POC USA LLC v. Expeditors International of Washington Inc

1 2 UNITED STATES DISTRICT COURT WESTERN DISTRICT OF WASHINGTON 3 AT SEATTLE 4 POC USA, LLC, Case No. C23-1816-RSM 5 Plaintiff, ORDER GRANTING AND DENYING IN 6 PART DEFENDANT’S MOTION FOR v. SUMMARY JUDGMENT 7 EXPEDITORS INTERNATIONAL OF 8 WASHINGTON, INC., 9 Defendant. 10 11 I. INTRODUCTION This matter comes before the Court on Defendant Expeditors International of 12 Washington, Inc.’s Motion for Summary Judgment. Dkt. #36. Plaintiff POC USA, LLC, 13 opposes the motion. Dkts. #60 and #62. The Court held oral argument on this Motion on April 14 15, 2025. Dkt. #98. For the following reasons, the Court GRANTS AND DENIES IN PART 15 Defendant’s Motion. 16 17 II. BACKGROUND In March 2016, Plaintiff entered into a Distributor Services Agreement (“DSA” or “the 18 contract”) with Defendant, outlining that Defendant would receive shipments of biking and other 19 sporting products manufactured by Plaintiff, warehouse the products, and ship the products to 20 Plaintiff’s customers. Dkt. #37, Bailey Decl., Ex. C. Defendant would perform these duties 21 using its own computerized distribution management system, and Defendant was required to 22 provide real-time visibility to Plaintiff of its products. This contract was amended in 2019. Id. 23 at Ex. D and Ex. E. 24 1 Defendant’s service included its “One Global Platform,” which provided real-time visibility of Plaintiff’s orders and goods with “Uptime” of “[o]ver 99.5%.” Id. at Ex. A. 2 Defendant’s IT infrastructure and software was chosen and provided by Defendant. 3 In February 2022, Defendant suffered a cyberattack. Dkt. #36 at 1. Instead of paying a 4 ransom, Defendant shut down most of its operating systems. Id. During this shutdown, 5 Defendant attempted to use a manual distribution method to fulfill its services for Plaintiff. Id. 6 However, this shutdown and manual system caused Plaintiff to limit orders, causing customer 7 complaints, cancelled orders, and lost business. Dkt. #68, Coates Decl., at ¶¶ 32-55. “By the 8 time Expeditors was able to resume normal services to POC, the window of opportunity to sell 9 cycling equipment during the still booming 2022 biking season had passed.” Id. at ¶ 51. 10 Plaintiff filed its Complaint on November 27, 2023. Dkt. #1. On January 25, Defendant 11 filed its Motion to Dismiss, Dkt. #14, which this Court granted and denied in part on April 11, 12 2024, Dkt. #28. The Court dismissed Plaintiff’s claims for negligence, gross negligence, and 13 bailment. Id. 14 On January 14, 2025, Defendant filed the instant Motion, requesting the Court grant 15 summary judgment on Plaintiff’s remaining claims for breach of contract, breach of implied 16 covenant of good faith and fair dealing, unjust enrichment, and violation of the Washington 17 Consumer Protection Act (“WCPA”). Dkt. #36. On April 15, 2025, the Court held oral argument 18 on this Motion. Dkt. #98. 19 III. DISCUSSION 20 A. Legal Standard 21 Summary Judgment is appropriate where “the movant shows that there is no genuine 22 dispute as to any material fact and the movant is entitled to judgment as a matter of law.” Fed. 23 R. Civ. P. 56(a); Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 247 (1986). Material facts are 24 1 those which might affect the outcome of the suit under governing law. Anderson, 477 U.S. at 248. In ruling on summary judgment, a court does not weigh evidence to determine the truth of 2 the matter but “only determine[s] whether there is a genuine issue for trial.” Crane v. Conoco, 3 Inc., 41 F.3d 5547, 549 (9th Cir. 1994) (citing Federal Deposit Ins. Corp. v. O’Melveny & 4 Meyers, 969 F.2d 744, 747 (9th Cir. 1992)). 5 On a motion for summary judgment, the court views the evidence and draws inferences 6 in the light most favorable to the non-moving party. Anderson, 477 U.S. at 255; Sullivan v. U.S. 7 Dep’t of the Navy, 365 F.3d 827, 832 (9th Cir. 2004). The Court must draw all reasonable 8 inferences in favor of the non-moving party. See O’Melveny & Meyers, 969 F.2d at 747, rev’d 9 on other grounds, 512 U.S. 79 (1994). However, the non-moving party must make a “sufficient 10 showing on an essential element of her case with respect to which she has the burden of proof” 11 to survive summary judgment. Celotex Corp. v. Catrett, 477 U.S. 317, 323 (1986). 12 B. Analysis 13 Defendant moves for summary judgment dismissal on Plaintiff’s surviving claims: (1) 14 breach of the implied covenant of good faith and fair dealing; (2) breach of contract; (3) violation 15 of the WCPA; and (4) unjust enrichment. 16 1. Contract and Duty of Good Faith and Fair Dealing Claims 17 Defendant argues that Plaintiff’s good faith and fair dealing claim should be dismissed 18 because Defendant had no cybersecurity obligation, this obligation does not exist in the contract, 19 and Plaintiff’s claim “is one of contractual non-performance, not bad faith.” Dkt. # 36 at 8-9. 20 Defendant argues that Plaintiff’s claim “is generic, non-specific, and untethered to any 21 contractual provision[,]” which Plaintiff later “morphed its position to argue that the term 22 ‘Standard Security’ in the [contract] . . . created or encompassed some obligation to prevent a 23 cyberattack.” Id. at 7. Defendant points to several of Plaintiff’s witness statements to argue that 24 1 Plaintiff never discussed cybersecurity with Defendant and could not find a document defining “Standard Security” or an agreed-upon definition. Id. at 7-8. Because the parties’ agreement is 2 governed by a contract with no cybersecurity obligation, Defendant contends, this alleged duty 3 is “abstract” and nonexistent. Id. at 6. Regarding said contract, Defendant argues that Plaintiff’s 4 breach of contract claim fails because the “Standard Security” contract term only covers physical 5 security of goods, not cybersecurity, and the contract precludes Plaintiff’s damages. Id. at 18- 6 21. 7 To establish a breach of contract claim, Plaintiff must prove: (1) the existence of a 8 contract, (2) a material breach of that contract, and (3) resulting damage. See St. John Med. Ctr. 9 v. State ex rel. Dep’t of Soc. &Health Servs., 110 Wn. App. 51, 64 (2002). Whether a contract 10 has been formed and/or breached “may be determined as a matter of law if reasonable minds 11 could not differ.” P.E. Sys., LLC v. CPI Corp., 176 Wn.2d 198, 207 (2012). Under Washington 12 law, “extrinsic evidence is admissible to assist the court in ascertaining the parties’ intent and in 13 interpreting the contract.” Spectrum Glass Co., Inc. v. Pub. Util. Dist. No.1 of Snohomish Cnty., 14 129 Wash. App. 303, 311, 119 P.3d 854, 858 (2005) (citing U.S. Life Credit Life Ins. Co. v. 15 Williams, 129 Wn.2d 565, 569, 919 P.2d 594 (1996)). Courts may consider the contract’s: (1) 16 subject matter and objective; (2) circumstances around its making; (3) the parties’ conduct; (4) 17 reasonableness of the parties’ interpretations; (5) preliminary negotiation party statements; (6) 18 usages of trade; and (7) the parties’ course of dealing. Id. (citing Berg v. Hudesman, 115 Wn.2d 19 657, 666-68, 801 P.2d 222 (1990)). However, the court may not consider extrinsic evidence “to 20 show a party’s unilateral or subjective intent as to the meaning of a contract word or term[.]” Id. 21 (citing Hollis v. Garwall, Inc., 137 Wn.2d 683, 695, 974 P.2d 836 (1999)). “Interpreting a 22 contract provision is a question of law when (1) the interpretation does not depend on the use of 23 extrinsic evidence or (2) only one reasonable inference can be drawn from the extrinsic 24 1 evidence.” Id. (citing Tanner Elec. Co-op. v. Puget Sound Power Light Co., 128 Wn.2d 656, 674, 911 P.2d 1301 (1996)). 2 “There is in every contract an implied duty of good faith and fair dealing” that “obligates 3 the parties to cooperate with each other so that each may obtain the full benefit of performance.” 4 Rekhter v. Dep’t of Soc. & Health Servs., 180 Wn.2d 102, 112, 323 P.3d 1036 (2014) (quoting 5 Badgett v. Sec. State Bank, 116 Wn.2d 563, 569, 807 P.2d 356 (1991)). This implied covenant 6 “cannot add or contradict express contract terms and does not impose a free-floating obligation 7 of good faith on the parties.” Id. at 113. Instead, “the duty arises only in connection with terms 8 agreed to by the parties.” Id. (citations omitted). The duty can arise “when the contract gives 9 one party discretionary authority to determine a contract term.” Id. (quoting Goodyear Tire & 10 Rubber Co. v. Whiteman Tire, Inc., 86 Wn. App. 732, 738, 935 P.2d 628 (1997)). 11 The Court finds that it cannot interpret the parties’ contract as requested by the moving 12 party or find breach as a matter of law. The term “Standard Security” is undefined in the contract 13 and surrounding documents, and Defendant points to extrinsic evidence such as email to argue 14 that this term does not refer to cybersecurity. See Dkt. #36 at 18. Even considering this evidence, 15 Defendant has failed to show that “only one reasonable inference can be drawn from” it. Tanner 16 Elec. Co-op. at 674. Taking all reasonable inferences in Plaintiff’s favor, the parties’ 17 communications about the physical security of goods do not rule out all reasonable conclusions 18 that cybersecurity fit within the term “Standard Security” or was otherwise included in a contract 19 for services related to a global, cybernetwork. See Dkt. #37, Daily Decl., at ¶¶ 7, 9, 13, 12, 13, 20 14, 15, Ex. A, Ex. C, and Ex. D. 21 Furthermore, because a cybersecurity duty could reasonably exist under the contract, the 22 Court finds that Defendant has failed to show that Plaintiff’s claim for breach of the implied duty 23 of good faith and fair dealing is untethered to a contract term or duplicative. Defendant’s reliance 24 1 on one witness’ statements to argue that Plaintiff’s claim is actually “one of contractual non- performance, not bad faith[,]” is not conclusive and not the only reasonable inference here. Dkt. 2 #36 at 9; see also Dkt. #38, Saeturn Decl., Ex. A. The parties’ competing evidence shows that 3 there are disputes of material fact that cannot be resolved at summary judgment. These factual 4 questions of contract and breach are better left to a fact-finding jury. The Court will not dismiss 5 these claims. 6 2. WCPA 7 Defendant argues that Plaintiff’s WCPA claim fails because “[t]he undisputed evidence 8 demonstrates that Expeditors made no promise or guarantee to POC regarding any aspect of 9 cybersecurity . . . [and] POC in no way relied on any of these supposed unfair or deceptive 10 statements and, as a matter of law, cannot establish” causation or injury. Dkt. #36 at 15-16. 11 For a private WCPA action, “a plaintiff must establish five distinct elements: (1) unfair 12 or deceptive act or practice; (2) occurring in trade or commerce; (3) public interest impact; (4) 13 injury to plaintiff in his or her business or property; (5) causation.” Hangman Ridge Training 14 Stables, Inc. v. Safeco Title Ins. Co., 105 Wn.2d 778, 780 (1986). Whether a particular act or 15 practice is “unfair or deceptive” is a question of law. Panag v. Farmers Ins. Co. of Wash., 166 16 Wn.2d 27, 47, 204 P.3d 885 (2009). A plaintiff need not show that the defendant intended to 17 deceive but only that the alleged act had “the capacity to deceive a substantial portion of the 18 public.” Id. 19 “Deception exists ‘if there is a representation, omission[,] or practice that is likely to 20 mislead’ a reasonable consumer.” Id. at 50 (quoting Sw. Sunsites, Inc. v. Fed. Trade Comm’n, 21 785 F.2d 1431, 1435 (9th Cir. 1986)). But the “universe of ‘unfair’ business practices is broader 22 than, and encompasses, the universe of ‘deceptive’ business practices.” Id. at 51. Thus, a 23 deceptive act is necessarily unfair, but an unfair act is not necessarily deceptive. Acts are “unfair” 24 1 if they cause substantial injury that is “not outweighed by countervailing benefits to consumers or competitors, and not reasonably avoidable by the consumer.” Id. 2 “Furthermore, as a more general matter, federal courts applying Washington law have 3 consistently found that a ‘failure to employ adequate data security measures’ that ‘result in harm 4 to thousands of customers’ is sufficient to constitute an ‘unfair’ act under the WCPA.” In re 5 Accellion, Inc. Data Breach Litigation, 2024 WL333893, at *18 (N.D. Cal. Jan. 29, 2024) (citing 6 Veridian, 295 F. Supp. 3d at 1162 (W.D. Wash. 2017), Krefting v. Kaye-Smith Enterprises Inc., 7 2023 WL 4846850, at *8 (W.D. Wash. July 28, 2023), Guy v. Convergent Outsourcing, Inc., 8 2023 WL 4637318, at *8 (W.D. Wash. July 20, 2023), and Buckley, 2018 WL 1532671, at *4 9 (W.D. Wash. Mar. 29, 2018). 10 Defendant contends that Plaintiff has not established that Defendant’s actions were unfair 11 or deceptive. Defendant asserts that this Court should dismiss Plaintiff’s WCPA claim and 12 consistently hold to the Ninth Circuit’s decision in Grey v. Amazon.com Inc., 2024 WL 2206454 13 (9th Cir. May 16, 2024). There, plaintiffs alleged harm from using Alexa-enabled devices and 14 Amazon’s alleged misrepresentations of using Alexa voice recordings for targeted advertising 15 purposes. See gen. id. The Ninth Circuit affirmed the District Court’s ruling that the “plaintiffs 16 did not adequately allege causation for those [Amazon public] statements [that it was not using 17 voice recordings for targeted advertising] because they made no allegations that they ‘viewed or 18 heard any of those statements or were otherwise aware of them at the time they purchased their 19 Alexa-enabled devices or at any time prior to the filing of this lawsuit.’” Id. at *2. Defendant 20 argues that Plaintiff “was not even aware of what it now claims are ‘unfair or deceptive’ 21 statements until after the cyberattack” and cannot establish causation. Dkt. #36 at 16. 22 The Court finds that Plaintiff has sufficiently shown that that Defendant could provide 23 cybersecurity and presented this to Plaintiff and the public, which could deceive or mislead a 24 1 reasonable consumer. Unlike Grey, Plaintiff contends here that Defendant represented its up- to-snuff cybersecurity from the beginning, both to Plaintiff and the public, not that it learned of 2 Defendant’s cybersecurity after the cyberattack. As shown in the parties’ communications, 3 Defendant’s “One Global Platform,” its “Warehouse Management System” providing “‘real 4 time’ visibility . . . accurate up to the second[,]” E-mail deliveries, and the like were all included 5 as part of the contract distribution services. See Dkt. #37, Bailey Decl., Ex. A. As detailed above, 6 the parties have submitted competing evidence on whether cybersecurity was included in the 7 contract and how Defendant presented its cybersecurity capabilities to Plaintiff and the public. 8 Accordingly, the Court finds there are genuine disputes of material facts regarding this claim, 9 Plaintiff has made a “sufficient showing of essential elements” on this claim, and, drawing all 10 reasonable inferences in Plaintiff’s favor, Defendant is not entitled to judgment as a matter of 11 law. 12 3. Unjust Enrichment 13 Plaintiff argues that Defendant was unjustly enriched by refusing to pay the ransom 14 demanded by the cyber-attackers and, instead, “made the decision to shift the costs of not paying 15 the ransom to its customers[.]” Dkt. #60 at 7. Defendant contends that the parties’ relationship 16 is governed by a contract, and the supposed “savings” by refusing to pay the ransom do not 17 constitute a “benefit conferred” by Plaintiff on Defendant. Dkts. #36 at 10-12 and #76 at 1-3. 18 Unjust enrichment exists as a remedy where no contract exists, but a quasi-contract 19 implied in law “arises from an implied duty of the parties not based on a contract, or on any 20 consent or agreement.” Heaton v. Imus, 93 Wn.2d 249, 252 (1980). “Unjust enrichment is the 21 method of recovery for the value of the benefit retained absent any contractual relationship 22 because notions of fairness and justice require it.” Young v. Young, 164 Wn.2d 477, 484 (2008). 23 To establish a claim for unjust enrichment, a plaintiff must show that: (1) a benefit was conferred 24 1 on the defendant; (2) the defendant had knowledge or appreciation of the benefit; and (3) the defendant’s retainment of the benefit without payment of its value is inequitable under the 2 circumstances. Id. at 484-85. 3 Taking all reasonable inferences in Plaintiff’s favor, the parties dispute nevertheless 4 revolves around the terms of their contract and related actions. Moreover, the Court fails to see 5 how refusing to pay criminals a ransom for hijacking a service system constitutes Plaintiff 6 conferring a benefit on Defendant. Plaintiff cites to no cases to support the application of unjust 7 enrichment under these or comparative circumstances. See gen. Dkt. #60. Accordingly, the 8 Court will dismiss this claim. 9 IV. CONCLUSION 10 Having reviewed the instant Motion, responsive briefings, declarations, and the 11 remainder of the record, the Court hereby finds and ORDERS that Defendant’s Motion for 12 Summary Judgment, Dkt. #36, is GRANTED AND DENIED IN PART. Plaintiff’s unjust 13 enrichment claim is DISMISSED with prejudice. All other claims (for breach of contract, breach 14 of implied covenant of good faith and fair dealing, and Washington Consumer Protection Act 15 violations) REMAIN. 16 DATED this 6th day of June, 2025. 17 A 18 19 RICARDO S. MARTINEZ UNITED STATES DISTRICT JUDGE 20 21 22 23 24