Griffey v. Magellan Health Inc.

562 F.Supp.3d 34

Chris GRIFFEY, individually and on behalf of all others similarly situated; et al., Plaintiffs,

v.MAGELLAN HEALTH INCORPORATED, Defendant.

No. CV-20-01282-PHX-MTL

United States District Court, D. Arizona.

Signed September 27, 2021

David K. Lietz, Pro Hac Vice, Gary E. Mason, Pro Hac Vice, Mason Lietz & Klinger LLP, Washington, DC, Gary M. Klinger, Pro Hac Vice, Mason Lietz & Klinger LLP, Chicago, IL, Hart Lawrence Robinovitch, Zimmerman Reed PLLP, Scottsdale, AZ, Neal A. DeYoung, Pro Hac Vice, DeYoung & Associates, Southbury, CT, Carrie Ann Laliberte, Bonnett Fairbourn Friedman & Balint PC, Phoenix, AZ, for Plaintiffs Chris Griffey, Bharath Maduranthgam Rayam, Michael Domingo, Laura Leather, Clara Williams.

David K. Lietz, Pro Hac Vice, Gary E. Mason, Pro Hac Vice, Mason Lietz & Klinger LLP, Washington, DC, Elaine Ann Ryan, Carrie Ann Laliberte, Bonnett Fairbourn Friedman & Balint PC, Phoenix, AZ, Gary M. Klinger, Pro Hac Vice, Mason Lietz & Klinger LLP, Chicago, IL, Neal A. DeYoung, Pro Hac Vice, DeYoung & Associates, Southbury, CT, Hart Lawrence Robinovitch, Zimmerman Reed PLLP, Scottsdale, AZ, for Plaintiff Keith Lewis.

Elaine Ann Ryan, Carrie Ann Laliberte, Bonnett Fairbourn Friedman & Balint PC, Phoenix, AZ, Joel Robert Rhine, Pro Hac Vice, Martin A. Ramey, Pro Hac Vice, Rhine Law Firm PC, Wilmington, NC, John A. Yanchunis, Pro Hac Vice, Morgan & Morgan Complex Litigation Group, Tampa, FL, Michael Dell'Angelo, Pro Hac Vice, Berger & Montague PC, Michael K. Yarnoff, Pro Hac Vice, Kehoe Law Firm PC, Philadelphia, PA, Patricia Nicole Syverson, Bonnett Fairbourn Friedman & Balint PC, San Diego, CA, Hart Lawrence Robinovitch, Zimmerman Reed PLLP, Scottsdale, AZ, for Plaintiffs Daniel Ranson, Mitchell Flanders, Joseph Rivera, Teresa Culberson.

Christopher A. Wiech, Pro Hac Vice, Baker & Hostetler LLP, Atlanta, GA, Paul Gregory Karlsgodt, Pro Hac Vice, Sean B. Solis, Pro Hac Vice, Baker & Hostetler LLP, Denver, CO, John Christopher Gray, Lewis Roca Rothgerber Christie LLP, Phoenix, AZ, for Defendant.

ORDER

Michael T. Liburdi, United States District Judge Magellan Health, Inc. ("Magellan") was the subject of a ransomware cyber-attack and data breach. A hacker stole the personally identifiable information ("PII") and protected health information ("PHI") of Magellan employees, contractors, and participants in health care benefit plans that Magellan administers. Plaintiffs here represent these categories of individuals. They assert numerous claims against Magellan relating to the data breach. Magellan has moved to dismiss. (Doc. 33, the "Motion".) The Parties fully briefed the Motion and the Court held oral argument. The Court resolves the Motion as follows.

I. FACTUAL BACKGROUND

The following facts are taken from the First Amended Consolidated Class Action Complaint ("Amended Complaint"). (Doc. 30.) Magellan is a health care company headquartered in Phoenix, Arizona. It administers health and pharmaceutical benefits to plan members in exchange for fees. (Doc. 30 ¶¶ 30–31.) As part of the administration process, Magellan obtains and stores plan members’ PII and PHI on its servers. (Id. ¶¶ 31–33.) Similarly, Magellan collects PII from its employees as a condition of employment. (Id. ¶¶ 63–64.) Plaintiffs further allege that Magellan's privacy policy contains express statements whereby Magellan committed to protecting the PII and PHI it collects. (Id. ¶¶ 50–53.)

In April 2020, a hacker sent a "spear phishing" email to Magellan employees. (Id. ¶¶ 32, 38.) An employee unwittingly responded to the email, and, in doing so, provided the hacker with access to the Magellan email system. (Id. ) A ransomware attack followed. (Id. ¶¶ 32, 38, 82.) The hacker accessed and extracted PII and PHI from Magellan servers. (Id. ¶ 33.) Magellan detected the attack when system files became encrypted. (Id. ¶ 38.) This is a common feature of a successful spear phishing attack. (Id. ¶ 37.) It was Magellan's second data breach that year. (Id. ¶¶ 32, 38, 82.)

Plaintiffs are residents of different states and have different relationships with Magellan, but their claims fall into three categories based on the injury they allegedly suffered. Plaintiffs Chris Griffey, Michael Domingo, Joseph Rivera, and Teresa Culberson received notice of the data breach. (Id. ¶¶ 1, 4, 12–13.) They allege potential risks of future harm, including harm to their PII or PHI. (Id. ) Plaintiffs Bharath Rayam and Clara Williams allegedly experienced attempted fraud but suffered no out-of-pocket losses. (Id. ¶¶ 2–3, 6–7.) Finally, Plaintiffs Laura Leather, Daniel Ranson, Mitchell Flanders, and Keith Lewis allege they incurred out-of-pocket expenses in response to the data breach to protect or monitor their PII and PHI. (Id. ¶¶ 5, 8–11, 14–15.)

Plaintiffs lay out the nature of their alleged current and future injuries in their Amended Complaint: (1) the compromise, publication, theft, damage to, diminution in value, or unauthorized use of their PII or PHI; (2) out-of-pocket costs associated with the prevention, detection, recovery, and remediation from identity theft or fraud; (3) lost opportunity costs and lost wages associated with efforts expended and the loss of productivity from addressing and attempting to mitigate the actual and future consequences of the data breach; (4) the continued risk to their PII and PHI while in Magellan's possession if Magellan does not take appropriate measures to protect Plaintiffs’ information; (5) current and future costs in terms of time, effort, and money that will be expended to prevent, detect, contest, remediate, and repair the impact of the data breach for Plaintiffs’ lives; (6) imminent and impending injury arising from the increased risk of fraud and identity theft; (7) injury in ways yet to be discovered and proven at trial; and (8) a heightened risk for financial fraud, medical fraud, identity theft, and attendant damages for the foreseeable future. (Id. ¶¶ 85–86, 91; see id. ¶ 98.)

Plaintiffs allege Magellan's data security infrastructure was inadequate to prevent the cyber-attack. (Id. ¶¶ 85–91.) As a result, all Plaintiffs and the prospective class members allege claims of negligence, negligence per se , breach of implied contract, unjust enrichment, and violations of the Arizona Consumer Fraud Act ("AzCFA"). (Id. ¶ 28.) In addition, Plaintiffs domiciled outside of Arizona allege violations of their state's consumer protection laws. (Id. )

Magellan moves to dismiss the Amended Complaint asserting various arguments: (1) Plaintiffs lack Article III standing; (2) none of Plaintiffs’ claims for relief are properly pleaded; and (3) many of the claims asserted under state consumer protection statutes do not apply to Magellan.

II. STANDARD OF REVIEW

A complaint must contain "a short and plain statement of the claim showing that the pleader is entitled to relief" such that the defendant is given "fair notice of what the ... claim is and the grounds upon which it rests." Bell Atl. Corp. v. Twombly , 550 U.S. 544, 555, 127 S.Ct. 1955, 167 L.Ed.2d 929 (2007) (quoting Fed. R. Civ. P. 8(a)(2) ; Conley v. Gibson , 355 U.S. 41, 47, 78 S.Ct. 99, 2 L.Ed.2d 80 (1957) ). A complaint does not suffice "if it tenders ‘naked assertion[s]’ devoid of ‘further factual enhancement.’ " Ashcroft v. Iqbal , 556 U.S. 662, 678, 129 S.Ct. 1937, 173 L.Ed.2d 868 (2009) (quoting Twombly , 550 U.S. at 556, 127 S.Ct. 1955 ). Dismissal under Rule 12(b)(6) "can be based on the lack of a cognizable legal theory or the absence of sufficient facts alleged under a cognizable legal theory." Balistreri v. Pacifica Police Dep't , 901 F.2d 696, 699 (9th Cir. 1988). A complaint, however, should not be dismissed "unless it appears beyond doubt that the plaintiff can prove no set of facts in support of the claim that would entitle it to relief." Williamson v. Gen. Dynamics Corp. , 208 F.3d 1144, 1149 (9th Cir. 2000).

The Court must accept material allegations in a complaint as true and construe them in the light most favorable to Plaintiffs. North Star Int'l v. Arizona Corp. Comm'n , 720 F.2d 578, 580 (9th Cir. 1983). "Indeed, factual challenges to a plaintiff's complaint have no bearing on the legal sufficiency of the allegations under Rule 12(b)(6)." See Lee v. City of Los Angeles , 250 F.3d 668, 688 (9th Cir. 2001). Review of a Rule 12(b)(6) motion is "limited to the content of the complaint." North Star Int'l , 720 F.2d at 581.

III. DISCUSSION

The Court addresses whether Plaintiffs have standing and then addresses whether Plaintiffs have stated a claim in each cause of action.

A. Standing

The standing doctrine is rooted in Article III of the United States Constitution. To proceed with an action in federal court, a plaintiff must show "(i) that he suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) that the injury was likely caused by the defendant; and (iii) that the injury would likely be redressed by judicial relief." TransUnion LLC v. Ramirez , ––– U.S. ––––, 141 S. Ct. 2190, 2203, 210 L.Ed.2d 568 (2021) (citing Lujan v. Defenders of Wildlife , 504 U.S. 555, 560–561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992) ). Here, redressability and causation are not at issue. The critical inquiry is whether each Plaintiff suffered an actual, concrete injury. Magellan argues that Plaintiffs have not. The Court disagrees.

Setting aside the issue of whether Plaintiffs have stated cognizable injuries for the purposes of their substantive claims against Magellan, it is axiomatic that a plaintiff can satisfy the Article III injury-in-fact requirement but, ultimately, fall short of satisfying the cognizable injury requirement for, say, a negligence claim. See Krottner v. Starbucks Corp. , 406 F. App'x 129, 131 (9th Cir. 2010). To qualify under this standard, conduct, like Magellan's here, must create a risk of future injury that is "certainly impending." Clapper v. Amnesty Int'l USA , 568 U.S. 398, 409, 133 S.Ct. 1138, 185 L.Ed.2d 264 (2013). This...