the adequacy of Equifaxs management of its data security efforts.
However, false or misleading statements or omissions concerning material facts about management or internal operations may be actionable, such as when a defendant makes certain statements while that defendant knows that existing mismanagement makes those statements false or misleading. Thus, while allegations that Equifax engaged in mismanagement would fail under section 10(b), allegations that the Defendants made false or misleading statements or omissions concerning such corporate mismanagement at Equifax can constitute basis for a section 10(b) claim. The Defendants misconstrue the Plaintiffs argument. The Plaintiff does not argue that the Defendants violated section 10(b) by failing to implement better cybersecurity practices. Instead, the Plaintiff contends that the Defendants violated section 10(b) by making false or misleading statements as to the strength and quality of Equifaxs cybersecurity. Such a claim is not barred by Santa Fe.
2. The Adequacy of Equifaxs Data Security
Next, the Defendants argue that the statements touting the strength of Equifaxs data security systems and the adequacy of Equifaxs efforts to promote cybersecurity do not constitute material misrepresentations. In the Amended Complaint, the Plaintiff alleges that the Defendants made a variety of material misrepresentations as to the state of Equifaxs data security and Equifaxs efforts to promote cybersecurity. For example, the Defendants allegedly stated that Equifax was a trusted steward of personal data and that it employed strong data security and confidentiality standards on the data that we provide and on the access to that data. They allegedly stated that Equifax maintain[ed] a highly sophisticated data information network that includes advanced security, protections and redundancies. According to the Plaintiff, the fundamental shortcomings in Equifaxs cybersecurity, including a failure to take some of the most elementary precautions, render these statements false or misleading.
The Defendants make two main arguments for why these statements are not material misrepresentations. First, they argue that the alleged statements are not actually false or misleading because the facts pleaded do not show that Equifaxs data security was actually inadequate. Second, they contend that these statements constitute inactionable puffery. According to the Defendants, these statements were vague, meaningless, statements of corporate optimism that no reasonable shareholder would rely upon in making investment decisions. The Court addresses each of these arguments in turn.
i. Falsity
The Defendants contend that the Plaintiff has failed to plead the falsity of each of the alleged statements concerning the strength of Equifaxs systems. They argue that the Plaintiff has not shown that the statements boasting of the strength and complexity of Equifaxs cybersecurity are actually false. Instead, according to the Defendants, the Plaintiff has only alleged that Equifax was the victim of a criminal attack that was out of its control. They contend that the fact that a company suffered a significant cyberattack does not necessarily mean that its cybersecurity was deficient, and thus does not render its prior statements about its commitment to data security false.
However, the Plaintiff alleges more than just the mere occurrence of the Data Breach. The Plaintiff has pleaded a multitude of specific, detailed factual allegations demonstrating that Equifaxs cybersecurity systems were grossly deficient and outdated, despite the Defendants various assurances to the contrary. In the Amended Complaint, the Plaintiff alleges that Equifax failed to implement even the most basic security measures, reflecting a systemic organizational disregard for cybersecurity and cyber-hygiene best practices. Cybersecurity experts opined that Equifaxs data security failures flowed from an inadequate tone at the top and that the real problem was a very poor focus on information security at the highest levels of the company. For example, according to the Plaintiff, Equifax failed to implement an effective patch management process, relying upon a single employee to manually implement the companys patching process across its entire network. This process failed to meet the most basic industry standards - application of security patches is a critical cybersecurity practice. Because of this shortcoming, Equifax allegedly failed to remediate known deficiencies in its cybersecurity infrastructure, such as the Apache Struts vulnerability. Furthermore, according to the Plaintiff, Equifax failed to implement adequate encryption measures to protect sensitive information, in contrast to its representation that it encrypted confidential information. Equifax allegedly stored and transmitted the personal information of hundreds of millions of consumers in unencrypted, plaintext, making it easy for intruders to read and misuse.
Overall, the Plaintiff alleges that, among other things, Equifax: (1) failed to implement adequate patching processes; (2) failed to create adequate encryption measures to protect the information in its custody; (3) failed to implement adequate authentication measures to ensure that parties attempting to access its networks were authorized to do so; (4) failed to establish mechanisms for monitoring its networks for security breaches; (5) stored personal data in easily accessible public channels; (6) relied on outdated and obsolete software; and (7) failed to warehouse obsolete personal information. Together, according to the Plaintiff, each of these shortcomings created an inadequate cybersecurity system.
Given the dangerously deficient state of Equifaxs cybersecurity, the Court concludes it was false, or at least misleading, for Equifax to tout its advanced cybersecurity protections. In contrast to the Defendants representations that, among other things, Equifax employed a highly sophisticated data information network
and advanced security protections, Equifaxs data security was dangerously lacking. While it is true that the mere occurrence of a data breach may not necessarily mean that a companys data security systems are inadequate, the Plaintiff here does not rely solely upon the occurrence of the Data Breach to establish that the Defendants statements were false. Instead, the Plaintiff has pleaded a variety of facts showing that Equifaxs cybersecurity systems were outdated, below industry standards, and vulnerable to cyberattack, and that Equifax did not prioritize data security efforts.
Furthermore, as the Plaintiff points out, a number of courts have come to a similar conclusion, holding that statements touting the strength or quality of an important business operation are false, and thus actionable, when those operations are, in reality, deficient. For example, in In re ValuJet, Inc., Securities Litigation the court explained that:
The Plaintiffs allege that, despite the numerous safety-related incidents and FAA heightened scrutiny of ValuJets operations, (1) Defendants Jordon and Priddy fraudulently represented in the 1995 report to shareholders that ValuJets paramount goal was profitability while maintaining operational integrity; (2) Defendant Priddy fraudulently represented at an investors conference in April, 1996 that ValuJet planned to add additional aircraft and that growth would be significant; and (3) Defendant Jordan fraudulently represented in a press release in April, 1996 that ValuJets safety record had been certifiably among the very best in the airline industry. When viewing the allegations in the Complaint as true, the Court finds that Defendants Jordan and Priddys alleged misrepresentations during the class period are sufficiently plead under the PSLRA heightened-pleading standards to constitute false statements for the purposes of a Rule 10b-5 claim.
Similarly, the Defendants representations that Equifax employed a highly sophisticated data information network are allegedly false given the actual state of its systems.
The case that the Defendants primarily rely upon, In re Heartland Payment Systems, Inc. Securities Litigation is distinguishable. In Heartland , the corporate defendant, a provider of bank card payment processing services to merchants, suffered a Structured Query Language attack by criminal hackers. This attack placed hidden, malicious software on the defendants network, which infected its payment processing system. Because of this, hackers were able to steal 130 million credit card and debit card numbers. After this incident, the plaintiffs filed a securities action, alleging that the defendants misrepresented the state of Heartlands network security, that they concealed the occurrence of data breach from investors, and they made false statements concerning the adequacy of its security systems and the efforts they took for network security. Specifically, Heartland had stated that it place[d] significant emphasis on maintaining a high level of security and maintained a network configuration that provides multiple layers of security to isolate our databases from unauthorized access. The plaintiffs argued that those statements were untruthful because Heartland had suffered the SQL attack and had not fully resolved security issues arising out of that attack. The court concluded, however, that these statements were not false or misleading because there was nothing inconsistent between these statements and the fact that Heartland had suffered an SQL attack. The fact that a company has suffered a security breach does not demonstrate that the company did not place significant emphasis on maintaining a high level of security. The court further explained that it was equally plausible that Heartland did place a high emphasis upon security.
In contrast, the Plaintiff here has not alleged that the Defendants statements concerning Equifaxs cybersecurity practices are false merely because Equifax suffered a security breach. Instead, the Plaintiff has asserted specific factual allegations describing the poor state of Equifaxs cybersecurity. These allegations depict a data security system that was dangerously deficient and fell far short of industry standards. Unlike in Heartland , where it was plausible that the company placed a high emphasis on security but nonetheless was a victim of a breach, Equifaxs data security is alleged to have been in disrepair, in contrast to the Defendants statements otherwise. Thus, Heartland is distinguishable.
The Defendants also argue that these allegations fail because the Plaintiff has failed to plead the falsity of the statements concerning the adequacy of cybersecurity with particularity. The PSLRA requires a plaintiff to specify the reason or reasons why the statement is misleading. For example, the Defendants contend that the Plaintiff has not adequately alleged the falsity of the statement that the Equifax network is reviewed on a continual basis by external security experts who conduct intrusion testing, vulnerability assessments, on-site inspections, and policy/incident management reviews. However, the Court concludes that the Plaintiff has satisfied its requirement to plead the falsity of these statements with particularity. The Plaintiff alleges in the Amended Complaint that this statement was false or misleading because Equifax ignored advice issued by those external security experts warning the Company about gross inadequacies in its cybersecurity, because Equifax failed to heed the calls of its cybersecurity consultants to perform comprehensive system reviews, and because Equifaxs vulnerability scanning was deficient since scans were performed infrequently, examined only portions of Equifaxs systems, relied on outdated technology, and lacked appropriate redundancies. The Defendants argue that these allegations merely second-guess the extent or efficacy of these efforts. However, the Court concludes that these allegations are sufficient because they explain why this statement was false, or at a minimum, misleading. These allegations explain that it was misleading to state that cybersecurity experts continually review Equifaxs systems when Equifax ignored those experts suggestions and used superficial vulnerability scanning.
The Defendants also challenge the statements that Equifax had a rigorous enterprise risk management program that targeted its cybersecurity risks, that Equifax used a variety of technical, administrative and physical ways to keep personal credit data safe, that Equifax regularly review[ed] and update[d] [its] security protocols, and that Equifax develop[ed], maintain[ed], and enhance[d] secured proprietary information databases. According to the Defendants, the Plaintiffs allegations that Equifaxs efforts were inadequate fail because they do not show that Equifax did not have a risk management program, or that it did not attempt to comply with data security regulations. However, the Plaintiff adequately alleges the falsity of each of these statements with particularity. With each of these statements, the Plaintiff explains how the context of Equifaxs cybersecurity makes them false or misleading. The Plaintiff alleges that each of these areas of cybersecurity was so deficient that it was misleading for Equifax to assure investors that these efforts were promoting the security of its data systems. These statements do more than merely tell investors that a risk management program existed or that it used various cybersecurity techniques. Instead, Equifax used these statements to assure investors that they were taking cybersecurity seriously.
Furthermore, the Defendants also take many of these statements out of context in their brief. For example, the Defendants argue that the Plaintiff has not shown that it was false or misleading to state that Equifax had an enterprise risk management program. But, in the Amended Complaint, the Plaintiff alleges that Equifax stated that it has a rigorous enterprise risk management program targeting ... data security. An assurance that Equifax employed a rigorous enterprise risk management program is more misleading to investors than simply affirming the existence of an enterprise risk management program. Similarly, the Defendants argue that the Plaintiff has not alleged that it was false to state that Equifax regularly review[ed] and update[d] [its] security protocols, even if those efforts were not effective or to the necessary extent. However, in the Amended Complaint, the Plaintiff alleges that Equifax stated that [w]e regularly review and update our security protocols to ensure that they continue to meet or exceed established best practices at all times. This statement does not merely state that Equifax reviewed and updated its security protocols, but instead that it did so to ensure that it met established best practices. Furthermore, the Defendants argue that the Plaintiff has not shown that the statement that Equifax monitor[ed] federal and state legislative and regulatory activities that involve credit reporting, data privacy and security is false, when in reality the Plaintiff alleges that Equifax stated that [w]e continuously monitor federal and state legislative and regulatory activities that involve credit reporting, data privacy and security to identify issues in order to remain in compliance with all applicable laws and regulations. This context, omitted by the Defendants in their argument, is important in determining whether the statements were false or misleading.
ii. Puffery
Next, the Defendants argue that many of the challenged statements concerning Equifaxs commitment to data security constitute inactionable puffery. Alleged misrepresentations must be based upon a material fact to give rise to a securities law violation. Subjective characterizations of a companys current performance or predictions about future performance, absent a false misstatement of fact, are generally not actionable. Such statements of corporate optimism or puffery are not actionable because they both lack an underlying factual basis and also fail the materiality requirement of Rule 10b-5. Thus, vague, optimistic statements are not actionable because reasonable investors do not rely on them in making investment decisions. Statements constitute puffery if they are too general to cause a reasonable investor to rely upon them. According to the Defendants, many of the alleged statements reflected corporate optimism and aspiration that a reasonable investor would not rely upon, and thus constitute puffery. Such statements of puffery cannot serve as the basis for a section 10(b) claim because a reasonable investor would not rely upon them. For example, the Defendants contend that many of the statements generally avow a commitment to data security or characterize security as a priority for Equifax. According to the Defendants, a reasonable investor would not rely upon statements such as these, which are generalized, non-verifiable, and vague statements of commitment to and aspirations about data security.
However, the Court finds that these alleged statements are not inactionable puffery. An alleged misstatement or omission must be so obviously unimportant to a reasonable investor that reasonable minds could not differ on the question of their importance to be deemed inactionable puffery. For example, in the context of a drilling companys statements concerning its safety and training efforts, one court noted that it could not say, as a matter of law, that Transoceans representation that such efforts were extensive was obviously unimportant to GSF shareholders since [i]n an industry as dangerous as deepwater drilling, it is to be expected that investors will be greatly concerned about an operators safety and training efforts. Likewise, the Court cannot say, as a matter of law, that Equifaxs representations that its cybersecurity efforts were extensive or that it was committed to data security were so obviously unimportant to its shareholders that they should be considered immaterial. Furthermore, the fact that these statements relate to a core aspect of Equifaxs business makes it even more likely that a reasonable investor would assign weight to them. Since data security plays an important part of a business such as Equifax, investors would be even more likely to find these types of representations important in making their investment decisions. For these reasons, the Court cannot, as a matter of law, conclude that these statements are obviously unimportant to Equifaxs investors.
Moreover, the context of these alleged statements is important to this determination. Although the alleged statements, when viewed in isolation, might constitute puffery, the fact that they were made repeatedly to assure investors that Equifaxs systems were secure could lead a reasonable investor to rely upon them as reflecting the state of Equifaxs cybersecurity. Thus, the context of these supposedly aspirational statements matters: the Defendants repeatedly stated that cybersecurity, an important aspect of their business, was a top priority for senior management, despite the fact that Equifax failed to employ some of the most elementary cybersecurity practices. Even if, in a vacuum, each of these statements seems like a meaningless, corporate vaguery, when taken together a reasonable investor would rely upon them to conclude that Equifax made cybersecurity a serious priority.
The cases cited by the Defendants are unpersuasive. For example, in Ong v. Chipotle Mexican Grill, Inc. (Chipotle II) , the court concluded that statements that Chipotle was committed to serving safe, high quality food and that its food safety programs are ... designed to ensure that Chipotle compl[ies] with applicable federal, state and local food safety regulations
were inactionable puffery. However, the court provided little analysis for why those statements constituted puffery. Here, statements affirming a commitment to cybersecurity can be actionable because a reasonable investor might rely upon such statements in making investment decisions. Although the court in Chipotle II found statements that the company was committed to serving safe food to constitute puffery, the Court concludes that the statements here are not so obviously unimportant to investors given the repeated nature of these statements, the context of Equifaxs business, and the widespread nature of the deficiencies alleged in the Amended Complaint. Therefore, for these reasons, Chipotle II is unpersuasive.
3. Failure to Disclose the Data Breach
Next, the Defendants move to dismiss the Plaintiffs allegations based upon their purported failure to disclose the Data Breach earlier. In the Amended Complaint, the Plaintiff alleges that some of the alleged statements were or became misleading by omission because the Defendants did not publicly disclose the Data Breach until September 7, 2017. According to the Plaintiff, the Defendants statements after March 2017 lauding Equifaxs data security were false or misleading because Equifax knew or recklessly disregarded that hackers had already penetrated its databases.
However, the Court concludes that the Defendants were under no duty to disclose the Data Breach prior to becoming aware of the incident in July 2017. The Plaintiff has not alleged that the Defendants knew about the Data Breach before July 29, 2017, but instead argues that they were reckless as to its occurrence. It bases its argument upon warnings that the Defendants allegedly received as to the deficient state of Equifaxs cybersecurity, its failure to employ adequate patching processes, and its failure to use proper network monitoring. These warnings might demonstrate that the Defendants knew of, or were reckless as to, Equifaxs ability to prevent or detect a breach. However, these warnings do not establish that the Defendants knew, or were reckless to the existence of, the specific Data Breach at issue here. The allegations also do not demonstrate that the Defendants knew of, or were reckless as to the existence of, Equifaxs failure to patch the Apache Struts vulnerability. Therefore, the Defendants were under no duty to disclose the existence of the Data Breach before they knew it had occurred.
Second, the Plaintiff argues that the Defendants were under a duty to correct their prior misstatements once they became aware of the Data Breach in July 2017. According to the Plaintiff, even if some of the Defendants statements may not have been misleading at the time they were made, the Defendants had a duty to correct the statements once they learned that the Data Breach had occurred. A duty to disclose can be created by a defendants previous decision to speak on the subject. Where a defendants failure to speak would render the defendants own prior speech misleading or deceptive, a duty to disclose arises. According to the Plaintiff, the Defendants had a duty to disclose once they learned that their prior statements concerning the security of Equifaxs systems became false due to the Data Breach.
However, the Court finds that the occurrence of the Data Breach did not itself make those prior statements false or misleading, and thus did not create a duty to disclose. As the Court noted above, the occurrence of a data breach does not necessarily imply that a companys data security is inadequate. In Heartland, the court concluded that the defendants were not under a duty to disclose the occurrence of a data breach because the plaintiffs had not alleged that the companys systems were actually deficient. The court noted that the occurrence of a data breach itself does not establish that a companys data security is inadequate. Similarly, here, the occurrence of the Data Breach itself did not necessarily render the Defendants prior statements false, and thus did not impose a duty to correct those statements by disclosing the occurrence of the Data Breach. Therefore, the Court finds this argument unavailing.
4. Statements About Cybersecurity Risks
Next, the Defendants move to dismiss the Plaintiffs allegations regarding Equifaxs warnings of its cybersecurity risks. In the Amended Complaint, the Plaintiff alleges that Equifax, Smith, and Gamble made false or misleading statements in SEC filings concerning the cybersecurity risks that Equifax faced. The Plaintiff alleges that Equifax stated in its 2015 and 2016 Forms 10-K that:
Despite our substantial investment in physical and technological security measures, employee training, contractual precautions and business continuity plans, our information technology networks and infrastructure or those of our third-party vendors and other service providers could be vulnerable to damage, disruptions, shutdowns, or breaches of confidential information due to criminal conduct, denial of service or other advanced persistent attacks by hackers[.]
However, according to the Plaintiff, it was false or misleading to state that Equifax could be vulnerable to a breach when, in fact, Equifax was highly vulnerable to such an attack, as, in fact, Defendants had been warned on numerous occasions both before and during the Class Period.
The Defendants argue that these allegations fail to state a claim because, through these statements, the Defendants warned of the precise risk that caused the Plaintiffs losses. The Court finds that these statements are not actionable. The difference between disclosing that Equifax could be vulnerable and that it was highly vulnerable would not mislead a reasonable investor in making an investment decision. The case that the Plaintiff relies upon, In re Van der Moolen Holding N.V. Securities Litigation , is distinguishable. There, the court concluded that cautionary statements can give rise to a section 10(b) violation. The court noted that to caution that it is only possible for the unfavorable events to happen when they have already occurred is deceit. However, that case is distinguishable. There, the defendant warned investors about regulatory risks, even though it knew or was recklessly ignorant that its employees were violating NYSE rules. Here, in contrast, the risk warned of is different. The Defendants warned that Equifax could be vulnerable to a data breach, but they did not fail to disclose the existence of a breach when they made that statement. Thus, unlike in Van der Moolen , the Defendants did not warn that Equifax could be at risk, when it in fact was suffering a data breach. Therefore, the Court finds these risk statements inactionable.
5. Equifaxs Compliance With Data Protection Laws
Next, the Defendants move to dismiss the Plaintiffs claims concerning statements about Equifaxs compliance with data protection laws, regulations, and best practices. In the Amended Complaint, the Plaintiff alleges that the Defendants made various statements assuring that Equifax complied with relevant data protection laws, regulations, standards, and best practices. For example, the Plaintiff alleges that Equifax stated on its website that it takes great care to ensure that we use and process personal data in ways that comply with applicable regulations and respects individual privacy. Equifax also stated that [w]e regularly review and update our security protocols to ensure that they continue to meet or exceed established best practices at all times and that [w]e continuously monitor federal and state legislative and regulatory activities that involve credit reporting, data privacy and security to identify issues in order to remain in compliance with all applicable laws and regulations. However, despite these affirmations, Equifax allegedly fell far short of complying with these regulatory requirements.
The Defendants first assert that these claims merely allege corporate mismanagement, which is not actionable under federal securities laws. However, as explained above, this argument fails. The Plaintiff does not allege that the Defendants violated section 10(b) by failing to comply with cybersecurity laws, regulations, and best practices. Instead, the Plaintiff argues that they violated section 10(b) by stating that Equifax was in compliance with these laws and regulations, when in fact it was not. As stated above, the Court finds that such a claim is actionable under federal securities laws. If the Plaintiff adequately alleged that Equifax made false statements concerning its compliance with these laws, regulations, and standards, then such claims would not be barred by Santa Fe.
The Defendants next argue that these alleged statements described Equifaxs ongoing efforts to comply with data protection laws and standards, and that the statements did not guarantee compliance. According to the Defendants, the Plaintiff has not adequately alleged the falsity of these statements because the fact that they were not in compliance does not mean that they were not making efforts to comply. However, in the alleged statements, Equifax did more than just say that it made efforts to comply with these laws and standards. It stated that it monitored regulatory activities to remain in compliance with all applicable laws and regulations, that it reviewed its security protocols to ensure that they continue to meet or exceed established best practices, and that it took great care to ensure that it handled personal data in a way that complied with regulations. These statements go beyond merely stating that it made an effort to comply with laws, regulations, and industry standards, and instead assured that Equifax took steps to remain in compliance with laws and regulations and meet industry standards. According to the allegations in the Amended Complaint, Equifax in reality failed to live up to these assurances.
And even if these statements only conveyed that Equifax made an effort to comply with data security laws, regulations, and standards, they would still be false or misleading. A reasonable investor would understand these statements to assure that the company was making actual, good faith efforts to maintain a data security protocol that complied with these standards. In reality, according to the Amended Complaint, data security was not a priority at all for Equifaxs management. The state of Equifaxs cybersecurity reflected a systemic organizational disregard for cybersecurity. Given this context, these statements were false or misleading. It is misleading to a reasonable investor to state that Equifax made an effort to comply with data laws, regulations, and standards when, in fact, Equifax demonstrated a systemic disregard for cybersecurity. For this reason, these statements concerning efforts to comply with data laws, regulations, and industry best practices are false or misleading.
The Defendants also argue that the fact Equifax experienced a cyberattack does not render their aspirational statements concerning their data security efforts and compliance false. However, as the Court explained with regard to the statements concerning the adequacy of Equifaxs cybersecurity, the Plaintiff does not rely solely upon the occurrence of the Data Breach to show the falsity of the compliance statements. Instead, the Plaintiff alleges that these statements regarding Equifaxs compliance with data security laws, regulations, and standards were false due to widespread deficiencies in Equifaxs cybersecurity and data protocols. According to the Plaintiff, Equifax assured the public that it made efforts to remain in compliance with data laws, regulation, and standards, even though in reality its cybersecurity was in a state of disrepair. Therefore, under the facts alleged, these assurances that Equifax made efforts to comply with data protection laws and best practices were false or misleading.
Next, the Defendants also argue that these allegations fail because, unlike in the cases relied upon by the Plaintiff, the Plaintiffs allegations do not show that the Defendants had contemporaneous knowledge of the facts contradicting their statements concerning legal compliance. However, this argument addresses whether the Defendants acted with the requisite scienter, which is addressed below. Whether a statement is false or misleading, and whether a defendant made such a statement with the requisite state of mind, are two separate questions. As discussed above, the Plaintiff has adequately alleged that these statements were false or misleading.
Finally, at oral argument, the Defendants distinguished the cases relied upon by the Plaintiff. They contended that the defendants statements in those cases concerning their compliance with regulations were false because they had already been told by regulators that their operations were deficient. It is true that, in some of those cases, the court found the defendants statements misleading due in part to the fact that regulators had informed them of problems in their operations. However, this does not mean that any statement touting compliance with laws, regulations, or industry standards is not false or misleading if the company has not received communications from regulators. Instead, this was just one fact that supported the courts holdings in those cases. Here, the Defendants issued statements assuring that Equifax remained in compliance with data security laws, regulations, and standards, even though its security systems were grossly deficient. As described above, these statements were false or misleading to investors, even if Equifax had never received an enforcement letter from regulators informing it that it was not in compliance with data laws or regulations.
6. Statements Concerning Internal Controls
The Defendants next move to dismiss the Plaintiffs allegations concerning the Defendants various statements about Equifaxs internal controls. In the Amended Complaint, the Plaintiff alleges that Smith and Gamble certified in SEC filings, pursuant to the Sarbanes-Oxley Act, that Equifax maintained a system of internal controls that would provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of our assets that could have a material effect on the financial statements. Nonetheless, according to the Plaintiff, these assurances in Equifaxs 10-K and 10-Q filings concerning the quality of its internal controls were materially false or misleading because Equifax lacked adequate mechanisms for detecting and responding to data breaches. The Defendants move to dismiss the allegations concerning this category of statements. They argue that the Plaintiff has failed to plead the falsity of the challenged statements because they address Equifaxs internal controls over financial reporting , as opposed to controls over data security. According to the Defendants, since these statements exclusively addressed financial reporting controls at Equifax, deficiencies in Equifaxs cybersecurity mechanisms do not render these statements false. Thus, deficiencies in Equifaxs data breach protocol do not establish that these statements were false.
The Court concludes that the Plaintiff has failed to show that these statements are false. Congress enacted Sarbanes-Oxley to restore investor confidence in the wake of numerous, highly-publicized, cases of accounting fraud. The purpose of Sarbanes-Oxley certifications is to ensure that proper financial reporting processes are undertaken. In In re PetroChina Co. Ltd. Securities Litigation , the district court rejected a section 10(b) claim premised upon PetroChinas Sarbanes-Oxley certifications. The court noted that the plaintiffs allegations, concerning bribery by PetroChina officials, did not imply that the Company had flawed internal controls over financial reporting. The court explained that the plaintiffs did not claim that PetroChina failed to evaluate its internal controls or disclose any weaknesses to its auditors, did not assert that the certifying officers neglected to inform PetroChinas auditor of any relevant fraud, and did not establish that PetroChinas internal controls in relation to financial reporting were insufficient; much less does the [complaint] make any allegation as to how or why PetroChinas internal controls were inadequate.
Likewise, the Plaintiff fails to allege that Equifax had flawed internal controls over its financial reporting. Even if Equifaxs data breach protocol was vastly deficient, this does not establish that it had insufficient internal controls over financial reporting. The Plaintiff has not raised any allegations concerning the accuracy of Equifaxs accounting, books, or financial reporting. Therefore, the Plaintiff has not established that Equifax, Smith, or Gambles statements concerning Equifaxs internal controls over financial reporting were false. A reasonable investor would understand that certifications under Sarbanes-Oxley such as these are in the context of financial accounting scandals, and would recognize that it related to Equifaxs financial reporting. A reasonable investor would not take assurances of internal controls to detect improprieties in accounting and bookkeeping to guarantee that there were systems in place to deal with cybersecurity breaches. Since the Plaintiff has not alleged that Equifaxs financial reports were inaccurate in any way, its claims concerning Smith and Gambles certification of proper internal controls pursuant to Sarbanes-Oxley fail. Therefore, the Plaintiffs claims are dismissed to the extent that they rely upon statements guaranteeing adequate internal controls pursuant to Sarbanes-Oxley.
7. Statements of Opinion and Belief
Next, the Defendants contend that many of the challenged statements are inactionable opinions or statements of belief. First, the Defendants contend that almost all of the alleged statements are inactionable, in part, because they are opinions. However, many of these statements that the Defendants contend are inactionable are not, in fact, opinions. For example, the Defendants contend that the following statement is an inactionable opinion: As a trusted steward of consumer and business information, Equifax employs strong data security and confidentiality standards on the data we provide and on the access to that data. We maintain a highly sophisticated data information network that includes advanced security, protections and redundancies. While such statements use some indefinite language, they do not constitute a subjective opinion.
However, some of the allegedly false statements are closer calls. According to the Defendants, statements such as Smiths assurance that I think we are in a very good position now are not actionable because the Plaintiff has not shown that the Defendants did not in fact hold the stated opinions. The Plaintiff contends that this statement, even if an opinion, is actionable because it did not align with the information in his possession. [C]ertain opinions may be actionable because if the real facts are otherwise, but not provided, the opinion statement will mislead its audience. An investor expects not just that the issuer believes the opinion (however irrationally), but that it fairly aligns with the information in the issuers possession at the time. Opinion statements can be misleading in context, and thus actionable, if they conflict with what a reasonable investor would take from the statement itself.
As discussed in more detail below, the Plaintiff only alleges that Smith - not the other Individual Defendants - was given specific information as to the deficiencies in Equifaxs cybersecurity. Around March 2017, Smith oversaw Mandiants audit of Equifaxs systems, where Mandiant warned that these systems were inadequate. The Plaintiff has not made specific allegations that Gamble, Ploder, or Dodge had information in their possession contradicting any opinion statements they issued. Without this knowledge, these opinion statements are not actionable. Furthermore, any opinion statements Smith made before receiving these warnings would also not be actionable.
B. Scienter
Next, the Defendants argue that the Plaintiff has failed to plead facts that give rise to a strong inference of scienter on the part of any of the Defendants. To state a section 10(b) claim, the PSLRA requires a plaintiff to plead with particularity facts giving rise to a strong inference that the defendants either intended to defraud investors or were severely reckless when they made the allegedly materially false or incomplete statements. A strong inference is an inference that is cogent and at least as compelling as any opposing inference one could draw from the facts alleged. This inquiry asks whether all of the facts alleged, taken as a whole, give rise to this strong inference of scienter. Thus, courts must consider the complaint in its entirety, and not whether any individual allegation, scrutinized in isolation, meets that standard. This inquiry is inherently comparative because courts must take into account plausible opposing inferences. Where a lawsuit involves multiple defendants and multiple allegations, moreover, scienter must be found with respect to each defendant and with respect to each alleged violation of the statute.
To move beyond the pleading state, a plaintiff must allege facts sufficiently demonstrating each defendants state of mind regarding his or her alleged violations. But, the PSLRA does permit the aggregation of facts to infer scienter. The factual allegations, taken as a whole, must give rise to this strong inference as to each Defendant and each alleged violation. Circumstantial evidence can be sufficient to establish a strong inference of scienter. Since scienter is highly fact-intensive inquiry, such questions are most appropriate for a fact finder.
In sum, the reviewing court must ask: When the allegations are accepted as true and taken collectively, would a reasonable person deem the inference of scienter at least as strong as any opposing inference?
In the Eleventh Circuit, it is well established that section 10(b) and Rule 10b-5 require a showing of either an intent to deceive, manipulate, or defraud, or severe recklessness. The Eleventh Circuit has defined severe recklessness as:
Severe recklessness is limited to those highly unreasonable omissions or misrepresentations that involve not merely simple or even inexcusable negligence, but an extreme departure from the standards of ordinary care, and that present a danger of misleading buyers or sellers which is either known to the defendant or is so obvious that the defendant must have been aware of it.
Plaintiffs may prove such recklessness by providing evidence that defendants possessed knowledge of facts or access to information contradicting their public statements, so as to prove that defendants knew or should have known that they were misrepresenting material facts related to the corporation. Facts indicating the scienter may include the particular times, dates, places, or other details of the alleged fraudulent activity. These particulars are not required per se, but their absence from the complaint may be indicative of the excessive generality of the allegations supporting scienter. With regard to Individual Defendants, the question is whether a reasonable person would infer that there was at least a fifty-fifty chance that the individual defendants knew about the alleged fraud (or were severely reckless in not knowing about it) based on its nature, duration, or amount.
Here, the Plaintiff attempts to plead scienter by alleging, among other things, that: (1) the Defendants received numerous warnings concerning the inadequacies of Equifaxs cybersecurity; (2) the Defendants were aware of the breach by late July 2017, but failed to disclose the breach and continued to make false statements until September 7, 2017; (3) the false and misleading statements concerned one of the most significant issues and severe risks that Equifax faced; (4) the Defendants were in charge of cybersecurity and received routine updates about the state of Equifaxs data security; (5) the egregiousness of the deficiencies in Equifaxs data security practices supports an inference of scienter; (6) the sudden departure of high-ranking officers at Equifax after disclosure of the Data Breach supports a finding of scienter; and (7) suspicious stock sales by Gamble and Ploder support an inference of scienter. Since scienter is an essential element of a securities fraud claim, the Plaintiff must create a strong inference - one that is cogent and compelling - that the Defendants knew about the deficiencies in Equifaxs cybersecurity, or were severely reckless in not knowing about it, when they made the allegedly false or misleading statements. The Court concludes that the allegations in the Amended Complaint establish a strong inference of scienter as to Equifax and Smith. However, these facts, even when taken together, do not give rise to a strong inference of scienter as to Gamble, Dodge, and Ploder.
1. Warnings About Data Security Deficiencies
First, the Defendants argues that alleged warnings of deficiencies in Equifaxs cybersecurity fail to support a strong inference of scienter as to any of the Individual Defendants. In the Amended Complaint, the Plaintiff alleges that the Defendants received numerous warnings ... that Equifaxs cybersecurity was inadequate to protect the sensitive personal information in its custody and that this contributes to a finding of scienter. Specifically, the Plaintiff alleges that: (1) Deloitte and KPMG issued audit reports detailing several problems with Equifaxs cybersecurity, but Equifaxs management did not take these reports seriously; (2) Smith oversaw a March 2017 investigation by security consulting firm Mandiant, in which Mandiant warned that Equifaxs cybersecurity was inadequate and contained critical weaknesses; (3) security researchers warned Equifax that cybersecurity deficiencies existed, including an immense cache of personal consumer information that was accessible through public-facing websites; (4) Equifax received clear warnings about the Apache Struts vulnerability from both the government and its own employees; (5) Equifax employees warned management that the companys cybersecurity was inadequate, but data security was not a priority for management; and (6) Equifax prior breaches that revealed cybersecurity vulnerabilities to the Defendants. According to the Defendants, these allegations do not give rise to a strong inference of scienter because the Plaintiff has failed to plead facts showing that these supposed warnings were ever communicated to any of the Individual Defendants.
The Court finds that these allegations provide sufficient circumstantial evidence to conclude that Smith was aware of the warnings concerning the deficiencies in Equifaxs cybersecurity. In the Amended Complaint, the Plaintiff alleges that Equifax hired Mandiant in early 2017 to conduct a cybersecurity audit after the W2Express breach in 2016. Specifically, the Plaintiff alleges that Equifax hired cybersecurity firm Mandiant to investigate weaknesses in its data protection systems and that Smith was personally overseeing, and closely monitoring the progress of, this investigation. This allegation is based upon a Bloomberg report published in the wake of the Data Breach. The Plaintiff alleges that Mandiant warned Equifax that its unpatched systems and misconfigured security policies could indicate major problems. However, instead of heeding Mandiants advice, Equifax allegedly disputed the firms findings and declined to engage in a broader review of Equifaxs data security. Based upon this, the Court concludes that the Plaintiff adequately alleges that Smith knew, or was severely reckless as to the existence of, warnings of serious deficiencies in Equifaxs cybersecurity after receiving Mandiants warnings in early 2017.
The Defendants then argue that these allegations should not be given weight because they are based upon articles in Bloomberg and Motherboard that rely upon anonymous sources. In Mizzaro , the Eleventh Circuit addressed the question of how to weigh allegations based upon confidential witness reports. There, the court noted that [a]lthough a whistleblower who demands confidentiality may be less credible than one who is willing to put his name behind his accusations, allegations based on such statements are not heavily discounted in all cases. It explained that the weight to be afforded to allegations based on statements proffered by a confidential source depends on the particularity of the allegations made in each case, and confidentiality is one factor that courts may consider. Confidentiality, however, should not eviscerate the weight given if the complaint otherwise fully describes the foundation or basis of the confidential witnesss knowledge, including the position(s) held, the proximity to the offending conduct, and the relevant time frame.
In the Amended Complaint, the Plaintiff bases some of its allegations upon news articles citing anonymous sources. For example, the Plaintiff bases some of its allegations on a Bloomberg article reported on September 29, 2017. That article explained that the Mandiant investigation was described internally as a top-secret project and one that Smith was overseeing personally, according to one person with direct knowledge of the matter. The Plaintiff also premised some of its allegations upon an article published in Motherboard on October 26, 2017. Despite the fact that these news articles rely in part on anonymous sources, the Court declines to completely discount the allegations that rely upon them. This Court has previously noted that pleading requirements under the PSLRA can easily be satisfied with references to internal memoranda and news articles. News articles, which frequently rely upon unnamed sources, constitute reliable bases for allegations. Therefore, the Court does not discount the allegations based upon these two articles merely because they cite anonymous sources. And, even if the Plaintiff did in fact rely solely upon information derived from an anonymous source, and not information from a news article, these allegations would still be entitled to weight. The Bloomberg article cites two independent sources, with direct knowledge, who corroborate each others assertions. Furthermore, the Motherboard article provides statements from several former Equifax employees, providing both their positions and tenure in the company. The Court therefore finds that the allegations based upon these news articles are entitled to due consideration.
However, the Plaintiffs allegations of scienter fail as to the rest of the Individual Defendants. The Plaintiff has not provided sufficiently particularized averments of fraud or scienter as to Gamble, Ploder, and Dodge to give rise to a strong inference that they acted with knowledge or severe recklessness. Claims of securities fraud cannot rest on speculation and conclusory allegations. The Plaintiff has not adequately pleaded that Gamble, Ploder or Dodge ever received any of these purported warnings as to the shortcomings in Equifaxs data security. Instead, the Plaintiff relies upon general allegations that Equifax management was warned but did not heed experts advice. Such generalities do not establish a strong inference of scienter. The Plaintiff has not alleged which defendant knew what, how they knew it, or when with regard to these warnings.
The Plaintiff relies upon In re ChoicePoint, Inc. Securities Litigation to support its argument that these allegations sufficiently plead scienter. However, that case is distinguishable. In ChoicePoint , the plaintiffs alleged that the defendants misrepresented the existence and severity of data security problems within the company prior to a data breach. The court concluded that the plaintiffs adequately alleged scienter. Specifically, the plaintiffs alleged that the individual defendants had access to internal information demonstrating the falsity of the public statements and were confronted by employees, that employees specifically warned each of the individual defendants about the companys inadequate security procedures, and that some of the individual defendants learned of the companys data breach and subsequently sold millions of dollars of their company stock. In contrast, the Plaintiff has not alleged that Gamble, Dodge, and Ploder were specifically warned about the problems with Equifaxs data security, and did not specifically allege that each of these defendants had access to information contradicting their public statements. Instead, the Plaintiff relies on general allegations that management was warned. Such an allegation requires the Court to assume that Gamble, Dodge, and Ploder were part of this group of management that received these warnings. This assumption does not give rise to a strong inference of scienter.
The Plaintiff also argues that this stringent requirement for scienter ignores recklessness as a way to establish scienter. According to the Plaintiff, it is not required to provide smoking gun evidence of scienter, but instead can establish recklessness through the Individual Defendants access to a plethora of information clearly and directly contradicting their public statements regarding cybersecurity. While it is true that the Plaintiff need not provide a smoking gun of scienter, it also cannot rely on generalities and chains of inferences. The Plaintiff must allege specific facts as to each defendant and each challenged statement that give rise to a strong inference of scienter. To establish a strong inference of recklessness, the Plaintiff must allege facts showing that the risk of misleading investors was so obvious that the Defendants must have been aware of it. The Plaintiffs allegations fail to meet this standard.
The Defendants also argue that, even if these warnings and concerns had been communicated to the Individual Defendants, the Plaintiff fails to plead facts establishing that they agreed with any of these concerns or were severely reckless in not believing them. Thus, with regard to Smith, even though he personally oversaw the Mandiant audit, the Plaintiff does not allege that he agreed with the firms conclusion that Equifaxs cybersecurity was deficient. However, the Plaintiff need not allege that Smith agreed subjectively with Mandiants concerns to establish scienter. In Omnicare , the Supreme Court explained that an issuers statement that its conduct is lawful, when made contrary to its lawyers advice, can give rise to a section 10(b) claim. Similarly, Smiths statements touting Equifaxs cybersecurity, despite his knowledge of experts advice to the contrary, are actionable.
Next, the Defendants argue that the prior data breaches fail to establish a strong inference of scienter because they did not put them on notice of inadequacies in Equifaxs systems. In the Amended Complaint, the Plaintiff alleges that the prior W2Express, LifeLock, and TALX breaches warned the Defendants that Equifaxs cybersecurity was vulnerable. Thus, according to the Plaintiff, the Defendants knew or were severely reckless as to the deficient state of Equifaxs cyberdefenses. According to the Defendants, the Plaintiff has not pleaded facts showing that these prior incidents were symptomatic of broader cybersecurity problems, and thus cannot be used to show that the Defendants were aware of the deficiencies in the data systems. The Defendants argue that these breaches did not put them on warning because none of them remotely resemble[d] the attack in the Data Breach. According to the Defendants, these prior breaches did not involve the same exact exploitation of unpatched software vulnerabilities.
The Court agrees with the Plaintiff that these prior breaches were symptomatic of a larger cybersecurity problem. The Amended Complaint details how these prior incidents were the result of many of the same problems that contributed to the Data Breach here. According to the Amended Complaint, these previous breaches resulted from, or were exacerbated by, poor authentication measures and inadequate network monitoring. In fact, after one of these incidents, Equifax acknowledged that it would need to implement additional monitoring and blocking measures to protect the data in its custody. Thus, Equifax understood that these deficiencies contributed to prior breaches. These prior breaches demonstrated the same, repeated network failures, and contrary to the Defendants assertions, did depict fundamental problems in Equifaxs cybersecurity.
Nonetheless, the Plaintiff has failed to allege that the Individual Defendants, except for Smith, knew, or were severely reckless to the fact that, these prior breaches were symptomatic of fundamental security problems. Although the Plaintiff adequately alleges that these prior breaches involved some of the same problems involved in the Data Breach, it has not alleged that Gamble, Dodge, or Ploder had specific knowledge, or access to specific facts, informing them that these prior breaches involved these specific issues. Absent such allegations, the Plaintiff has failed to allege that the Individual Defendants other than Smith knew that the prior breaches involved these authentication and monitoring issues, or that they were severely reckless as to this fact. Without knowing that these breaches were specifically caused by authentication and network monitoring issues, these Defendants would not have been put on notice that there were shortcomings in these areas of security. Without this knowledge, these previous breaches do not serve as warnings of the many cybersecurity deficiencies that the Plaintiff alleges in the Amended Complaint, and thus cannot establish scienter.
However, these prior breaches do help establish scienter as to Smith. As explained above, Equifax hired Mandiant in early 2017 in response to the TALX breach. Smith personally oversaw and closely monitored this investigation by Mandiant. Mandiant then confirmed in its review that Equifaxs systems were grossly inadequate, and warned that Equifaxs failure to patch vulnerabilities could present problems. Thus, Smith was personally aware of Mandiants investigation and the results of this investigation, and knew that this investigation had been initiated due to the prior TALX breach. Thus, these allegations are sufficient to infer that Smith knew, or was severely recklessly as to the fact that, the TALX breach was the result of deficiencies in Equifaxs cybersecurity. Therefore, the Court concludes that the TALX breach along with Mandiants audit report contribute to a finding of scienter as to Smith. According to the Amended Complaint, the Mandiant investigation was a top-secret project that Smith was overseeing personally. Smith, at least, had access to facts showing that the cybersecurity was seriously deficient, which would contribute to a conclusion that he was at least severely reckless in making statements touting Equifaxs cybersecurity.
2. Knowledge of the Data Breach
Next, the Plaintiffs argue that Equifax Senior Managements knowledge of the Data Breach raises a strong inference of scienter. In the Amended Complaint, the Plaintiff alleges that Senior Management, including the Individual Defendants were well aware of the Data Breach by late July 2017, but nonetheless failed to disclose the incident and continued to make false statements concerning Equifaxs data security. Thus, according to the Plaintiff, the Defendants knowingly or recklessly made false statements because they knew of the Data Breach. The Defendants argue that these allegations concerning the Defendants knowledge of the Data Breach fail to give rise to a strong inference of scienter.
First, the Defendants argue that each of the challenged statements attributed to Gamble, Ploder, and Dodge, and all but one of the statements attributed to Smith, are alleged to have been made on or before July 27, 2017. Thus, as to these statements, the Individual Defendants could not have known or been severely reckless as to the risk of misleading investors since they did not know of the existence of the Data Breach. The Court agrees. The Plaintiff has not shown that Gamble, Dodge, or Ploder made any of the challenged statements after they allegedly became aware of the Data Breach in late July 2017. Thus, these Individual Defendants knowledge of the Data Breach does not establish scienter as to any of their specific alleged violations.
However, these allegations do support a finding of scienter as to Smith. On August 16, 2017, after discovery of the Data Breach, Smith made comments regarding Equifaxs data security in a speech at the University of Georgia. The factual allegations in the Amended Complaint support a finding that Smith made these statements with the requisite scienter. By this point, Mandiant had already informed Smith that it was likely that a large amount of personally identifiable information had been compromised in the Data Breach. Furthermore, Smith had personally overseen the previous Mandiant investigation in March 2017, in which Mandiant concluded that Equifaxs cybersecurity practices were grossly inadequate. Thus, Smith, despite knowing that the sensitive data had been compromised in the Data Breach, and despite personally overseeing this previous investigation by Mandiant, nonetheless stated that data security is a huge priority for us and that it was his number one worry. These allegations are sufficient to raise a strong inference that Smith made this statement with the requisite scienter.
The Defendants argue that, even assuming Smith was aware of the Data Breach when he made this statement, such knowledge would not reasonably have suggested that it would be misleading to state that data security was a huge priority and his number one worry. However, these arguments do not address whether Smith acted with the necessary scienter. Instead, they ask whether the statements were false or misleading - which is a separate inquiry. The Defendants conflate the two issues. As discussed above, these statements were false or misleading because a reasonable investor would understand this statement to convey that there was no significant security breach when it was made. The Defendants also argue that scienter as to this statement is not adequately alleged because the Plaintiff did not plead facts that Smith knew the statements were false or misleading. However, as explained above, Smith made these statements despite his knowledge of Mandiants warnings concerning Equifaxs deficiencies. Such knowledge, even if Smith disagreed with it, contributes to an inference of recklessness.
3. Core Business Operation
The Plaintiffs next argue that the fact that the alleged violations concerned one of the most critical risks facing Equifax contributes to a strong inference of scienter. However, the fact that an alleged fraud concerned a companys core business does not itself establish a strong inference of scienter. [I]t is not automatically assumed that a corporate officer is familiar with certain facts just because these facts are important to the companys business; there must be other, individualized allegations that further suggest that the officer had knowledge of the fact in question. Instead, a persons status as a corporate officer, when considered alongside other allegations, can help support an inference that that person is familiar with the companys most important operations.
However, this argument fails to establish scienter. It is insufficient for a plaintiff to make conclusory allegations that the Defendants had access to the true facts in order to demonstrate scienter, particularly where the complaint fails to allege which defendant knew what, how they knew it, or when. The Plaintiffs allegations that cybersecurity was critical to Equifaxs business operations fail to establish scienter as to Dodge, Ploder, and Gamble. The Plaintiff must plead specific facts establishing that the Individual Defendants knew of, or were severely reckless as to, the existing deficiencies in Equifaxs data systems. General allegations that cybersecurity is critical to Equifaxs business may, in totality, contribute to a finding of scienter. However, absent allegations that Gamble, Ploder, or Dodge had access to specific facts showing these problems, this argument fails.
The Eleventh Circuits decision in Garfield v. NDC Health Corporation is instructive. There, the plaintiff alleged that the defendants attended monthly operations meetings where every aspect of the business was discussed in detail, including the aggressive channel stuffing and mounting problems with accounts recevable (sic) that were at the center of the plaintiffs fraud allegations. The plaintiff also alleged that testimonial evidence by a former senior executive would show that the defendants knew of these problems. The court concluded that these allegations failed to establish scienter due to the absence of particularized averments of fraud or scienter. The plaintiffs broad claims lacked the requisite detail because it failed to allege what was said at the meeting, to whom it was said, or in what context. The court explained that [a] general allegation that Individual Defendants promoted channel stuffing at a series of meetings does not establish scienter.
Here, the Plaintiff fails to establish a strong inference of scienter based upon Dodge, Ploder, and Gambles roles in the company. The Amended Complaint fails to allege what warnings were given to each of these specific Individual Defendants, when those warnings were conveyed to these Individual Defendants, what was said in such warnings, and in what context those warnings were made. Generally, the Plaintiff alleges that these Individual Defendants, based upon their positions and their general duty to monitor the operations of Equifaxs networks and systems, must have known about the deficient state of its cybersecurity. The Amended Complaint, however, fails to provide specific factual allegations as to a time, place or manner in which any of the Individual Defendants were specifically warned of these cybersecurity deficiencies. Therefore, these allegations are insufficient to support an inference of scienter.
The Plaintiff cites In re Ebix, Inc. Securities Litigation. There, the court concluded that the factual allegations gave rise to a strong inference that the defendants were at least severely reckless in their representations due to the defendants roles within the company (CEO and CFO), their active participation in press releases, earnings calls, and SEC filings dealing with the issues focused on in the [complaint], and the nature, duration and extent of the fraud alleged. However, Ebixis distinguishable from this case because there the plaintiff alleged specific communications to and from the Individual Defendants regarding these issues. In contrast, the Plaintiff here has not alleged any specific communications to or from any of the Individual Defendants concerning the state of Equifaxs cybersecurity. Without these types of specific allegations, the Plaintiff fails to establish a strong inference that the Individual Defendants were severely reckless in their representations concerning Equifaxs data security.
Thus, these general allegations that cybersecurity was a core business operation do not support an inference that Dodge, Gamble, or Ploder knowingly or recklessly misrepresented the state of Equifaxs networks when they stated that cybersecurity was one of Equifaxs top priorities. These allegations do contribute to a finding of scienter as to Smith, when taken into account with the other, more specific allegations as to his knowledge of problems with Equifaxs data security. However, on their own, these allegations do not establish a strong inference of scienter.
4. Defendants Assurances
Next, the Plaintiff argues that the Defendants assured investors that they were focused on cybersecurity and compliance with data security laws, and that these assurances support an inference of scienter. The Plaintiff cites In re Theragenics Corp. Securities Litigation in support of this argument. However, the facts of that case are distinguishable. This Court in Theragenics did not hold that the defendants assurances that they were monitoring their competitors performance supported an inference of scienter. Instead, the plaintiffs there alleged that the defendants did in fact continually monitor the performance of their competitor, establishing that they knew their statements were false or misleading. In contrast, the Plaintiff here has not shown that the Individual Defendants, aside from Smith, were monitoring Equifaxs cybersecurity or had access to specific information or warnings that would have established that they knew or were severely reckless as to the falsity of the statements they made.
In essence, the Plaintiff argues that the Defendants stated that they were closely monitoring Equifaxs cybersecurity, and that from this, one can infer that they must have known about the problems with data security. However, the fact that the Defendants stated that they were closely monitoring Equifaxs network security does not establish that they knew of, or were severely reckless to the existence of, these cybersecurity deficiencies. These allegations are too general. Instead, the more plausible inference is that the Individual Defendants, besides Smith, were negligent with regard to their management and monitoring of cybersecurity. In the cases relied upon by the Plaintiff, the plaintiffs alleged that the defendants were in fact monitoring the events underlying the false or misleading statements, and thus knew or were severely reckless to the fact that the statements made were false. Scienter was not established in those cases merely because the defendants assured investors that they were monitoring those underlying events, as the Plaintiff here alleges. This argument, which requires additional inferential steps, is insufficient to establish scienter as to Gamble, Ploder, and Dodge.
5. Egregiousness of Cybersecurity Deficiencies
The Defendants next contend that the Plaintiffs allegations as to the egregiousness of the shortcomings in Equifaxs data security fail to support a strong inference of scienter. Instead, according to the Defendants, these allegations merely constitute hindsight criticism as to the manner in which Equifax managed cybersecurity. The Plaintiff argues that the magnitude, scope, and duration of the deficiencies in Equifaxs cybersecurity systems were such that they could not have escaped the notice of the Defendants and other senior management, and that this supports an inference of scienter. And, according to the Plaintiff, this is compounded by the fact that the Defendants allegedly represented that they were closely monitoring Equifaxs data security. The Court concludes, however, that the egregiousness of Equifaxs cybersecurity problems, without more specific allegations, fails to establish scienter. Once again, as discussed above, the Plaintiff has failed to establish that Dodge, Gamble, or Ploder knew of or were severely reckless as to these egregious deficiencies. The severity of these problems, if taken into account with other specific factual allegations supporting scienter, could help establish an inference of scienter. However, here those other allegations are absent. Without those allegations, the Plaintiff has failed to establish an inference that is cogent and compelling, and just as likely as other, more innocent explanations. Even if these problems were severe and widespread, it is still more plausible to infer that these Individual Defendants were negligent, rather than something more insidious.
6. Stock Sales
Next, the Plaintiff argues that suspicious stock sales by Gamble and Ploder support an inference of scienter. [T]he timing of stock trades by insiders also may be relevant to inferring scienter. Stock sales or purchases timed to maximize returns on nonpublic information weigh in favor of inferring scienter; the lack of similar sales weighs against inferring scienter. To demonstrate the relevance of stock trades to the issue of scienter, a plaintiff bear[s] the burden of showing that sales by insiders were in fact unusual or suspicious in amount and in timing.
Here, the Court concludes that the stock sales fail to establish scienter. First, the Plaintiff fails to allege that any of the other Individual Defendants, including Smith, the CEO, engaged in insider trading. This alone undermines any inference that these stock sales contribute to a finding of scienter. Second, the stock sales, which can constitute circumstantial evidence that Gamble and Ploder knew that Equifaxs stock price was artificially inflated, cannot on their own establish scienter as to these Defendants. However, as discussed above, the Plaintiff has failed to provide more than general allegations that any of the Individual Defendants, besides Smith, made misstatements with knowledge or severe recklessness toward their falsity. This circumstantial evidence fails to meet the stringent pleading requirements under the PSLRA that the allegations give rise to a strong inference of scienter.
There is no doubt that these sales by Gamble and Ploder are suspicious, especially given their timing. They contribute to an inference of scienter, but they are not sufficient on their own to raise a strong inference of scienter with regard to Gamble and Ploder as to the alleged violations. The stock sales could have, when aggregated with other facts, contributed to a finding of a strong inference of scienter. However, they cannot establish this strong inference on their own. This is compounded by the fact that the other Individual Defendants, including Smith, did not engage in similarly suspicious stock sales. Thus, given the lack of other specific factual allegations establishing scienter as to these Defendants, the suspicious stock sales by Gamble and Ploder fail to give rise to a strong inference of scienter on their own.
7. Sudden Resignations of Equifax Officers
Next, the Plaintiff contends that the sudden departures of high-ranking Equifax executives support an inference of scienter. On September 15, 2017, about a week after public disclosure of the Data Breach, Chief Security Officer Susan Mauldin and Chief Information Officer David Webb resigned from Equifax. On September 26, 2017, Smith retired from Equifax, without severance, effective immediately. The Equifax Board of Directors announced that it had the power to retroactively classify Smith as having been fired for cause, which includes intentional or reckless misconduct. According to the Plaintiff, the circumstances surrounding these departures of senior executives establish a strong inference that there were profound failures in [Equifaxs] data protection practices that were the result of reckless or intentional misconduct.
Some courts have concluded that the resignation of corporate officers, in certain contexts, can support an inference of scienter. However, in those cases, the context of the executives resignations was important. The fact that an executive resigned, on its own, does not support an inference of scienter. Instead, the circumstances of the resignation must suggest that intentional or reckless misconduct had occurred. For example, in In re Home Loan Servicing Solutions, Ltd. Securities Litigation , cited by the Plaintiff, the court concluded that scienter was established as to a defendant who, among other things, was at the epicenter of the business, who was forced to resign, and who regulatory documents indicated was engaged in improper transactions. Similarly, in In re OSG Securities Litigation , the court concluded that the resignations of two executives supported an inference of scienter when the circumstances and timing of the resignations suggest that both defendants were terminated in relation to the undisclosed tax issue underlying the fraud claims. The court noted that [a]lthough the decision to terminate the defendants does not negate the possibility of mere negligence in mismanaging the Section 956 issue, it more likely suggests a higher level of wrongdoing approaching recklessness or even conscious malfeasance.
In contrast, the context of the resignations here does not suggest that Gamble, Ploder, or Dodge knew of, or were severely reckless as to, the false or misleading nature of their statements. The Plaintiff fails to explain how the resignations of Smith, Mauldin, and Webb show that Gamble, Ploder, or Dodge acted with the requisite state of mind. Nothing about the context of these resignations would lead one to infer that Gamble, Ploder, or Dodge must have known about the deficient state of Equifaxs cybersecurity. Without such allegations, the resignations of Smith, Mauldin, and Webb fail to establish scienter as to these Individual Defendants.
However, Smiths resignation does contribute to a finding of scienter on his part. Taking all of these allegations into account, the following facts support a strong inference of scienter: Smith was warned by Mandiant, after a previous breach, that Equifaxs cybersecurity was grossly inadequate; Smith, as CEO, would have likely followed many of the developments in Equifaxs cybersecurity since it was an important aspect of its business; Smith learned of the Data Breach in late July 2017, but still continued to make statements touting the companys security; and after the public disclosure of the incident, Smith resigned his roles in the company, while the Board of Directors announced it may decide to retroactively terminate him with cause. These allegations, taken together, give rise to a strong inference of scienter that Smith made these misstatements with knowledge or severe recklessness as to their falsity.
But, the Court concludes overall that the Plaintiff has failed to allege specific facts giving rise to a strong inference of scienter as to Gamble, Ploder, or Dodge. Instead, as to these Defendants, the Plaintiff relies upon inferences based upon their role in the company and the size of the fraud. These general allegations do not suffice. [I]t is not enough to make conclusory allegations that the Defendants had access to the true facts in order to demonstrate scienter, particularly where the complaint fails to allege which defendant knew what, how they knew it, or when. Nor does a vague assertion that a defendant must have known about the fraud by virtue of his position of authority suffice to prove a strong inference of scienter. Without specific allegations that Gamble, Ploder, and Dodge had access to information that made them aware of the problems with Equifaxs data security, the Amended Complaint fails to give rise to a strong inference of scienter as to these Individual Defendants. Thus, the Plaintiff fails to adequately plead scienter under the stringent requirements set forth in the PSLRA.
8. Equifaxs State of Mind
Finally, the Defendants argue that the Plaintiff has failed to adequately plead scienter as to Equifax. However, failure to adequately plead scienter as to individual defendants does not automatically mean that scienter cannot be established against a corporation. Corporations, of course, have no state of mind of their own. Instead, the scienter of their agents must be imputed to them. A plaintiff, in theory, can still create a strong inference that a corporate defendant such as Equifax acted with the requisite scienter, even if it has failed to prove scienter as to the individual defendants. Even if the Amended Complaint fails to raise a strong inference of scienter as to any of the named Individual Defendants, the Plaintiff can survive dismissal if it raise[s] a strong inference that somebody responsible for the allegedly misleading statements must have known about the fraud. To do so, the Plaintiff must allege facts in the Amended Complaint creating a strong inference that unnamed Equifax officials were both responsible for issuing the allegedly false public statements and were aware of the alleged fraud. It can do so through allegations relating the state of mind of corporate officials who make or issue the statement (or order or approve it or its making or issuance, or who furnish information or language for inclusion therein, or the like).
Here, the Plaintiffs claims as to Equifax survive to the extent that the claims against Smith survive dismissal. Furthermore, the Plaintiff has alleged that Equifaxs employees warned management of the deficient state of the companys cybersecurity. While these allegations are insufficient to establish scienter as to the named Defendants other than Smith, they are sufficient to establish that some corporate officials at Equifax, who would have had a role in crafting many of the statements made by the company, knew of the data security problems in the company. This is especially true given the resignations of Webb and Mauldin, two corporate executives whose responsibilities included data security, and Smith, whose role as CEO would have encompassed data security. The Plainitff alleges that Equifax employees warned management of the problems with the companys cybersecurity, and also alleges that Webb and Mauldin resigned after the Data Breach. This supports an inference that some corporate officials in Equifax knew, or were severely reckless, as to the fraudulent conduct. Thus, the Court concludes that the Amended Complaint still creates a strong inference that Equifax, the corporate defendant, acted with the requisite state of mind.
C. Loss Causation
Next, the Defendants argue that the Plaintiff has failed to adequately allege loss causation. The Plaintiff must allege facts demonstrating that the Defendants misrepresentations caused the losses for which the Plaintiff seeks to recover. To prove loss causation in a section 10(b) claim, a plaintiff must offer proof of a causal connection between the misrepresentation and the investments subsequent decline in value. Essentially, the Plaintiff must show that the Defendants fraud, and not some other factor, proximately caused its alleged losses. The loss causation element does not require a plaintiff to prove that a fraudulent misrepresentation was the sole cause of a securitys loss in value. But, the plaintiff must still demonstrate that the fraudulent statement was a substantial or significant cause of the decline in price. By ensuring that only losses actually attributable to a given misrepresentation are cognizable, the loss causation requirement ensures that the federal securities laws do not becom[e] a system of investor insurance that reimburses investors for any decline in the value of their investments. Section 10(b) is not a prophylaxis against the normal risks associated with investment in the stock market, but instead is designed solely to protect against fraud. The loss causation element is only subject to Rule 8s notice pleading standard, requiring a short and plain statement, and not the heightened pleading standards of the PSLRA.
In the Amended Complaint, the Plaintiff alleges that the market for Equifaxs securities was efficient and that the market for Equifax stock promptly digest current information regarding Equifax from all publicly available sources and reflected such information in Equifaxs stock price. Thus, according to the Plaintiff, it is entitled to a presumption of reliance. The Plaintiffs claims therefore rely upon the fraud-on-the-market theory of causation, derived from the efficient market hypothesis. This hypothesis provides that in an open and developed securities market, the price of a companys stock is determined by the available material information regarding the company and its business. Because millions of shares change hands daily, and a critical mass of market makers study the available information and influence the stock price through trades and recommendations, an efficient capital market rapidly and efficiently digests all available information and translates that information into the processed form of a market price. Just as an efficient market translates all available truthful information into the stock price, the market processes the publicly disseminated falsehood and prices it into the stock as well. The market price of the stock will then include an artificial inflationary value-the amount that the market mistakenly attributes to the stock based on the fraudulent misinformation.
This presumption is also relevant for loss causation. While reliance focuses on the front-end causation question of whether the defendants fraud induced or influenced the plaintiffs stock purchase, loss causation provides the bridge between reliance and actual damages. In a fraud-on-the-market case, the loss causation element requires the plaintiff to show that the fraud-induced inflation that was baked into the plaintiffs purchase price was subsequently removed from the stocks price, thereby causing losses to the plaintiff. Plaintiffs often demonstrate loss causation in fraud-on-the-market cases circumstantially, by:
(1) identifying a corrective disclosure (a release of information that reveals to the market the pertinent truth that was previously concealed or obscured by the companys fraud); (2) showing that the stock price dropped soon after the corrective disclosure; and (3) eliminating other possible explanations for this price drop, so that the factfinder can infer that it is more probable than not that it was the corrective disclosure-as opposed to other possible depressive factors-that caused at least a substantial amount of the price drop.
Overall, loss causation analysis in a fraud-on-the-market case focuses on the following question: even if the plaintiffs paid an inflated price for the stock as a result of the fraud (i.e., even if the plaintiffs relied), did the relevant truth eventually come out and thereby cause the plaintiffs to suffer losses?
The Defendants argue that the announcements to the public of the Data Breach on and following September 7, 2017 did not reveal that the prior statements concerning Equifaxs data security were false, and thus were not a corrective disclosure. Specifically, the Defendant contends that: (1) the initial announcement of the incident on September 7, 2017 did not reveal that prior statements referencing Equifaxs commitment to data security, efforts to protect data, and compliance with laws and regulations were false; (2) the revelations on September 11, 2017 that Equifax lacked an effective data breach crisis management plan did not show that any of the challenged statements were false or misleading; (3) the revelations on September 12, 2017 that 11.5 million customers signed up for the identity protection plan offered by Equifax does not reveal the falsity of any prior statements; and (4) revelations on September 13 and 14, 2017 that the Apache Struts vulnerability caused the Data Breach did not reveal that any of the challenged statements were false or misleading.
However, as noted above, a disclosure need not precisely mirror an earlier misrepresentation, but instead must relate to the misrepresentation and not other negative information about the company. Furthermore, a corrective disclosure can come from any source, and can take any form from which the market would absorb the information and accordingly react. The Court concludes that the Plaintiff has adequately alleged loss causation. Rule 8 is satisfied if plaintiff provides a short and plain statement adequate to give defendants some indication of the loss and the causal connection that the plaintiff has in mind. The Plaintiff alleges that the initial disclosure of the Data Breach, along with subsequent disclosures that Equifaxs poor cybersecurity played a part in the incident, that Congress would be conducting a probe into Equifaxs general cybersecurity practices, that millions of consumers were affected, and that a failure to implement a patch that had been available since March 2017 caused the Data breach, all combined to disclose the truth to investors. This, along with the wide variety of news reporting on the incident detailing Equifaxs cybersecurity problems, slowly revealed the truth about the prior misstatements. This adequately puts the Defendants on notice as to the causal connection between the Defendants misrepresentations and the classs losses.
The Plaintiff also argues that a corrective disclosure may occur through the materialization of an event within the zone of risk concealed by defendants misstatements. Under this theory, [i]f the significance of the truth is such as to cause a reasonable investor to consider seriously a zone of risk that would be perceived as remote or highly unlikely by one believing the fraud, and the loss ultimately suffered is within that zone, then a misrepresentation or omission as to that information may be deemed a foreseeable or proximate cause of the loss. The Eleventh Circuit has never decided whether the materialization-of-concealed-risk theory may be used to prove loss causation in a fraud-on-the-market case. The Court declines to adopt this theory here. First, the Plaintiff failed to plead this theory of loss causation in the Amended Complaint. Second, the Plaintiff has failed to explain how the materialization of the Data Breach itself corrected prior misstatements touting the strength of Equifaxs cybersecurity. Third, the Court need not adopt this theory since the Plaintiff has adequately alleged loss causation through corrective disclosures.
D. In Connection With
Next, the Defendants contend that the statements made by Smith in a speech at the University of Georgia were not made in connection with the purchase or sale of a security. To state a claim under section 10(b), the plaintiff must show that the false or misleading statement was made in connection with the purchase or sale of a security. In using this phrase, Congress ... intended only that the device employed, whatever it might be, be of a sort that would cause reasonable investors to rely thereon, and, in connection therewith, so relying, cause them to purchase or sell a corporations securities. Moreover, when ... a claim is based on the fraud-on-the-market theory, a straightforward cause and effect test is applied, under which it is sufficient that statements which manipulate the market are connected to resultant stock trading.
Here, the Plaintiff has adequately shown that Smiths statement was made in connection with the purchase or sale of a security. As the Supreme Court has noted, market professionals generally consider most publicly announced material statements about companies, thereby affecting stock market prices. In In re Carter-Wallace, Inc. Securities Litigation, the court noted that [t]echnical advertisements in sophisticated medical journals detailing the attributes of a new drug could be highly relevant to analysts evaluating the stock of the company marketing the drug, and thus it could not conclude that such statements, as a matter of law, were not made in connection with a securities transaction. Similarly, statements made by Equifaxs CEO concerning a core business operation could be highly relevant to analysts evaluating Equifaxs stock. The fact that Smith made this statement at a presentation at a college, and not in some other setting, does not change this conclusion. This is further bolstered by the Plaintiffs allegation that this presentation was uploaded to the popular website YouTube.com. The Court cannot say that this statement, which would be relevant to analysts studying Equifaxs securities, was not made in connection with a securities transaction. This is especially true given the fact that the Plaintiff relies upon the fraud-on-the-market theory. Therefore, the Court finds the Defendants argument unpersuasive.
E. Section 20(a) Claims
Finally, the Defendants argue that the Plaintiffs section 20(a) claims fail to state a claim for which relief can be granted. Section 20(a) of the Exchange Act extends liability for violations of Rule 10b-5 to controlling persons in the company. To show control person liability under Section 20(a), a plaintiff must allege that: (1) the company violated § 10(b); (2) the defendant had the power to control the general affairs of the company; and (3) the defendant had the power to control the specific corporate policy that resulted in the primary violation.
The Defendants first argue that the Plaintiffs failure to plead any primary violation of section 10(b) by Equifax requires dismissal of the section 20(a) claims. However, as discussed above, the Plaintiff has adequately pleaded some of its section 10(b) claims as to Equifax. The Defendants next argue that the Plaintiff fails to adequately plead that the Individual Defendants control specific corporate policy that resulted in the alleged primary violations of section 10(b). Specifically, the Defendants argue that the Plaintiff has not alleged that any of the Individual Defendants had control over the content and dissemination of the unattributed statements made on Equifaxs website during the class period, or any of the statements made by different Individual Defendants, or that they controlled the cybersecurity matters misrepresented. Furthermore, the Defendants argue that the Plaintiff has not alleged that Gamble, Ploder, or Dodge controlled Equifaxs general affairs.
The Court agrees that the Plaintiff has failed to allege that Gamble, Ploder, or Dodge exercised control over the specific cybersecurity policies that resulted in the alleged violations, or that they exercised control over any of the unattributed statements made or statements made by other Individual Defendants. Thus, the Plaintiffs section 20(a) claims should be dismissed as to these Individual Defendants. The Court concludes, however, that the Plaintiff has adequately alleged a section 20(a) claim as to Smith. Smith, as CEO, had the power to control the general affairs of Equifax. Smith also had the power to control the specific corporate policy that resulted in the section 10(b) violations. Smith had both the power to control Equifaxs cybersecurity policy and the statements made by Equifax and the other Individual Defendants as to these cybersecurity policies. Thus, the Plaintiff has sufficiently stated a claim for control liability as to Smith.
IV. Conclusion
For the reasons stated above, the Defendants Joint Motion to Dismiss [Doc. 62] is GRANTED in part and DENIED in part. It is GRANTED as to the Defendants Gamble, Ploder, and Dodge. It is DENIED as to the Defendants Equifax and Smith.
SO ORDERED, this 28 day of January, 2019.
Am. Compl. ¶ 3.
Id. ¶ 3.
Id. ¶ 19.
Id.
Id. ¶ 20.
Id. ¶ 21.
Id.
Id. ¶ 22.
Id. ¶ 23.
Id. ¶ 24.
Id. ¶ 29.
Id. ¶ 36.
Id. ¶¶ 30, 36.
Id. ¶ 30.
Id. ¶ 36.
Id. ¶ 37.
Id. ¶ 38.
Id.
Id.
Id. ¶ 39.
Id.
Id. ¶ 52.
Id. ¶ 53.
Id. ¶ 277.
Id. ¶ 62.
Id. ¶ 208.
Id. ¶ 66 (emphasis omitted).
Id. ¶ 209.
Id.
Id.
Id.
Id. ¶¶ 210-11.
Id. ¶ 217.
Id.
Id.
Id.
Id. ¶ 218.
Id.
Id. ¶ 217.
Id. ¶¶ 218-19.
Id. ¶¶ 224-30.
Id. ¶ 224.
Id.
Id.
Id.
Id. ¶ 225 (emphasis omitted).
Id.
Id.
Id. ¶ 226.
Id. ¶¶ 231-34.
Id. ¶ 231.
Id.
Id.
Id. ¶ 232.
Id.
Id.
Id. ¶ 233.
Id. ¶¶ 235-40.
Id. ¶ 235.
Id.
Id. ¶ 236.
Id. ¶ 237.
Id.
Id. ¶¶ 241-45.
Id. ¶¶ 246-47.
Id. ¶¶ 248-50.
Id. ¶¶ 251-53.
Id. ¶¶ 254-60.
Id. ¶¶ 261-63.
Id. ¶¶ 264-66.
Id. ¶¶ 285-353.
Id. ¶ 71.
Id. ¶ 77.
Id.
Id.
Id. ¶¶ 78-83.
Id.
Id. ¶ 91.
Id.
Id. ¶ 92.
Id.
Id. ¶ 93.
Id. ¶ 73.
Id.
Id.
Id.
Id. ¶ 73.
Id. ¶ 85.
Id.
Id.
Id. ¶ 87.
Id. ¶ 89.
Id. ¶ 90.
Id. ¶ 95.
Id.
Id.
Id. ¶ 96.
Id.
Id.
Id. ¶ 97.
Id.
Id. ¶ 98.
Id. ¶¶ 109-10.
Id. ¶ 112.
Id. ¶ 113.
Id. ¶ 114.
Id. ¶ 115.
Id. ¶ 116.
Id. ¶ 117.
Id.
Id. ¶ 118.
Id.
Id. ¶ 118.
Id.
Id. ¶ 119.
Id. ¶ 120.
Id.
Id.
Id.
Id. ¶ 121.
Id.
Id.
Id.
Id.
Id. ¶ 122.
Id.
Id.
Id. ¶ 123.
Id. ¶ 334.
Id. This speech was recorded and uploaded to YouTube.com on August 22, 2017.
Id. ¶ 124.
Id. ¶ 125.
Id. ¶ 124.
Id. ¶ 126.
Id. ¶ 128.
Id. ¶ 131.
Id. ¶ 128.
Id. ¶ 129.
Id. ¶ 138.
Id.
Id. ¶ 151.
Id. ¶¶ 154-79.
Id. ¶ 177.
See [Doc. 64].
Ashcroft v. Iqbal , 556 U.S. 662, 129 S.Ct. 1937, 1949, 173 L.Ed.2d 868 (2009) ; Fed. R. Civ. P. 12(b)(6).
Bell Atlantic v. Twombly , 550 U.S. 544, 556, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007).
See Quality Foods de Centro America, S.A. v. Latin American Agribusiness Dev. Corp. , S.A. , 711 F.2d 989, 994-95 (11th Cir. 1983) ; see also Sanjuan v. American Bd. of Psychiatry and Neurology, Inc. , 40 F.3d 247, 251 (7th Cir. 1994) (noting that at the pleading stage, the plaintiff receives the benefit of imagination).
See Lombards, Inc. v. Prince Mfg., Inc. , 753 F.2d 974, 975 (11th Cir. 1985), cert. denied , 474 U.S. 1082, 106 S.Ct. 851, 88 L.Ed.2d 892 (1986).
See Erickson v. Pardus , 551 U.S. 89, 93, 127 S.Ct. 2197, 167 L.Ed.2d 1081 (2007).
Fed. R. Civ. P. 9(b).
In re Theragenics Corp. Sec. Litig. , 105 F.Supp.2d 1342, 1348 (N.D. Ga. 2000) (citing Brooks v. Blue Cross and Blue Shield of Fla., Inc. , 116 F.3d 1364, 1371 (11th Cir. 1997) ).
In re Scientific-Atlanta, Inc., Sec. Litig. , 239 F.Supp.2d 1351, 1358 (N.D. Ga. 2002).
15 U.S.C. § 78u-4(b)(1).
15 U.S.C. § 78u-4(b)(2).
15 U.S.C. § 78u-4(b)(2).
15 U.S.C. § 78u-4(b)(3)(A).
15 U.S.C. § 78j(b).
17 C.F.R. § 240.10b-5.
Mizzaro v. Home Depot, Inc. , 544 F.3d 1230, 1236-37 (11th Cir. 2008).
Defs. Mot. to Dismiss, at 9.
Fed. R. Civ. P. 9(b).
Brooks v. Blue Cross and Blue Shield of Fla. , 116 F.3d 1364, 1371 (11th Cir.1997).
15 U.S.C. § 78u-4(b)(1).
In re HomeBanc Corp. Sec. Litig. , 706 F.Supp.2d 1336, 1353 (N.D. Ga. 2010).
FindWhat Inv. Grp. v. FindWhat.com , 658 F.3d 1282, 1305 (11th Cir. 2011) (internal quotations and alterations omitted).
Id.
Defs. Mot. to Dismiss, at 12-13.
Id.
Santa Fe Indus., Inc. v. Green , 430 U.S. 462, 477, 97 S.Ct. 1292, 51 L.Ed.2d 480 (1977) (No doubt Congress meant to prohibit the full range of ingenious devices that might be used to manipulate securities prices. But we do not think it would have chosen this term of art if it had meant to bring within the scope of s 10(b) instances of corporate mismanagement such as this, in which the essence of the complaint is that shareholders were treated unfairly by a fiduciary.).
Id. at 465, 97 S.Ct. 1292.
Id. at 465, 473, 97 S.Ct. 1292.
In re Ebix, Inc. Sec. Litig. , 898 F.Supp.2d 1325, 1340 (N.D. Ga. 2012) (quoting In re Premiere Techs. Inc. , No. 1:98-CV-1804-JOF, 2000 WL 33231639, at *14 (N.D.Ga. 2000) ).
The Defendants cite cases for the proposition that misstatements concerning corporate mismanagement, along with allegations of corporate mismanagement, are also not cognizable under the federal securities laws/section 10(b). See Defs. Mot. to Dismiss, at 13 (citing Cutsforth v. Renschler , 235 F.Supp.2d 1216, 1242-44 (M.D. Fla. 2002) ). However, the Supreme Courts holding in Santa Fe does not support such a conclusion, and the cases cited are not binding authority on this Court. The Court instead agrees with the courts in this District that have concluded that false or misleading statements or omissions concerning corporate mismanagement are cognizable under the federal securities laws. See, e.g., In re Ebix, Inc. Sec. Litig. , 898 F.Supp.2d 1325, 1340 (N.D. Ga. 2012). The Defendants cite Cutsforth v. Renschler for the proposition that a failure to disclose mismanagement is also not cognizable under the federal securities laws. The Court finds the reasoning in Cutsforth and similar cases unconvincing. In those cases, the courts do not explain why nondisclosure of mismanagement is inactionable under Santa Fe. Furthermore, the facts of those cases are distinguishable. The court in Cutsforth found that the mere nondisclosure of mismanagement itself was not actionable. In contrast, the Plaintiff here alleges that the Defendants made affirmative misstatements concerning mismanagement of cybersecurity, not a mere failure to disclose. Even applying the holding in Cutsforth and similar cases, such misstatements would be actionable. Thus, the Court also finds that Cutsforth is distinguishable.
Am. Compl. ¶ 289.
Id.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 16.
Defs. Mot. to Dismiss, at 13-15.
Id. at 15.
Am. Compl. ¶ 66.
Id. ¶ 257.
Id. ¶ 209.
Id. ¶ 210.
Id. ¶ 209.
Id. ¶¶ 65, 217-23, 295.
Id. ¶ 65.
Id. ¶ 65.
Id. ¶ 289.
See, e.g., Bricklayers & Masons Local Union No. 5 Ohio Pension Fund v. Transocean Ltd. , 866 F.Supp.2d 223, 243 (S.D.N.Y. 2012) (Likewise, the Complaint plausibly alleges facts indicating that a reasonable investor would assume that Transoceans safety and training measures were not only large in extent and range or amount, but adequate, when, in fact, the measures were insufficient to address applicable legal requirements and created a high risk of legal exposure.); In re Massey Energy Co. Sec. Litig. , 883 F.Supp.2d 597, 617-18 (S.D.W. Va. 2012) (holding that the defendants statements concerning their commitment to safety, including that safety was a first priority every day, were actionable); In re ValuJet, Inc., Sec. Litig. , 984 F.Supp. 1472, 1477-78 (N.D. Ga. 1997) (concluding that statements touting operational integrity and safety were false given numerous safety incidents).
ValuJet , 984 F.Supp. at 1477-78.
In re Heartland Payment Sys., Inc. Sec. Litig. , Civ. No. 09-1043, 2009 WL 4798148, at *1 (D.N.J. Dec. 7, 2009).
Id.
Id.
Id. at *2.
Id. at *5.
Id.
Id.
Id.
Defs. Mot. to Dismiss, at 22.
15 U.S.C. § 78u-4(b)(1).
See Defs. Mot. to Dismiss, at 22; see also Am. Compl. ¶ 292.
Am. Compl. ¶ 293.
Am. Compl. ¶ 346.
Id. ¶ 339.
Id.
Id. ¶ 311
Defs. Mot. to Dismiss, at 22-23.
See Am. Compl. ¶¶ 312, 340, 347 (explaining the falsity of each of these challenged statements).
Defs. Mot. to Dismiss, at 22.
Am. Compl. ¶ 346.
Defs. Mot. to Dismiss, at 22.
Am. Compl. ¶ 339 (emphasis added).
Compare Defs. Mot. to Dismiss, at 22-23, with Am. Compl. ¶ 342.
Defs. Mot. to Dismiss, at 18-21.
Amalgamated Bank v. Coca-Cola Co. , No. 1:05-CV-1226, 2006 WL 2818973, at *3 (N.D. Ga. Sept. 29, 2006).
Id.
Id.
Id. (quoting Grossman v. Novell, Inc. , 120 F.3d 1112, 1119-20 (10th Cir. 1997) ) (internal alterations omitted).
In re Australia & New Zealand Banking Grp. Ltd. Sec. Litig., No. 08 Civ. 11278(DLC), 2009 WL 4823923, at *11 (S.D.N.Y. Dec. 14, 2009) (quoting ECA, Local 134 IBEW Joint Pension Tr. of Chi. , 553 F.3d 187, 206 (2d Cir. 2009) ).
Defs. Mot. to Dismiss, at 18.
Id. at 19.
Id. at 18.
Bricklayers & Masons Local Union No. 5 Ohio Pension Fund v. Transocean Ltd. , 866 F.Supp.2d 223, 239 (S.D.N.Y. 2012).
Id. at 244.
See In re Petrobras Sec. Litig. , 116 F.Supp.3d 368, 381 (S.D.N.Y. 2015) (While some of the alleged statements, viewed in isolation, may be mere puffery, nonetheless, when (as here alleged) the statements were made repeatedly in an effort to reassure the investing public about the Companys integrity, a reasonable investor could rely on them as reflective of the true state of affairs at the Company. Accordingly, the Court cannot find that all of Petrobras alleged statements regarding its general integrity and ethical soundness were immaterial as a matter of law.).
Ong v. Chipotle Mexican Grill, Inc. (Chipotle II) , 294 F.Supp.3d 199, 232 (S.D.N.Y. 2018).
Defs. Mot. to Dismiss, at 16.
See, e.g. , Am. Compl. ¶ 318 (contending that certain statements, such as Equifax being a trusted steward, were false and misleading because Defendants knew or were reckless in failing to know, but failed to disclose, that hackers had penetrated Equifaxs internal data systems); see also id. ¶¶ 288, 300, 335, 338.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 28.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 29.
Rudolph v. Arthur Andersen & Co. , 800 F.2d 1040, 1043 (11th Cir. 1986).
Id. (citing First Va. Bankshares v. Benson , 559 F.2d 1307, 1314 (5th Cir. 1977) ).
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 29.
In re Heartland Payment Sys., Inc. Sec. Litig. , Civ. No. 09-1043, 2009 WL 4798148, at *4 (D.N.J. Dec. 7, 2009).
Id.
However, as discussed above, the Plaintiff has adequately alleged that those prior statements were false. Whether those statements touting Equifaxs cybersecurity are false, and thus actionable, is a separate question from whether the Defendants were under a duty to disclose specifically the occurrence of the Data Breach. Those statements are actionable merely because of the fact that they were false or misleading at the time they were made due to the widespread inadequacies in Equifaxs data systems, notwithstanding whether the Data Breach occurred or not.
Defs. Mot. to Dismiss, at 26.
Am. Compl. ¶ 306.
Id. ¶ 308 (emphasis in original).
Defs. Mot. to Dismiss, at 27.
In re Van der Moolen Holding N.V. Sec. Litig. , 405 F.Supp.2d 388 (S.D.N.Y. 2005).
Id. at 400.
Id. (internal quotations omitted).
Id.
Am. Compl. ¶ 336.
Id. ¶ 339.
Id. ¶ 342.
Defs. Mot. to Dismiss, at 21.
Defs. Reply Br., at 23.
Am. Compl. ¶¶ 340, 342.
See, e.g. , Am. Compl. ¶¶ 66-67.
Id. ¶ 66.
Defs. Mot. to Dismiss, at 17.
Defs. Reply Br., at 24.
Transcript of Oral Argument, at 75 [Doc. 83].
See, e.g., In re Cryolife, Inc. , No. Civ.A.1:02CV1868-BBM, 2003 WL 24015055, at *8-*9 (N.D. Ga. May 27, 2003) (noting that the defendant had contended it was in compliance with all FDA regulations despite the fact that it had received a letter from the FDA documenting specific problems with Cryolifes quality assurance programs); In re ValuJet, Inc. , 984 F.Supp. 1472, 1477 (N.D. Ga. 1997) (In the Complaint, the Plaintiffs allege that representatives of the Federal Aviation Administration (FAA) identified numerous safety-related incidents involving ValuJet. The Plaintiffs further allege in the Complaint that in February of 1996, the FAA (1) began surveillance of ValuJet; (2) expressed written concern about the training of pilots and ValuJets safety and maintenance procedures which included numerous, uncorrected violations; and (3) as a result of the February 1996 inspection, expressly required ValuJet to get FAA approval before buying more planes or beginning access to new cities. As alleged in the Complaint, an FAA letter to Defendant Jordan, dated February 29, 1996, expressed concern about ValuJets meeting the highest possible degree of safety in the public interest.).
Am. Compl. ¶ 349.
Id. ¶¶ 349-53.
Defs. Mot. to Dismiss, at 30-31.
Id. at 31-32.
City of Roseville Emp. Ret. Sys. v. Horizon Lines, Inc. , 686 F.Supp.2d 404, 417 (D. Del. 2009).
In re PetroChina Co. Ltd. Sec. Litig. , 120 F.Supp.3d 340, 358-59 (S.D.N.Y. 2015).
Id. at 359.
Id.
See In re Braskem S.A. Sec. Litig. , 246 F.Supp.3d 731, 758 (S.D.N.Y. 2017) (rejecting securities fraud claims premised upon Sarbanes-Oxley certifications because the complaint did not concretely allege that any of Braskems financial reports were in any way inaccurate).
Defs. Mot. to Dismiss, at 24-26.
See generally [Doc. 62-2].
See [Doc. 62-2], at 2.
Defs. Mot. to Dismiss, at 24-25.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 38.
In re Flowers Foods, Inc. Sec. Litig. , No. 7:16-CV-222 (WLS), 2018 WL 1558558, at *8 (M.D. Ga. Mar. 23, 2018) (quoting Omnicare, Inc. v. Laborers Dist. Council Constr. Indus. Pension Fund. , --- U.S. ----, 135 S.Ct. 1318, 1328, 191 L.Ed.2d 253 (2015) ).
Omnicare , 135 S.Ct. at 1329.
Flowers Foods , 2018 WL 1558558, at *8 (quoting Omnicare , 135 S.Ct. at 1329 ).
Mizzaro v. Home Depot, Inc. , 544 F.3d 1230, 1238 (11th Cir. 2008) (internal quotations omitted).
Tellabs, Inc. v. Makor Issues & Rights, Ltd. , 551 U.S. 308, 324, 127 S.Ct. 2499, 168 L.Ed.2d 179 (2007).
Mizzaro , 544 F.3d at 1238.
Id. at 1238.
Id. at 1239 (quoting Tellabs , 551 U.S. at 323, 127 S.Ct. 2499 ).
Phillips v. Scientific-Atlanta, Inc. , 374 F.3d 1015, 1017 (11th Cir. 2004).
Id. at 1018.
Id. at 1017 ; see also In re Cabletron Sys., Inc. , 311 F.3d 11, 39 (1st Cir. 2002) (The plaintiff may combine various facts and circumstances indicating fraudulent intent-including those demonstrating motive and opportunity-to satisfy the scienter requirement. (internal alterations and quotations omitted) ).
Phillips , 374 F.3d at 1018.
Mizzaro , 544 F.3d at 1249.
In re Sci. Atlanta, Inc. Sec. Litig. , 754 F.Supp.2d 1339, 1361 (N.D. Ga. 2010) (citing S.E.C. v. Merchant Capital, LLC , 483 F.3d 747, 766 (11th Cir. 2007) ).
Tellabs , 551 U.S. at 326, 127 S.Ct. 2499.
Mizzaro , 544 F.3d at 1238.
Id. (quoting Bryant v. Avado Brands, Inc. , 187 F.3d 1271, 1282 n.18 (11th Cir. 1999) ).
In re Sci. Atlanta, Inc. Sec. Litig. , 754 F.Supp.2d 1339, 1360 (N.D. Ga. 2010) (citing Cornwell v. Credit Suisse Grp. , 689 F.Supp.2d 629, 637 (S.D.N.Y. 2010) ).
In re Coca-Cola Enters. Inc. Sec. Litig. , 510 F.Supp.2d 1187, 1199 (N.D. Ga. 2007).
Id. (internal quotations omitted).
In re Ebix, Inc. Sec. Litig. , 898 F.Supp.2d 1325, 1344 (N.D. Ga. 2012) (quoting Mizzaro , 544 F.3d at 1249 ) ).
Am. Compl. ¶¶ 267-84.
Mizzaro , 544 F.3d at 1247.
Defs. Mot. to Dismiss, at 35.
Am. Compl. ¶ 268.
Id. ¶¶ 71, 269.
Id. ¶ 268.
Id. ¶ 269.
Id. ¶ 271.
Id.
Id. ¶ 270.
Defs. Mot. to Dismiss, at 35-36.
Am. Compl. ¶ 13.
Id. ¶ 91 (emphasis omitted).
Id. ¶ 92.
Id. ¶ 93.
Defs. Mot. to Dismiss, at 36-37.
See Mizzaro , 544 F.3d at 1239 (One topic Tellabs did not address is how courts should go about evaluating allegations based on statements made by unidentified, confidential witnesses. The issue is important here because statements by confidential witnesses form one of the main building blocks of the amended complaint.).
Id. at 1239.
Id. at 1240.
Id.
Am. Compl. ¶¶ 91-93.
Id. ¶ 91 (emphasis omitted).
In re Theragenics Corp. Sec. Litig. , 105 F.Supp.2d 1342, 1355 (N.D. Ga. 2000).
Am. Compl. ¶¶ 91-94.
See, e.g., id. ¶ 77 (Regarding those warnings, in an October 26, 2017 article entitled Equifax Was Warned, Motherboard reported that according to a former member of Equifaxs cybersecurity team who left the Company in 2017, the Company had hired Deloitte to perform a security audit in 2016.); see also id. ¶¶ 78, 80-83.
Garfield v. NDC Health Corp. , 466 F.3d 1255, 1265 (11th Cir. 2006).
Id. (internal quotations omitted).
See, e.g. , Am. Compl. ¶ 254 (For example, as alleged above, a former Equifax employee told Motherboard that Company management refused to take seriously the conclusions of a 2016 Deloitte security audit that found multiple serious deficiencies in the Companys infrastructure, including poor patching.).
In re Theragenics Corp. Sec. Litig. , 105 F.Supp.2d 1342, 1361 (N.D. Ga. 2000) (quoting In re Comshare, Inc. Sec. Litig., No. 96-737-DT, 1997 WL 1091468, at *8 (E.D. Mich. Sept. 18, 1997) ).
In re ChoicePoint, Inc. Sec. Litig. , No. 1:05-CV-00686-JTC, 2006 WL 8429145 (N.D. Ga. Nov. 21, 2006).
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 41.
In re ChoicePoint , at *1-2.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 42.
Defs. Mot. to Dismiss, at 38-39.
Omnicare, Inc. v. Laborers Dis. Council Const. Indus. Pension Fund. , --- U.S. ----, 135 S.Ct. 1318, 1328-29, 191 L.Ed.2d 253 (2015).
Defs. Mot. to Dismiss, at 39-40.
Am. Compl. ¶¶ 73-75, 84-90.
Defs. Reply Br., at 1-2.
See Am. Compl. ¶ 69 (The hackers gained unauthorized access to data on Equifaxs computer systems by using publicly available information to answer security questions and bypass authentication measures.); id. ¶ 70 (Because Equifax failed to implement adequate network monitoring safeguards, hackers were able to repeatedly penetrate Equifaxs network for approximately eight months before the Company finally detected the suspicious inquiries in January 2014.); id. ¶¶ 73-74 (Once again, Equifaxs inadequate network monitoring practices compounded the magnitude of its failure to implement proper authentication protocols: the W2Express hackers first penetrated the Companys networks in early 2015 and remained undetected inside Equifaxs networks for approximately one year before they were discovered, just as hackers had done during the cyberattack that occurred the previous year.); id. ¶¶ 85-89 (noting that poor authentication measures and inadequate networking caused and aggravated the TALX breach).
Id. ¶ 70 (In its March 2014 letter, Equifax assured the New Hampshire Attorney General that the Company would implement additional monitoring and blocking measures to protect at-risk information.).
Am. Compl. ¶ 91.
Id.
Am. Compl. ¶ 91.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 47.
Am. Compl. ¶ 272.
Defs. Mot. to Dismiss, at 44.
Id. at 44.
At the earliest, according to the Complaint, the Defendants became aware of the Data Breach on July 29, 2017. See, e.g. , Am. Compl. ¶ 15.
Am. Compl. ¶ 334.
Id. ¶ 122.
Id. ¶¶ 91-92.
Id. ¶ 334.
Defs. Mot. to Dismiss, at 45.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 48.
In re Heartland Payment Sys., Inc. Sec. Litig. , Civ. No. 09-1043, 2009 WL 4798148, at *7 (D.N.J. Dec. 7, 2009).
Id.
See In re Coca-Cola Enters. Sec. Litig. , 510 F.Supp.2d 1187, 1200-01 (N.D. Ga. 2007) ([T]he Plaintiffs have failed to plead facts sufficient to demonstrate that the Defendants engaged in channel stuffing.).
Id. at 1201 (quoting In re Theragenics Corp. Sec. Litig. , 105 F.Supp.2d 1342, 1361 (N.D. Ga. 2000) ).
Garfield v. NDC Health Corp. , 466 F.3d 1255 (11th Cir. 2006).
Id. at 1264.
Id.
Id. at 1265.
Id.
Id.
In re Coca-Cola Enters. Sec. Litig. , 510 F.Supp.2d 1187, 1201 (N.D. Ga. 2007).
Id. (The Amended Complaint fails to provide any specific allegations regarding a time, place or manner in which any of the Individual Defendants was specifically informed or indicated special knowledge as to CCEs channel stuffing activities.).
Ebix , 898 F.Supp.2d at 1346-47.
Id. at 1347.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 50.
In re Theragenics Corp. Sec. Litig. , 137 F.Supp.2d 1339, 1348 (N.D. Ga. 2001).
See In re Immucor Inc. Sec. Litig. , No. 1:05-CV-2276-WSD, 2006 WL 3000133, at *18 (N.D. Ga. Oct. 4, 2006) (That Gallup never disclosed the full scope of the Italian situation, even after it is apparent that he knew of its scope and gravity, lends strength to the inference that Gallup intentionally or recklessly withheld from investors a full and fair statement of the problems in Italy and their possible consequences.); In re Theragenics Corp. Sec. Litig. , 137 F.Supp.2d 1339, 1348 (N.D. Ga. 2001) (noting that the plaintiffs scienter claim was based, in part, on their claim that Theragenics closely and continually monitored the performance of Amersham, its largest competitor).
Defs. Mot. to Dismiss, at 46-47.
Id.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 51.
Id. at 51.
Mizzaro v. Home Depot, Inc. , 544 F.3d 1230, 1253 (11th Cir. 2008).
Id.
In re Coca-Cola Enters. Inc. Sec. Litig. , 510 F.Supp.2d 1187, 1202 (N.D. Ga. 2007) (quoting Druskin v. Answerthink, Inc. , 299 F.Supp.2d 1307, 1335 (S.D. Fla. 2004) ).
Id.
In re Spectrum Brands, Inc. Sec. Litig. , 461 F.Supp.2d 1297, 1318 (N.D. Ga. 2006) (The sales contribute to an inference of scienter as to Jones, but are not alone sufficient to raise a strong inference that Jones acted with scienter in committing the acts of securities fraud alleged.).
In re Theragenics Corp. Sec. Litig. , 105 F.Supp.2d 1342, 1361 (N.D. Ga. 2000) ([T]he Plaintiffs in this case cannot base scienter on stock sales alone. The stock sales may constitute circumstantial evidence that Defendants Jacobs and Smith knew Theragenics stock price was artificially inflated and may support a strong inference of scienter.).
Coca-Cola , 510 F.Supp.2d at 1202.
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 53-54.
Am. Compl. ¶ 280.
Id. ¶ 281.
Id.
Id. ¶ 282.
See, e.g., In re Home Loan Servicing Sols, Ltd. Sec. Litig. , No. 16-cv-60165-WPD, 2016 WL 10592320, at *7 (S.D. Fla. June 6, 2016) (noting that the fact that a corporate officer was forced to resign contributed to a finding of scienter); In re OSG Sec. Litig. , 12 F.Supp.3d 622, 632 (S.D.N.Y. 2014) (The circumstances and timing of the resignations suggest that both defendants were terminated in relation to the undisclosed tax issue. ).
In re Home Loan Servicing Sols, Ltd. Sec. Litig. , 2016 WL 10592320, at *7.
In re OSG Sec. Litig. , 12 F.Supp.3d at 632.
Id. at 632-33.
In re Coca-Cola Enters. Inc. Sec. Litig. , 510 F.Supp.2d 1187, 1201 (N.D. Ga. 2007) (quoting In re Theragenics Corp. Sec. Litig. , 105 F.Supp.2d 1342, 1361 (N.D. Ga. 2000) ).
Orton v. Parametric Tech. Corp. , 344 F.Supp.2d 290, 306 (D. Mass. 2004).
See In re Coca-Cola Enters. Inc. Sec. Litig. , 510 F.Supp.2d 1187, 1201 (N.D. Ga. 2007) (Here, the Plaintiffs similarly fail to allege that any of the Defendants had knowledge as to the channel stuffing. The essence of their allegations is that because of the Defendants positions and their general duty to monitor the information on Margin Minder, the Defendants must have known about the channel stuffing. The Amended Complaint fails to provide any specific allegations regarding a time, place or manner in which any of the Individual Defendants was specifically informed or indicated special knowledge as to CCEs channel stuffing activities. These pleadings are thus insufficient to demonstrate an inference of scienter.).
Defs. Mot. to Dismiss, at 53-54.
Mizzaro , 544 F.3d at 1254 (Even though it failed to plead scienter adequately for any of the individual defendants, the amended complaint could, in theory, still create a strong inference that the corporate defendant, Home Depot, Inc., acted with the requisite state of mind.); see also Plymouth Cty. Ret. Sys. v. Carters Inc. , No. 1:08-cv-02940-JOF, 2011 WL 13124501, at *12 n.8 (N.D. Ga. Mar. 17, 2011).
Mizzaro , 544 F.3d at 1254.
Mizzaro , 544 F.3d at 1254.
Mizzaro , 544 F.3d at 1254 (emphasis in original).
Id. at 1254-55.
Id. at 1254 (quoting Southland Sec. Corp. v. INSpire Ins. Sols., Inc. , 365 F.3d 353, 366 (5th Cir. 2004) ).
Id.
Defs. Mot. to Dismiss, at 54.
See 15 U.S.C. § 78u-4(b)(4).
Meyer v. Greene , 710 F.3d 1189, 1195 (11th Cir. 2013) (quoting Robbins v. Koger Props., Inc. , 116 F.3d 1441, 1448 (11th Cir. 1997) ).
FindWhat Invr Grp. v. FindWhat.com , 658 F.3d 1282, 1309 (11th Cir. 2011).
Meyer , 710 F.3d at 1196 (citing Hubbard v. BankAtlantic Bancorp, Inc. , 688 F.3d 713, 726 (11th Cir. 2012) ).
Id. (citing Hubbard , 688 F.3d at 726 ).
Meyer , 710 F.3d at 1196 (quoting Robbins v. Koger Props., Inc. , 116 F.3d 1441, 1447 (11th Cir. 1997) ).
Id.
Id.
Am. Compl. ¶¶ 363-64.
FindWhat Inv. Grp. , 658 F.3d at 1309-10.
Id. at 1310 (quoting Basic Inc. v. Levinson , 485 U.S. 224, 241, 108 S.Ct. 978, 99 L.Ed.2d 194 (1988) ).
Id. (internal quotations and citations omitted).
Id.
Id.
FindWhat Inv. Grp. , 658 F.3d at 1311 (quoting In re Cooper Cos. Sec. Litig. , 254 F.R.D. 628, 638 (C.D. Cal. 2009) ); see also In re Williams Sec. Litig. , 558 F.3d 1130, 1137 (10th Cir. 2009) (Loss causation is easiest to show when a corrective disclosure reveals the fraud to the public and the price subsequently drops-assuming, of course, that the plaintiff could isolate the effects from any other intervening causes that could have contributed to the decline.).
Id.
Id. at 1311-12 (footnote omitted).
Id. (citing Dura Pharm., Inc. v. Broudo , 544 U.S. 336, 347, 125 S.Ct. 1627, 161 L.Ed.2d 577 (2005) ).
Defs. Mot. to Dismiss, at 55.
Id. at 56-57.
Meyer , 710 F.3d at 1197.
FindWhat Investor Grp. v. FindWhat.com , 658 F.3d 1282, 1312 n.28 (11th Cir. 2011).
In re Ebix, Inc. Sec. Litig. , 898 F.Supp.2d 1325, 1347 (N.D. Ga. 2012) (quoting In re Coca-Cola Enters. Inc. Sec. Litig. , 510 F.Supp.2d 1187, 1203-04 (N.D. Ga. 2007) ).
Pl.s Br. in Oppn to Defs. Mot. to Dismiss, at 58.
Lentell v. Merrill Lynch & Co. , 396 F.3d 161, 173 (2d Cir. 2005) (quoting Castellano v. Young & Rubicam, Inc. , 257 F.3d 171, 188 (2d Cir. 2001) ).
Sapssov v. Health Mgmt. Assocs., Inc. , 608 F. Appx 855, 861 n.7 (11th Cir. 2015) (quoting Hubbard v. BankAtlantic Bancorp, Inc. , 688 F.3d 713, 726 n.25 (11th Cir. 2012) ).
Defs. Mot. to Dismiss, at 45 n.18. At oral argument, counsel for the Defendants devoted a significant portion of his time arguing that the challenged statements published on Equifaxs website were not made in connection with the sale or purchase of a security. See Transcript of Oral Argument, at 20-23 [Doc. 83]. However, this argument was not raised in the Defendants papers. Instead, the Defendants only assert in their papers that Smiths statements at the University of Georgia were not made in connection with the purchase or sale of a security. See Defs. Mot. to Dismiss, at 45 n.18; Defs. Reply Br., at 21 n.12. The Defendants failure to raise this argument in their briefs means that the argument has been abandoned. See Access Now, Inc. v. Sw. Airlines Co. , 385 F.3d 1324, 1330 (11th Cir. 2004) ([A] legal claim or argument that has not been briefed before the court is deemed abandoned and its merits will not be addressed.). And, even if the Defendants had raised this argument, the Court would not be persuaded. As discussed below, even statements made in technical jargon in a sophisticated medical journal can be considered in connection with the purchase or sale of a security, since analysts search for such information in evaluating stocks. See In re Carter-Wallace, Inc. Sec. Litig. , 150 F.3d 153, 156 (2d Cir. 1998). Here, the Court cannot say that, as a matter of law, statements made on a companys website are not made in connection with a securities transaction, even if those statements are not found prominently on the front page of the companys website. Market analysts, who find such information relevant, are able to locate and digest such information in evaluating a companys stock. See id. Therefore, the Court declines to dismiss these website statements for this reason.
In re Carter-Wallace, Inc. Sec. Litig. , 150 F.3d 153, 155-56 (2d Cir. 1998).
Id. (quoting SEC v. Tex. Gulf Sulphur Co. , 401 F.2d 833, 860 (2d Cir. 1968) ).
Id. (quoting In re Ames Dept Stores Inc. Stock Litig. , 991 F.2d 953, 966 (2d Cir. 1993) ).
Id. (quoting Basic Inc. v. Levinson , 485 U.S. 224, 247 n.24, 108 S.Ct. 978, 99 L.Ed.2d 194 (1988) ).
Id.
Am. Compl. ¶ 334.
Defs. Mot. to Dismiss, at 59.
15 U.S.C. § 78t(a).
In re Spectrum Brands, Inc. Sec. Litig. , 461 F.Supp.2d 1297, 1307 (N.D. Ga. 2006) (citing Theoharous v. Fong , 256 F.3d 1219, 1227 (11th Cir. 2001) ).
Defs. Mot. to Dismiss, at 59.
Id.
Id. at 59-60.
Id. at 60.