Argued and Submitted December 10, 2021 San Francisco, California Before: MURGUIA, Chief Judge, and IKUTA and VANDYKE, Circuit Judges.

Defendant Yevgeniy Nikulin appeals a $1,734,000 restitution order and an 88-month sentence imposed following his convictions for various offenses based

* This disposition is not appropriate for publication and is not precedent except as provided by Ninth Circuit Rule 36-3. on computer intrusions affecting the companies LinkedIn, Formspring, and Dropbox. We have jurisdiction under 28 U.S.C. § 1291.

Even assuming plain error review applies, the district court plainly erred in awarding $1,734,000 in restitution based on the victims’ non-itemized, conclusory summaries of their loss in unsworn letters. See United States v. Waknine, 543 F.3d 546, 556–57 (9th Cir. 2008); United States v. Tsosie, 639 F.3d 1213, 1221–23 (9th Cir. 2011). Although trial testimony and logs submitted at trial showed the extent of the victims’ responses to the computer intrusions, that evidence did not provide a basis for determining the costs incurred by the victims in mounting those responses. Because neither the victims’ letters nor other evidence submitted by the government satisfied the requirement that the government provide “a complete accounting of the losses to each victim” to “the extent practicable,” 18 U.S.C. § 3664(a), or provide “evidence or proof that all costs incurred were directly related to” Nikulin’s offenses, Waknine, 543 F.3d at 556, the evidence was insufficient to support a restitution award, id.

The district court’s conservative estimate that the victims’ losses exceeded $550,000 based on evidence regarding the size of the victim companies, the nature of their responses to the computer intrusions, and their statements of costs associated with their responses, was a “reasonable estimate of loss, given the available information.” United States v. Tadios, 822 F.3d 501, 503 (9th Cir. 2016) (citation omitted). Therefore, the district court did not err in applying a 14-level sentencing enhancement under § 2B1.1 of the Guidelines. U.S.S.G. § 2B1.1. Because the district court’s conservative estimate was supported by clear and convincing evidence, any error in the district court’s standard of review was harmless. See United States v. Wijegoonaratna, 922 F.3d 983, 990–91 (9th Cir. 2019).

Finally, the district court did not err in admitting evidence that the owner of the [email protected] email address committed a fourth, uncharged computer intrusion against the company Automattic. The evidence was admissible under Rule 404(b) of the Federal Rules of Evidence to show identity, both because it tended to prove that the hacker in the charged offenses was the person who controlled [email protected], and because it tended to establish Nikulin’s distinctive modus operandi. See United States v. Romero, 282 F.3d 683, 688 (9th Cir. 2002). Because the district court addressed any prejudice from this evidence by giving a limiting jury instruction, the district court did not err in determining that the evidence’s probative value outweighed any potential prejudice. See Fed.

R. Evid. 403; Hayes v. Ayers, 632 F.3d 500, 514 (9th Cir. 2011).1

AFFIRMED in part; REVERSED in part.^[2]