PayPal Beats Class Claims by Investors Over 2017 Data Breach

PayPal Holdings Inc. investors lost, for good this time, a class suit alleging the online payments firm knowingly misled them about a subsidiary’s 2017 data breach, a California federal judge ruled.

Although investors plausibly alleged PayPal misled them about when the breach occurred, they haven’t shown that the company and its executives had a guilty state of mind, the U.S. District Court for the Northern District of California said. The court previously gave investors a chance to amend their complaint but dismissed the suit with prejudice Sept. 18.

The 2017 breach exposed the personal data of about 1.6 million customers of PayPal subsidiary TIO Networks Corp. PayPal initially told investors it had discovered a vulnerability, but didn’t disclose the actual breach for another month. The investors sufficiently alleged that PayPal knew about the breach when it gave a misleading warning about potential security issues, Judge Edward M. Chen’s opinion said.

But the investors still weren’t able to show that PayPal knew the breach affected 1.6 million customers when the company made its first statement, the opinion said. Although the investors provided statements from confidential witnesses who were PayPal employees at the time, the statements didn’t credibly support allegations the company and its executives knew the full extent of the breach when they warned of potential vulnerabilities, Chen said.

The investors also hired a cybersecurity expert to provide an opinion on what PayPal probably knew and when. But the investors didn’t allege that the expert was familiar with PayPal’s specific security setup or that he actually talked to PayPal employees about the breach, the opinion said. All the expert appears to have done was infer “what likely would have happened in the event of any breach,” Chen said.

Orrick, Herrington & Sutcliffe LLP represented PayPal. The Rosen Law Firm P.A. and Pomerantz LLP represented the class.

The case is Sgarlata v. PayPal Holdings Inc., N.D. Cal., No. 17-cv-06956, dismissed with prejudice 9/18/19.