Flores v. Aon Corp.

242 N.E.3d 340

2023 IL App (1st) 230140

Maria FLORES, Deanna Dube, Misty Williams, and Sharon Rushing, Plaintiffs-Appellants,

v.AON CORPORATION, Defendant-Appellee.

No. 1-23-0140

Appellate Court of Illinois, First District, FIFTH DIVISION.

Filed September 29, 2023

Appeal from the Circuit Court of Cook County. No. 2022 CH 6132, Honorable Neil H. Cohen, Judge presiding.

Kenneth A. Wexler, Bethany R. Turke, and Eaghan S. Davis, of Wexler Boley & Elgersma LLP, and Gary M. Klinger, of Milberg Coleman Bryson Phillips Grossman, PLLC, both of Chicago, Raina C. Borrelli, Samuel J. Strauss (pro hac vice), Brittany Resch (pro hac vice), and Alex Phillips (pro hac vice), of Turke & Strauss LLP, of Madison, Wisconsin, Joseph M. Lyon, of Lyon Law Firm, LLC, and Terence R. Coates (pro hac vice), of Markovits, Stock & Demarco, LLC, both of Cincinnati, Ohio, Bryan L. Bleichner (pro hac vice), of Chestnut Cambronne PA, of Minneapolis, Minnesota, Patrick N. Keegan (pro hac vice), of Keegan & Baker, LLP, of Carlsbad, California, and Ryan A. Stygar (pro hac vice), of Centurion Trial Attorneys, APC, of San Diego, California, for appellants.

Craig C. Martin, LaRue L. Robinson, Mengjie Zou, Bianca L. Valdez, and Elizabeth P. Astrup, of Willkie Farr & Gallagher LLP, of Chicago, for appellee.

OPINION

PRESIDING JUSTICE MITCHELL delivered the judgment of the court, with opinion.

¶ 1 Plaintiffs Maria Flores, Deanna Dube, Misty Williams, and Sharon Rushing appeal the dismissal of their class action complaint in this data breach case against defendant Aon Corporation. Plaintiffs raise a number of issues on appeal, chief among them are as follows: (1) did the circuit court err in dismissing plaintiffs’ complaint for lack of standing (735 ILCS 5/2-619(a)(9) (West 2022)); (2) did the circuit court err in dismissing plaintiffs’ claims for negligence, negligence per se, breach of implied contract, unjust enrichment, a violation of Illinois’s Consumer Fraud and Deceptive Business Practices Act (Consumer Fraud Act) (815 ILCS 505/1 et seq. (West 2022)), a violation of the Florida Deceptive and Unfair Trade Practices Act (Fla. Stat. § 501.201 et seq. (2022)), and invasion of privacy for failure to state a claim (735 ILCS 5/2-615 (West 2022)); and (3) did the circuit court err in dismissing plaintiffs’ claims for economic loss under the Moorman doctrine? See Moorman Manufacturing Co. v. National Tank Co., 91 Ill. 2d 69, 61 Ill.Dec. 746, 435 N.E.2d 443 (1982). For the reasons below, we affirm in part and reverse in part.

¶ 2 I. BACKGROUND

¶ 3 Defendant is a global professional services company headquartered in Chicago that provides a wide range of services, including cybersecurity services, to its commercial clients. In February 2022, defendant discovered that an unauthorized third party had been repeatedly accessing some of defendant’s systems since late December 2020. Defendant prevented any further unauthorized access, conducted an investigation concerning the data breach, and informed law enforcement of the incident.

¶ 4 Plaintiffs Flores, Rushing, Williams and Dube allege that they provided defendant with their personal information, including their names, social security numbers, dates of birth, e-mail addresses, and benefit-enrollment information. Flores and Williams provided their personal information to defendant because defendant managed the employee benefits program offered by their employers, while Rushing provided defendant with her personal information because she was formerly employed by defendant. Dube does not specify why she provided her personal information to defendant. Plaintiffs all reside in different states, with Flores being a resident of Illinois, Williams being a resident of Florida, Rushing being a resident of Texas, and Dube being a resident of Nevada.

¶ 5 Three months after the data breach was discovered, defendant sent a notice letter to everyone who was potentially impacted by the data breach. Plaintiffs all received this notice sometime in June 2022. The notice letter stated that an unauthorized third party had access to some of defendant’s systems between December 2020 and February 2022 and that the unauthorized third party therefore had access to plaintiffs’ personal information, including their names, social security numbers, driver’s license numbers, and benefit enrollment information.

¶ 6 In June 2022, Flores filed a class action complaint against defendant. Flores later filed an amended class action complaint to add Dube, Rushing, and Williams as plaintiffs. Plaintiffs stated claims of relief for negligence, negligence per se, breach of implied contract, unjust enrichment, violation of Illinois’s Consumer Fraud Act, violation of the Florida Deceptive and Unfair Trade Practices Act, and invasion of privacy.

¶ 7 All plaintiffs alleged that they suffered actual injury in the form of (1) damages to and diminution in the value of their personal information; (2) lost time, annoyance, interference, and inconvenience dealing with the consequences of the data breach; and (3) anxiety and increased concerns for the loss of their privacy due to the data breach. Plaintiffs also alleged that they suffered imminent and impending injury arising from the substantially increased risk of fraud and identity theft by unauthorized third parties due to the data breach. Additionally, Flores, Rushing, and Williams alleged that they have received increased spam and targeted marketing after the data breach occurred and that the increase in spam was caused by the data breach. After the data breach occurred, Williams alleged that she experienced an attempt to process a $499.99 charge to her PayPal account, while Dube alleged that she was charged for a prescription from Express Scripts that she did not order.

¶ 8 Defendant moved to dismiss plaintiffs’ first amended class action complaint for lack of standing (735 ILCS 5/2-619(a)(9) (West 2022)) and failure to state a claim upon which relief can be granted (id. § 2-615). The circuit court granted defendant’s motion and dismissed plaintiffs’ complaint in its entirety. This timely appeal followed. Ill. S. Ct. R. 303 (eff. July 1, 2017).

¶ 9 II. ANALYSIS

¶ 10 A. Standing

¶ 11 Plaintiffs argue that the circuit court erred in dismissing their complaint due to lack of standing. They contend that they have demonstrated an injury-in-fact due to their allegations concerning (1) their imminent risk of future identity theft or fraud, (2) the unauthorized charges experienced by Williams and Dube, (3) the diminishment in the value of plaintiffs’ personal information, (4) their emotional distress due to the data breach, and (5) the lost time they have spent responding to the data breach, including the increased number of spam and targeted marketing messages they have received. Defendant argues that none of these allegations are sufficient to establish injury-in-fact for standing purposes and that plaintiffs have not adequately established a connection between the data breach and the unauthorized charges experienced by Williams and Dube.

[1–4] ¶ 12 A motion to dismiss pursuant to section 2-619 of the Code of Civil Procedure (735 ILCS 5/2-619 (West 2022)) admits the legal sufficiency of the complaint, but raises defects, defenses, or some other affirmative matter that defeats the plaintiff’s claim. Ball v. County of Cook, 385 Ill. App. 3d 103, 107, 324 Ill.Dec. 548, 896 N.E.2d 334 (2008). The phrase "affirmative matter" encompasses any defense other than a negation of the essential allegations of the plaintiff’s cause of action. Piser v. State Farm Mutual Automobile Insurance Co., 405 Ill. App. 3d 341, 344, 345 Ill.Dec. 201, 938 N.E.2d 640 (2010). A defendant may properly raise lack of standing in a motion to dismiss brought under section 2-619(a)(9). 735 ILCS 5/2-619(a)(9) (West 2022); Glisson v. City of Marion, 188 Ill. 2d 211, 220, 242 Ill.Dec. 79, 720 N.E.2d 1034 (1999). We review a dismissal under section 2-619 de novo. Glisson, 188 Ill. 2d at 220-21, 242 Ill.Dec. 79, 720 N.E.2d 1034.

[5–10] ¶ 13 Under Illinois law, to have standing to bring a claim a plaintiff must only demonstrate "some injury in fact to a legally cognizable interest." Messenger v. Edgar, 157 Ill. 2d 162, 170, 191 Ill.Dec. 65, 623 N.E.2d 310 (1993). "The claimed injury must be (1) distinct and palpable; (2) fairly traceable to defendant’s actions; and (3) substantially likely to be prevented or redressed by the grant of the requested relief." Wexler v. Wirtz Corp., 211 Ill. 2d 18, 23, 284 Ill.Dec. 294, 809 N.E.2d 1240 (2004). The claimed injury can be actual or threatened. Greer v. Illinois Housing Development Authority, 122 Ill. 2d 462, 492, 120 Ill.Dec. 531, 524 N.E.2d 561 (1988). Illinois courts are generally more willing than federal courts to recognize standing on the part of any person "who shows that he is in fact aggrieved." Id. at 491, 120 Ill.Dec. 531, 524 N.E.2d 561. While a court’s determination of whether a plaintiff has standing depends on the allegations in the complaint, the plaintiff's lack of standing is an affirmative defense and therefore must be proven by the defendant. Maglio v. Advocate Health & Hospitals Corp., 2015 IL App (2d) 140782, ¶ 21, 396 Ill.Dec. 861, 40 N.E.3d 746. A putative class action requires that the named plaintiff allege an injury-in-fact. A named plaintiff cannot rely upon injuries suffered by other unidentified members of the claimed class to establish standing. I.C.S. Illinois, Inc. v. Waste Management of Illinois, Inc., 403 Ill. App. 3d 211, 221, 341 Ill.Dec. 710, 931 N.E.2d 318 (2010).

¶ 14 In dismissing the plaintiffs’ complaint for lack of standing, the circuit court relied heavily on Maglio, the only Illinois case addressing standing in a data breach lawsuit. Maglio, 2015 IL App (2d) 140782, 396 Ill.Dec. 861, 40 N.E.3d 746. The plaintiffs in Maglio filed negligence, invasion of privacy, and statutory claims against defendant Advocate Health and Hospitals Corporation (Advocate) after four...