Attorney For Plaintiff (Additional Counsel On Signature Page)
Attorney For Plaintiff (Additional Counsel On Signature Page)
1   POMERANTZ LLP
     Jennifer Pafiti (SBN 282790)
 2   1100 Glendon Avenue, 15th Floor
     Los Angeles, California 90024
 3
     Telephone: (310) 405-7190
 4   jpafiti@pomlaw.com
10
      MICHAEL DRIEU, Individually and On               Case No.
11    Behalf of All Others Similarly Situated,
                                                       CLASS ACTION
12                                        Plaintiff,
                                                       COMPLAINT FOR VIOLATIONS OF
13                                                     THE FEDERAL SECURITIES LAWS
                              v.
14
                                                       DEMAND FOR JURY TRIAL
15    ZOOM VIDEO COMMUNICATIONS,
      INC., ERIC S. YUAN, and KELLY
16    STECKELBERG,
17
                                        Defendants.
18
19
20
21
22
23
24
25
26
27
28
1 Plaintiff Michael Drieu (“Plaintiff”), individually and on behalf of all other persons
8 United States Securities and Exchange Commission (“SEC”) filings, wire and press releases
 9   published by and regarding Zoom Video Communications, Inc. (“Zoom” or the “Company”),
10   analysts’ reports and advisories about the Company, and information readily obtainable on the
11
     Internet. Plaintiff believes that substantial evidentiary support will exist for the allegations set
12
     forth herein after a reasonable opportunity for discovery.
13
                                        NATURE OF THE ACTION
14
15 1. This is a federal securities class action on behalf of a class consisting of all persons
16 other than Defendants who purchased or otherwise acquired Zoom securities between April 18,
17   2019 and April 6, 2020, both dates inclusive (the “Class Period”), seeking to recover damages
18   caused by Defendants’ violations of the federal securities laws and to pursue remedies under
19
     Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 (the “Exchange Act”) and Rule
20
     10b-5 promulgated thereunder, against the Company and certain of its top officials.
21
            2.      Zoom was founded in 2011 and is headquartered in San Jose, California. The
22
23 Company was formerly known as Zoom Communications, Inc. and changed its name to Zoom
1 The Company’s cloud-native platform enables face-to-face video experiences and connects users
 2   across various devices and locations in a single meeting. The Company serves education,
 3
     entertainment/media, enterprise infrastructure, finance, healthcare, manufacturing, non-profit/not
 4
     for profit and social impact, retail/consumer products, and software/Internet industries, as well as
 5
     individuals.
 6
            4.       On March 22, 2019, Zoom filed a registration statement on Form S-1 with the SEC
 7
8 in connection with its initial public offering (“IPO”), which, after several amendments, was
 9   declared effective by the SEC on April 17, 2019 (the “Registration Statement”).
10          5.       On April 18, 2019, Zoom filed a prospectus on Form 424B4 with the SEC in
11
     connection with its IPO, which purported to provide information necessary for investors to
12
     consider before partaking in its IPO and purchasing the Company’s newly publicly-issued stock
13
     (collectively with the Registration Statement, the “Offering Documents”).
14
15 6. That same day, Zoom conducted its IPO and began trading publicly on the Nasdaq
16 Global Select Market (“NASDAQ”) under the ticker symbol “ZM.” Pursuant to Zoom’s IPO, the
17   Company sold 9.91 million of the Company’s shares to the public at the offering price of $36.00
18   per share.
19
            7.       Throughout the Class Period, Defendants made materially false and misleading
20
     statements regarding the Company’s business, operational and compliance policies. Specifically,
21
     Defendants made false and/or misleading statements and/or failed to disclose that: (i) Zoom had
22
23 inadequate data privacy and security measures; (ii) contrary to Zoom’s assertions, the Company’s
24 video communications service was not end-to-end encrypted; (iii) as a result of all the foregoing,
25   users of Zoom’s communications services were at an increased risk of having their personal
26
     information accessed by unauthorized parties, including Facebook; (iv) usage of the Company’s
27
     video communications services was foreseeably likely to decline when the foregoing facts came
28
                                                      2
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                   Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 4 of 28
1 to light; and (v) as a result, the Company’s public statements were materially false and misleading
8 as governments increasingly implemented shelter-in-place orders, that the truth was more fully
 9   laid bare in a series of corrective disclosures. As it became clear through a series of news reports
10   and admissions by the Company that Zoom had significantly overstated the degree to which its
11
     video communication software was encrypted, and organizations consequently prohibited its
12
     employees from utilizing Zoom for work activities, the Company’s stock price plummeted,
13
     damaging investors.
14
15 9. As a result of Defendants’ wrongful acts and omissions, and the precipitous decline
16 in the market value of the Company’s securities, Plaintiff and other Class members have suffered
23 11. This Court has jurisdiction over the subject matter of this action pursuant to 28
25           12.      Venue is proper in this Judicial District pursuant to Section 27 of the Exchange Act
26
     (15 U.S.C. § 78aa) and 28 U.S.C. § 1391(b). Zoom is headquartered in this Judicial District,
27
28
                                                       3
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                   Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 5 of 28
1 Defendants conduct business in this Judicial District, and a significant portion of Defendants’
8 PARTIES
 9           14.      Plaintiff, as set forth in the attached Certification, acquired Zoom securities at
10   artificially inflated prices during the Class Period and was damaged upon the revelation of the
11
     alleged corrective disclosures.
12
             15.      Defendant Zoom is a Delaware corporation with principal executive offices located
13
     at 55 Almaden Boulevard, 6th Floor, San Jose, California 95113. Zoom securities trade in an
14
16 16. Defendant Eric S. Yuan (“Yuan”) has served as Zoom’s President and Chief
23 19. The Individual Defendants possessed the power and authority to control the
24 contents of Zoom’s SEC filings, press releases, and other market communications. The Individual
25   Defendants were provided with copies of Zoom’s SEC filings and press releases alleged herein to
26
     be misleading prior to or shortly after their issuance and had the ability and opportunity to prevent
27
     their issuance or to cause them to be corrected. Because of their positions with Zoom, and their
28
                                                        4
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                     Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 6 of 28
1 access to material information available to them but not to the public, the Individual Defendants
 2   knew that the adverse facts specified herein had not been disclosed to and were being concealed
 3
     from the public, and that the positive representations being made were then materially false and
 4
     misleading. The Individual Defendants are liable for the false statements and omissions pleaded
 5
     herein.
 6
               20.      Zoom and the Individual Defendants are sometimes collectively referred to herein
 7
8 as “Defendants.”
 9                                    SUBSTANTIVE ALLEGATIONS
10                                                Background
11
               21.      Zoom was founded in 2011 and is headquartered in San Jose, California. The
12
     Company was formerly known as Zoom Communications, Inc. and changed its name to Zoom
13
     Video Communications, Inc. in May 2012.
14
15 22. Zoom provides a video communications app that allows users to interact with each
16 other primarily in the Americas, the Asia Pacific, Europe, the Middle East, and Africa. Users may
17   connect through frictionless video, voice, chat, and content sharing. The Company’s cloud-native
18   platform enables face-to-face video experiences and connects users across various devices and
19
     locations in a single meeting. The Company serves education, entertainment/media, enterprise
20
     infrastructure, finance, healthcare, manufacturing, non-profit/not for profit and social impact,
21
     retail/consumer products, and software/Internet industries, as well as individuals.
22
23 23. On March 22, 2019, Zoom filed the Registration Statement on Form S-1 with the
24 SEC in connection with its IPO, which, after several amendments, was declared effective by the
27
28
                                                        5
               CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                     Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 7 of 28
1 24. On April 18, 2019, Zoom filed a prospectus on Form 424B4 with the SEC in
 2   connection with its IPO, which purported to provide information necessary for investors to
 3
     consider before partaking in its IPO and purchasing the Company’s newly publicly-issued stock.
 4
               25.      That same day, Zoom conducted its IPO and began trading publicly on the
 5
     NASDAQ under the ticker symbol “ZM.” Pursuant to Zoom’s IPO, the Company sold 9.91
 6
     million of the Company’s shares to the public at the offering price of $36.00 per share.
 7
8 Materially False and Misleading Statements Issued During the Class Period
 9             26.      The Class Period begins on April 18, 2019, when Zoom conducted its IPO and its
10   shares began publicly trading on the NASDAQ pursuant to the materially false or misleading
11
     statements or omissions contained in the Offering Documents. In the Offering Documents,
12
     Defendants touted that Zoom’s “unique technology and infrastructure enable [inter alia] best-in-
13
     class reliability,” and that Zoom “offer[s] robust security capabilities, including end-to-end
14
15 encryption, secure login, administrative controls and role-based access controls” (emphasis
16 added).
17             27.      Additionally, the Offering Documents touted that “[o]ne of the most important
18   features of [Zoom’s] platform is its broad interoperability with a range of diverse devices,
19
     operating systems and third-party applications”; that its “platform is accessible from the web and
20
     from devices running Windows, Mac OS, iOS, Android and Linux”; that the Company has
21
     “integrations with [inter alia] . . . a variety of other productivity, collaboration, data management
22
23 and security vendors”; and that the Company “provide[s], develop[s] and create[s] applications for
24 [its] platform partners that integrate[s] [its] platform with [its] partners’ various offerings.”
25             28.      The Offering Documents also touted that, as part of Zoom’s growth strategy, the
26
     Company “enable[s] developers to embed our platform into their own offerings through [inter alia]
27
28
                                                        6
               CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                  Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 8 of 28
1 . . . [its] cross-platform software development kits (SDKs),” such as those the Company used, or
8 empathy and trust”; and that Defendants “strive to live up to the trust our customers place in us by
15 concerning Zoom’s risks related to cybersecurity, data privacy, and hacking, noting that the
16 Company’s “security measures have on occasion, in the past, been, and may in the future be,
17   compromised”; that “[c]onsequently, our products and services may be perceived as not being
18   secure,” which “may result in customers and hosts curtailing or ceasing their use of our products,
19
     our incurring significant liabilities and our business being harmed”; and that “actual or perceived
20
     failure to comply with privacy, data protection and information security laws, regulations, and
21
     obligations could harm our business.” Plainly, the foregoing risk warnings were generic “catch-
22
23 all” provisions that were not tailored to Zoom’s actual known risks concerning weaknesses in its
25          32.      On June 7, 2019, Zoom filed its first Quarterly Report on Form 10-Q with the SEC
26
     following its IPO, reporting the Company’s financial and operating results for the quarter ended
27
     April 30, 2019 (the “1Q20 10-Q”). The 1Q20 10-Q contained substantively the same statements
28
                                                         7
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                   Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 9 of 28
1 referenced in ¶¶ 27 and 29-31, supra, touting the way Zoom interacts with various operating
 2   systems and third-party applications, the trust its platform builds with customers and users, and
 3
     the Company’s efforts relating to privacy, data protection and information security; and providing
 4
     generic “catch-all” provisions that were not tailored to Zoom’s actual known risks concerning
 5
     weaknesses in its cybersecurity and data protection systems.
 6
             33.      Appended as an exhibit to the 1Q20 10-Q were signed certifications pursuant to the
 7
8 Sarbanes-Oxley Act of 2002 (“SOX”), wherein the Individual Defendants certified that the 1Q20
 9   10-Q “fully complies with the requirements of Section 13(a) or 15(d) of the Securities Exchange
10   Act of 1934 and that information contained in [the 1Q20 10-Q] fairly presents, in all material
11
     respects, the financial condition and results of operations of Zoom.”
12
             34.      The statements referenced in ¶¶ 26-33 were materially false and misleading because
13
     Defendants made false and/or misleading statements, as well as failed to disclose material adverse
14
15 facts about the Company’s business, operational and compliance policies. Specifically,
16 Defendants made false and/or misleading statements and/or failed to disclose that: (i) Zoom had
17   inadequate data privacy and security measures; (ii) contrary to Zoom’s assertions, the Company’s
18   video communications service was not end-to-end encrypted; (iii) as a result of all the foregoing,
19
     users of Zoom’s communications services were at an increased risk of having their personal
20
     information accessed by unauthorized parties, including Facebook; (iv) usage of the Company’s
21
     video communications services was foreseeably likely to decline when the foregoing facts came
22
23 to light; and (v) as a result, the Company’s public statements were materially false and misleading
1 allegedly exposed a flaw allowing hackers to take over Zoom webcams. According to the article,
 2   “[a] vulnerability in the Mac Zoom Client allows any malicious website to enable your camera
 3
     without your permission,” and “[t]he flaw potentially exposes up to 750,000 companies around
 4
     the world that use Zoom to conduct day-to-day business.”
 5
            36.     On this news, Zoom’s stock price fell $1.12 per share, or 1.22%, to close at $90.76
 6
     per share on July 8, 2019.
 7
8 37. Then, on July 11, 2019, public interest research center the Electronic Privacy
 9   Information Center (“EPIC”) filed a complaint against Zoom before the U.S. Federal Trade
10   Commission (“FTC”), alleging that the Company “placed at risk the privacy and security of the
11
     users of its services,” that “Zoom intentionally designed their web conferencing service to bypass
12
     browser security settings and remotely enable a user’s web camera without the consent of the
13
     user,” and that, “[a]s a result, Zoom exposed users to the risk of remote surveillance, unwanted
14
15 videocalls, and denial-of-service attacks.” The complaint also alleged that “[w]hen informed of
16 the vulnerabilities Zoom did not act until the risks were made public, several months after the
17   matter was brought to the company’s attention,” that “Zoom exposed its users to a wide range of
18   harms, many of which are ongoing,” and that the Company’s “business practices amount to unfair
19
     and deceptive practices under Section 5 of the FTC Act, subject to investigation and injunction by
20
     the [FTC].”
21
            38.     On this news, Zoom’s stock fell $1.32 per share, or 1.42%, to close at $91.40 per
22
24 39. Following these disclosures, however, Zoom’s stock price continued to trade at
25   artificially inflated prices throughout the Class Period as a result of Defendants’ continued
26
     misrepresentations and omissions concerning Zoom’s data privacy and security mechanisms.
27
28
                                                     9
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 11 of 28
1 40. For example, on September 5, 2019, Zoom hosted an earnings call with investors
 2   and analysts to discuss the Company’s second quarter financial results. In responding to a question
 3
     regarding the Company’s technology and architecture, Defendant Yuan stated, in relevant part:
 4
            I think the combination of technology, ease-of-use, security will win the customer
 5          trust, right. If you look at all other solutions out there today, all of them architecture
            is very old, right? Not a design for modern video cloud -- video first architecture.
 6          That's why we're ahead of any of our competitors for several years. Otherwise, I
            will go back to work all the weekend.
 7
8 (Emphasis added.)
 9          41.     Then, on September 13, 2019, Zoom filed a Quarterly Report on Form 10-Q with
10   the SEC, reporting the Company’s financial and operating results for the quarter ended July 31,
11
     2019 (the “2Q20 10-Q”). The 2Q20 10-Q contained substantively the same statements referenced
12
     in ¶¶ 27, 29-31, and 33, supra, touting the way Zoom interacts with various operating systems and
13
     third-party applications, the trust its platform builds with customers and users, and the Company’s
14
15 efforts relating to privacy, data protection and information security; providing generic “catch-all”
16 provisions that were not tailored to Zoom’s actual known risks concerning weaknesses in its
17   cybersecurity and data protection systems; and containing SOX certifications signed by the
18   Individual Defendants attesting to the accuracy and reliability of the financial report those
19
     certifications were appended to as an exhibit.
20
            42.     Additionally, in the 2Q20 10-Q’s section dedicated to disclosing legal proceedings,
21
     Defendants asserted that “[w]e are not presently a party to any litigation the outcome of which, we
22
23 believe, if determined adversely to us, would individually or taken together have a material adverse
24 effect on our business, operating results, cash flows or financial condition,” even despite the fact
25   that legal proceedings had already been initiated by EPIC before the FTC on July 11, 2019,
26
     regarding Zoom’s inadequate privacy and security measures, and at-risk software.
27
28
                                                       10
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 12 of 28
1 43. On December 9, 2019, Zoom filed another Quarterly Report on Form 10-Q with
 2   the SEC, reporting the Company’s financial and operating results for the quarter ended October
 3
     31, 2019 (the “3Q20 10-Q”). The 3Q20 10-Q contained substantively the same statements
 4
     referenced in ¶¶ 27, 29-31, 33, and 42, supra, touting the way Zoom interacts with various
 5
     operating systems and third-party applications, the trust its platform builds with customers and
 6
     users, the Company’s efforts relating to privacy, data protection and information security, the lack
 7
8 of any legal proceedings likely to have a material adverse effect on the Company’s business,
 9   operating results, cash flows or financial condition; providing generic “catch-all” provisions that
10   were not tailored to Zoom’s actual known risks concerning weaknesses in its cybersecurity and
11
     data protection systems; and containing SOX certifications signed by the Individual Defendants
12
     attesting to the accuracy and reliability of the financial report those certifications were appended
13
     to as an exhibit.
14
15           44.     On March 4, 2020, Zoom hosted an earnings call with investors and analysts to
     discuss the Company’s fourth quarter financial results. On that call, and while discussing an
16
     example of the security and compliance that Zoom’s services ensured for its users, Defendant
17
     Yuan stated, in relevant part:
18
             I also want to thank VMware for trusting Zoom. VMware has been providing all
19           employees, globally, access to Zoom meetings and digital workspace, and will soon
             utilize a large deployment of Zoom Phone. The easy, single sign-on access to Zoom
20
             from any device is enabled to leverage the VMware Workspace ONE platform,
21           allowing employees to access all the applications they need from their device of
             choice while ensuring security and compliance.
22
     (Emphasis added.)
23
24 45. On March 20, 2020, six days before the truth fully emerged regarding Zoom’s
25 deficient security and privacy systems, Zoom filed its first Annual Report on Form 10-K with the
26   SEC since its IPO, reporting the Company’s financial and operating results for the quarter and year
27   ended January 31, 2020 (the “2020 10-K”). As with the Offering Documents, the 2020 10-K
28
                                                     11
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 13 of 28
1 touted that Zoom’s “unique technology and infrastructure enable [inter alia] best-in-class
 2   reliability.”
 3
             46.     The 2020 10-K also touted that the Company’s Zoom Video Webinars feature
 4
     “easily integrates with [inter alia] Facebook Live . . . providing access to large bases of viewers,”
 5
     without disclosing how integration with Facebook could implicate users’ personal data, if at all.
 6
             47.     Additionally, the 2020 10-K contained substantively the same statements
 7
8 referenced in ¶¶ 27-31, 33, and 42, supra, touting the way Zoom interacts with various operating
 9   systems and third-party applications, how the Company employed SDKs to partner with other
10   digital platforms and app providers, the trust its platform builds with customers and users, the
11
     Company’s efforts relating to privacy, data protection and information security, the lack of any
12
     legal proceedings likely to have a material adverse effect on the Company’s business, operating
13
     results, cash flows or financial condition; providing generic “catch-all” provisions that were not
14
15 tailored to Zoom’s actual known risks concerning weaknesses in its cybersecurity and data
16 protection systems; and containing SOX certifications signed by the Individual Defendants
17   attesting to the accuracy and reliability of the financial report those certifications were appended
18   to as an exhibit.
19
             48.     The statements referenced in ¶¶ 40-47 were materially false and misleading because
20
     Defendants made false and/or misleading statements, as well as failed to disclose material adverse
21
     facts about the Company’s business, operational and compliance policies.               Specifically,
22
23 Defendants made false and/or misleading statements and/or failed to disclose that: (i) Zoom had
24 inadequate data privacy and security measures; (ii) contrary to Zoom’s assertions, the Company’s
25   video communications service was not end-to-end encrypted; (iii) as a result of all the foregoing,
26
     users of Zoom’s communications services were at an increased risk of having their personal
27
     information accessed by unauthorized parties, including Facebook; (iv) usage of the Company’s
28
                                                      12
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 14 of 28
1 video communications services was foreseeably likely to decline when the foregoing facts came
 2   to light; and (v) as a result, the Company’s public statements were materially false and misleading
 3
     at all relevant times.
 4
                                        The Truth Fully Emerges
 5
             49.     On March 26, 2020—in the midst of the COVID-19 pandemic and shelter-in-place
 6
     orders from multiple national and local governments, as businesses increasingly turned to Zoom’s
 7
8 video communication software to facilitate remote work activity —Motherboard, Vice Media’s
 9   technology news subsegment, reported that Zoom’s “privacy policy do[es] [not] make clear . . .
10   that the iOS version of the Zoom app is sending some analytics data to Facebook, even if Zoom
11
     users don’t have a Facebook account,” and that “Zoom is not forthcoming with the data collection
12
     or the transfer of it to Facebook.” The article also alleged that “[t]he Zoom app notifies Facebook
13
     when the user opens the app, [and provides] details on the user’s device such as the model, the
14
15 time zone and city they are connecting from, which phone carrier they are using, and a unique
16 advertiser identifier created by the user's device which companies can use to target a user with
17   advertisements.” The article also disclosed that “[s]everal days after Motherboard reached out for
18   comment and a day after the publication of this piece, Zoom confirmed the data collection in a
19
     statement to Motherboard.”
20
             50.     Then, on March 27, 2020, Zoom issued a statement by Defendant Yuan, disclosing
21
     “a change that [Defendants] have made regarding the use of Facebook’s SDK” after being “made
22
23 aware on Wednesday, March 25, 2020, that the Facebook SDK was collecting device information
24 unnecessary for us to provide our services.” Yuan admitted that “[t]he information collected by
25   the Facebook SDK did not include information and activities related to meetings such as attendees,
26
     names, notes, etc., but rather included information about devices such as the mobile OS type and
27
     version, the device time zone, device OS, device model and carrier, screen size, processor cores,
28
                                                     13
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 15 of 28
1 and disk space,” and that, “therefore [Defendants] decided to remove the Facebook SDK in [the]
 2   iOS client and have reconfigured the feature so that users will still be able to log in with Facebook
 3
     via their browser.”    Yuan also promised that Defendants “remain firmly committed to the
 4
     protection of our users’ privacy,” and that Defendants were “reviewing our process and protocols
 5
     for implementing these features in the future to ensure this does not happen again.”
 6
            51.     The next trading day, on March 30, 2020, the New York Times reported that Zoom
 7
8 is under scrutiny by the office of New York State Attorney General (“AG”), Letitia James
 9   (“James”), “for its data privacy and security practices.” According to the article, James’s “office
10   sent Zoom a letter asking what, if any, new security measures the company has put in place to
11
     handle increased traffic on its network and to detect hackers” in light of the recent COVID-19
12
     pandemic. Specifically, the article, quoted James, who is “concerned that Zoom’s existing security
13
     practices might not be sufficient to adapt to the recent and sudden surge in both the volume and
14
15 sensitivity of data being passed through its network,” and that, “[w]hile Zoom has remediated
16 specific reported security vulnerabilities, [the office] would like to understand whether Zoom has
23 noted other concerns cited by James’s office, including how “the [Zoom] app may be
24 circumventing state requirements protecting student data.” According to the article, “some
25   children’s privacy experts and parents said they were particularly concerned about how children’s
26
     personal details might be used,” and “[s]ome districts have prohibited educators from using Zoom
27
     as a distance-learning platform.” The article also stated that, “[o]ver the last few weeks, internet
28
                                                      14
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 16 of 28
1 trolls have exploited a Zoom screen-sharing feature to hijack meetings and do things like interrupt
8 information when users install or open the Zoom application and shares it, without proper notice,
 9   to third parties including Facebook Inc.,” that “Zoom’s privacy policy doesn’t explain to users that
10   its app contains code that discloses information to Facebook and potentially other third parties,”
11
     and that the Company’s “wholly inadequate program design and security measures have resulted,
12
     and will continue to result, in unauthorized disclosure of its users’ personal information.”
13
            54.     Then, on March 31, 2020, the Federal Bureau of Investigation (“FBI”) reportedly
14
15 issued a warning about so-called “Zoom-bombing,” the phenomenon identified by the New York
16 Times where hackers can take over video-conferencing on the Company’s app.
17          55.     Additionally, that same day, multiple news sources, including The Intercept and
18   The Verge, reported that Zoom’s video conferencing software is not, in fact, end-to-end encrypted
19
     between meeting participants, contrary to the Company’s assertions, and that Zoom was actually
20
     “using its own definition of the term, one that lets Zoom itself access unencrypted video and audio
21
     from meetings.” Specifically, The Intercept article noted that, “despite this misleading marketing,
22
23 the service actually does not support end-to-end encryption for video and audio content, at least as
24 the term is commonly understood,” and it “[i]nstead it offers what is usually called transport
25   encryption,” which is less secure. The article disclosed that after The Intercept reached out to
26
     Zoom for a comment about whether video meetings are actually end-to-end encrypted, a Zoom
27
     spokesperson wrote that, “[c]urrently, it is not possible to enable E2E [end-to-end] encryption for
28
                                                     15
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 17 of 28
1 Zoom video meetings,” and that Zoom video meetings use the same encryption methods offered
 2   by web servers to secure certain websites. As noted by The Intercept article, this is known as
 3
     transport encryption, “which is different from end-to-end encryption because the Zoom service
 4
     itself can access the unencrypted video and audio content of Zoom meetings.”
 5
            56.     Then, on April 1, 2020, during after-market hours, Reuters reported that Space
 6
     Exploration Technologies Corp. (“SpaceX”) had banned its employees from using Zoom’s video
 7
8 conferencing software because of “significant privacy and security concerns,” citing an internal
 9   memo reviewed by Reuters following the FBI’s warning regarding “Zoombombing.” According
10   to Reuters, the National Aeronautics and Space Administration (NASA), one of SpaceX’s largest
11
     customers, also decided to ban employee use of Zoom’s app.
12
            57.     That same day, Defendant Yuan published a blog post entitled, “A Message to Our
13
     Users.” In the post, Defendant Yuan admitted that “[the Company] recognize[s] that we have
14
15 fallen short of the community’s – and our own – privacy and security expectations.”
16 58. Between March 27, 2020, and April 2, 2020, Zoom’s stock price fell $29.77 per
23 has been addressing privacy issues.” Specifically, the article disclosed that Defendant “Yuan . . .
24 made $10.5 million in sales on Jan[uary] 14, another $12.5 million on Feb[ruary] 12, and $15.5
25   million on March 16,” while “Chief Marketing Officer Janine Pelosi has made close to $14 million
26
     in trades since February.”
27
28
                                                     16
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                 Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 18 of 28
1 60. That same day, Connecticut AG William Tong (“Tong”) announced his own
 2   office’s investigation into Zoom’s privacy and security practices. In a statement to Politico, Tong
 3
     stated: "We are alarmed by the Zoom-bombing incidents and are seeking more information from
 4
     the company about its privacy and security measures in coordination with other state attorneys
 5
     general.”
 6
            61.     Also on April 3, 2020, Citizen Lab, an interdisciplinary laboratory based at the
 7
8 Munk School of Global Affairs & Public Policy at the University of Toronto, published a report
 9   “examin[ing] the encryption that protects meetings in the popular Zoom teleconference app.”
10   Citizen Lab found that Zoom has “rolled their own” (i.e., built its own) encryption scheme, “which
11
     has significant weaknesses,” and “identif[ied] potential areas of concern in Zoom’s infrastructure,
12
     including observing the transmission of meeting encryption keys through China.”
13
            62.     Later that day, during after-market hours, Zoom reportedly confirmed that, during
14
15 its efforts to ramp up its server capacity to accommodate the massive influx of users over the past
16 few weeks amid the COVID-19 pandemic, it “mistakenly” allowed two of its Chinese data centers
17   to accept calls as a backup in the event of network congestion. According to Defendant Yuan,
18   “[d]uring normal operations, Zoom clients attempt to connect to a series of primary datacenters in
19
     or near a user’s region, and if those multiple connection attempts fail due to network congestion
20
     or other issues, clients will reach out to two secondary datacenters off of a list of several secondary
21
     datacenters as a potential backup bridge to the Zoom platform.”
22
23 63. Then, over the weekend, on April 4, 2020, the Wall Street Journal reported that, in
24 an interview with Defendant Yuan, Yuan had stated that “[i]f we mess up again, it’s done,” in
25   discussing the mounting privacy issues Zoom was facing, and that “I really messed up as CEO”
26
     and “[t]his kind of thing shouldn’t have happened.”
27
28
                                                       17
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 19 of 28
1 64. On April 6, 2020, the following trading day, New York City’s Department of
 2   Education announced that it had banned the use of Zoom in the city’s classrooms, and the city’s
 3
     mayor, Bill de Blasio disclosed that there had “been an effort by the Department of Education to
 4
     work with that company to ensure the privacy of our students to make sure their information could
 5
     not be accessed wrongly,” but that “[t]he chancellor and the team at the Department of Education
 6
     do not believe the company has cooperated.” Consequently, the city’s Department of Education
 7
8 instead recommended Google or Microsoft Teams for classroom communications purposes amid
15 that “these links included email addresses, passwords, meeting IDs, host keys and names, and the
16 type of Zoom account”; that, according to Sixgill, “one belonged to a major U.S. healthcare
17   provider, seven more to various educational institutions, and one to a small business”; that “[t]he
18   accounts were listed for anyone to download, with the intent to troll and disrupt rather than profit”;
19
     and that, “given that many are using Zoom for business purposes, confidential information could
20
     be compromised.”
21
            66.     Following these additional disclosures and news, Zoom’s stock price fell $5.26 per
22
24 67. As a result of Defendants’ wrongful acts and omissions, and the precipitous decline
25   in the market value of the Company’s securities, Plaintiff and other Class members have suffered
26
     significant losses and damages.
27
28
                                                      18
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 20 of 28
 2           68.      Plaintiff brings this action as a class action pursuant to Federal Rule of Civil
 3
     Procedure 23(a) and (b)(3) on behalf of a Class, consisting of all those who purchased or otherwise
 4
     acquired Zoom securities during the Class Period (the “Class”); and were damaged upon the
 5
     revelation of the alleged corrective disclosures. Excluded from the Class are Defendants herein,
 6
     the officers and directors of the Company, at all relevant times, members of their immediate
 7
8 families and their legal representatives, heirs, successors or assigns and any entity in which
15 thousands of members in the proposed Class. Record owners and other members of the Class may
16 be identified from records maintained by Zoom or its transfer agent and may be notified of the
17   pendency of this action by mail, using the form of notice similar to that customarily used in
18   securities class actions.
19
             70.      Plaintiff’s claims are typical of the claims of the members of the Class as all
20
     members of the Class are similarly affected by Defendants’ wrongful conduct in violation of
21
     federal law that is complained of herein.
22
23 71. Plaintiff will fairly and adequately protect the interests of the members of the Class
24 and has retained counsel competent and experienced in class and securities litigation. Plaintiff has
27
28
                                                       19
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 21 of 28
1 72. Common questions of law and fact exist as to all members of the Class and
 2   predominate over any questions solely affecting individual members of the Class. Among the
 3
     questions of law and fact common to the Class are:
 4
                  •     whether the federal securities laws were violated by Defendants’ acts as alleged
 5                      herein;
 6                •     whether statements made by Defendants to the investing public during the Class
 7                      Period misrepresented material facts about the business, operations and
                        management of Zoom;
 8
                  •     whether the Individual Defendants caused Zoom to issue false and misleading
 9                      financial statements during the Class Period;
10
                  •     whether Defendants acted knowingly or recklessly in issuing false and misleading
11                      financial statements;
12                •     whether the prices of Zoom securities during the Class Period were artificially
                        inflated because of the Defendants’ conduct complained of herein; and
13
14                •     whether the members of the Class have sustained damages and, if so, what is the
                        proper measure of damages.
15
            73.       A class action is superior to all other available methods for the fair and efficient
16
     adjudication of this controversy since joinder of all members is impracticable. Furthermore, as the
17
18 damages suffered by individual Class members may be relatively small, the expense and burden
19   of individual litigation make it impossible for members of the Class to individually redress the
20   wrongs done to them. There will be no difficulty in the management of this action as a class action.
21
            74.       Plaintiff will rely, in part, upon the presumption of reliance established by the fraud-
22
     on-the-market doctrine in that:
23
                  •     Defendants made public misrepresentations or failed to disclose material facts
24                      during the Class Period;
25
                  •     the omissions and misrepresentations were material;
26
                  •     Zoom securities are traded in an efficient market;
27
28
                                                        20
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 22 of 28
 1                 •     the Company’s shares were liquid and traded with moderate to heavy volume
                         during the Class Period;
 2
3 • the Company traded on the NASDAQ and was covered by multiple analysts;
11 76. Alternatively, Plaintiff and the members of the Class are entitled to the presumption
12   of reliance established by the Supreme Court in Affiliated Ute Citizens of the State of Utah v.
13   United States, 406 U.S. 128, 92 S. Ct. 2430 (1972), as Defendants omitted material information in
14
     their Class Period statements in violation of a duty to disclose such information, as detailed above.
15
                                                    COUNT I
16
     (Violations of Section 10(b) of the Exchange Act and Rule 10b-5 Promulgated Thereunder
17                                      Against All Defendants)
18
             77.       Plaintiff repeats and re-alleges each and every allegation contained above as if fully
19
     set forth herein.
20
             78.       This Count is asserted against Defendants and is based upon Section 10(b) of the
21
22 Exchange Act, 15 U.S.C. § 78j(b), and Rule 10b-5 promulgated thereunder by the SEC.
23 79. During the Class Period, Defendants engaged in a plan, scheme, conspiracy and
24   course of conduct, pursuant to which they knowingly or recklessly engaged in acts, transactions,
25
     practices and courses of business which operated as a fraud and deceit upon Plaintiff and the other
26
     members of the Class; made various untrue statements of material facts and omitted to state
27
     material facts necessary in order to make the statements made, in light of the circumstances under
28
                                                        21
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
               Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 23 of 28
1 which they were made, not misleading; and employed devices, schemes and artifices to defraud in
 2   connection with the purchase and sale of securities. Such scheme was intended to, and, throughout
 3
     the Class Period, did: (i) deceive the investing public, including Plaintiff and other Class members,
 4
     as alleged herein; (ii) artificially inflate and maintain the market price of Zoom securities; and (iii)
 5
     cause Plaintiff and other members of the Class to purchase or otherwise acquire Zoom securities
 6
     and options at artificially inflated prices. In furtherance of this unlawful scheme, plan and course
 7
8 of conduct, Defendants, and each of them, took the actions set forth herein.
 9          80.     Pursuant to the above plan, scheme, conspiracy and course of conduct, each of the
10   Defendants participated directly or indirectly in the preparation and/or issuance of the quarterly
11
     and annual reports, SEC filings, press releases and other statements and documents described
12
     above, including statements made to securities analysts and the media that were designed to
13
     influence the market for Zoom securities. Such reports, filings, releases and statements were
14
15 materially false and misleading in that they failed to disclose material adverse information and
17          81.       By virtue of their positions at Zoom, Defendants had actual knowledge of the
18   materially false and misleading statements and material omissions alleged herein and intended
19
     thereby to deceive Plaintiff and the other members of the Class, or, in the alternative, Defendants
20
     acted with reckless disregard for the truth in that they failed or refused to ascertain and disclose
21
     such facts as would reveal the materially false and misleading nature of the statements made,
22
23 although such facts were readily available to Defendants. Said acts and omissions of Defendants
24 were committed willfully or with reckless disregard for the truth. In addition, each Defendant
25   knew or recklessly disregarded that material facts were being misrepresented or omitted as
26
     described above.
27
28
                                                       22
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 24 of 28
1 82. Information showing that Defendants acted knowingly or with reckless disregard
 2   for the truth is peculiarly within Defendants’ knowledge and control. As the senior managers
 3
     and/or directors of Zoom, the Individual Defendants had knowledge of the details of Zoom’s
 4
     internal affairs.
 5
             83.     The Individual Defendants are liable both directly and indirectly for the wrongs
 6
     complained of herein.      Because of their positions of control and authority, the Individual
 7
8 Defendants were able to and did, directly or indirectly, control the content of the statements of
 9   Zoom. As officers and/or directors of a publicly-held company, the Individual Defendants had a
10   duty to disseminate timely, accurate, and truthful information with respect to Zoom’s businesses,
11
     operations, future financial condition and future prospects. As a result of the dissemination of the
12
     aforementioned false and misleading reports, releases and public statements, the market price of
13
     Zoom securities was artificially inflated throughout the Class Period. In ignorance of the adverse
14
15 facts concerning Zoom’s business and financial condition which were concealed by Defendants,
16 Plaintiff and the other members of the Class purchased or otherwise acquired Zoom securities at
17   artificially inflated prices and relied upon the price of the securities, the integrity of the market for
18   the securities and/or upon statements disseminated by Defendants, and were damaged thereby.
19
             84.     During the Class Period, Zoom securities were traded on an active and efficient
20
     market. Plaintiff and the other members of the Class, relying on the materially false and misleading
21
     statements described herein, which the Defendants made, issued or caused to be disseminated, or
22
23 relying upon the integrity of the market, purchased or otherwise acquired shares of Zoom securities
24 at prices artificially inflated by Defendants’ wrongful conduct. Had Plaintiff and the other
25   members of the Class known the truth, they would not have purchased or otherwise acquired said
26
     securities, or would not have purchased or otherwise acquired them at the inflated prices that were
27
     paid. At the time of the purchases and/or acquisitions by Plaintiff and the Class, the true value of
28
                                                        23
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                 Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 25 of 28
1 Zoom securities was substantially lower than the prices paid by Plaintiff and the other members of
 2   the Class. The market price of Zoom securities declined sharply upon public disclosure of the
 3
     facts alleged herein to the injury of Plaintiff and Class members.
 4
               85.   By reason of the conduct alleged herein, Defendants knowingly or recklessly,
 5
     directly or indirectly, have violated Section 10(b) of the Exchange Act and Rule 10b-5
 6
     promulgated thereunder.
 7
8 86. As a direct and proximate result of Defendants’ wrongful conduct, Plaintiff and the
 9   other members of the Class suffered damages in connection with their respective purchases,
10   acquisitions and sales of the Company’s securities during the Class Period, upon the disclosure
11
     that the Company had been disseminating misrepresented financial statements to the investing
12
     public.
13
                                                 COUNT II
14
15 (Violations of Section 20(a) of the Exchange Act Against The Individual Defendants)
16 87. Plaintiff repeats and re-alleges each and every allegation contained in the foregoing
24 Defendants had a duty to disseminate accurate and truthful information with respect to Zoom’s
25   financial condition and results of operations, and to correct promptly any public statements issued
26
     by Zoom which had become materially false or misleading.
27
28
                                                      24
               CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                 Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 26 of 28
1 90. Because of their positions of control and authority as senior officers, the Individual
 2   Defendants were able to, and did, control the contents of the various reports, press releases and
 3
     public filings which Zoom disseminated in the marketplace during the Class Period concerning
 4
     Zoom’s results of operations. Throughout the Class Period, the Individual Defendants exercised
 5
     their power and authority to cause Zoom to engage in the wrongful acts complained of herein. The
 6
     Individual Defendants therefore, were “controlling persons” of Zoom within the meaning of
 7
8 Section 20(a) of the Exchange Act. In this capacity, they participated in the unlawful conduct
15 Defendants exercised control over the general operations of Zoom and possessed the power to
16 control the specific activities which comprise the primary violations about which Plaintiff and the
23 A. Determining that the instant action may be maintained as a class action under Rule
24 23 of the Federal Rules of Civil Procedure, and certifying Plaintiff as the Class representative;
25          B.      Requiring Defendants to pay damages sustained by Plaintiff and the Class by reason
26
     of the acts and transactions alleged herein;
27
28
                                                     25
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
                 Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 27 of 28
1 C. Awarding Plaintiff and the other members of the Class prejudgment and post-
 2   judgment interest, as well as their reasonable attorneys’ fees, expert fees and other costs; and
 3
            D.      Awarding such other and further relief as this Court may deem just and proper.
 4
                                    DEMAND FOR TRIAL BY JURY
 5
            Plaintiff hereby demands a trial by jury.
 6
     Dated: April 7, 2020
 7
                                                             Respectfully submitted,
 8
 9                                                           POMERANTZ LLP
10
                                                             /s/ Jennifer Pafiti
11                                                           Jennifer Pafiti (SBN 282790)
                                                             1100 Glendon Avenue, 15th Floor
12                                                           Los Angeles, California 90024
13                                                           Telephone: (310) 405-7190
                                                             E-mail: jpafiti@pomlaw.com
14
                                                             POMERANTZ LLP
15                                                           Jeremy A. Lieberman
                                                             (pro hac vice application forthcoming)
16
                                                             J. Alexander Hood II
17                                                           (pro hac vice application forthcoming)
                                                             600 Third Avenue, 20th Floor
18                                                           New York, New York 10016
                                                             Telephone: (212) 661-1100
19                                                           Facsimile: (212) 661-8665
                                                             Email: jalieberman@pomlaw.com
20
                                                             Email: ahood@pomlaw.com
21
                                                             POMERANTZ LLP
22                                                           Patrick V. Dahlstrom
                                                             (pro hac vice application forthcoming)
23                                                           10 South La Salle Street, Suite 3505
                                                             Chicago, Illinois 60603
24
                                                             Telephone: (312) 377-1181
25                                                           Facsimile: (312) 377-1184
                                                             Email: pdahlstrom@pomlaw.com
26
                                                             BRONSTEIN, GEWIRTZ
27                                                           & GROSSMAN, LLC
28                                                           Peretz Bronstein
                                                             (pro hac vice application forthcoming)
                                                        26
             CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS
      Case 5:20-cv-02353-JD Document 1 Filed 04/07/20 Page 28 of 28
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
                                     27
     CLASS ACTION COMPLAINT FOR VIOLATIONS OF THE FEDERAL SECURITIES LAWS