In re Mondelez Data Breach Litig.

1

IN RE MONDELEZ DATA BREACH LITIGATION, IN RE: BRYAN CAVE LEIGHTON PAISNER, LLP DATA BREACH LITIGATION,

Nos. 23 C 3999, 23 C 4249

United States District Court, N.D. Illinois, Eastern Division

June 3, 2024

MEMORANDUM OPINION AND ORDER

JORGE L. ALONSO, United States District Judge

These consolidated class-action cases arise out of a data breach incident involving the law firm Bryan Cave Leighton Paisner LLP (“Bryan Cave”), which detected unauthorized access to its information systems in February 2023. Plaintiffs are all employees of Mondelez Global LLC (“Mondelez”), one of Bryan Cave's clients and they assert claims of negligence and other statelaw causes of action against defendants Mondelez and Bryan Cave based on the exposure of their personal information in the data breach. Defendants have moved to dismiss for lack of standing and failure to state a claim under Federal Rule of Civil Procedure 12(b)(1) and (6). For the following reasons the motions are granted in part and denied in part. They are denied as to standing, as to the negligence claims, and as to any accompanying right to declaratory or injunctive relief, but otherwise granted.

I. Background

The following facts are taken from the complaints in these consolidated actions. Mondelez makes snack food products for retail sale. It operates in countries all over the world, with its principal place of business in Chicago, Illinois. It retained Bryan Cave to provide legal services, and, in the course of the representation, Mondelez provided certain of its employees' personally identifiable information to Bryan Cave, including names, dates of birth, Social Security numbers, and addresses. In February 2023, Bryan Cave detected unauthorized access to its information systems, and a forensic investigation revealed that the hackers obtained the personal information of 51,100 current and former Mondelez employees. Each of the seven named plaintiffs received a letter from Mondelez to notify employees of the data breach and that their personal information had been exposed. Plaintiffs allege that they are at an increased risk of identity theft, and they have taken prudent actions to mitigate the risk of identity theft, such as “signing up for credit monitoring and identity theft insurance, closing and opening new credit cards, and securing their financial accounts.” (In Re: Mondelez Data Breach Litigation, Case No. 23 C 3999, Consol. Compl. ¶ 106, ECF No. 24; see id. at ¶ 108; see also In Re: Bryan Cave Data Breach Litigation, Case No. 23 C 4249, Am. Compl. ¶¶ 84.d. & e., 111, ECF No. 34.) They filed a number of lawsuits in which they assert various state-law claims under the diversity jurisdiction, see 28 U.S.C. § 1332(d). The Court has consolidated these actions so that two consolidated class actions remain, one against Mondelez and another against Bryan Cave.

II. Legal Standards

Defendants move to dismiss pursuant to Federal Rule of Civil Procedure 12(b)(1) and (6). “Rule 12(b)(1) is the means by which a defendant raises a defense that the court lacks subjectmatter jurisdiction,” such as a challenge to the plaintiff's standing. Bazile v. Fin. Sys. of Green Bay, Inc., 983 F.3d 274, 279 (7th Cir. 2020). “Standing” refers to the “‘personal stake in the outcome'” of the case that all plaintiffs must have in order to invoke the “judicial power” wielded by the federal courts. Warth v. Seldin, 422 U.S. 490, 499 (1975) (quoting Baker v. Carr, 390 U.S. 186, 204 (1962)). Where a defendant seeks dismissal under Rule 12(b)(1) for failure to set forth allegations sufficient to establish standing on the face of the complaint, courts must “accept all well-pleaded factual allegations as true and draw all reasonable inferences in favor of the plaintiff.” Prairie Rivers Network v. Dynegy Midwest Generation, LLC, 2 F.4th 1002, 1007 (7th Cir. 2021) (citing Silha v. ACT, Inc., 807 F.3d 169, 173 (7th Cir. 2015)).

A motion under Federal Rule of Civil Procedure 12(b)(6) tests whether the complaint states a claim on which relief may be granted. Richards v. Mitcheff, 696 F.3d 635, 637 (7th Cir. 2012). Under Rule 8(a)(2), a complaint must include “a short and plain statement of the claim showing that the pleader is entitled to relief.” Fed.R.Civ.P. 8(a)(2). The short and plain statement under Rule 8(a)(2) must “give the defendant fair notice of what . . . the claim is and the grounds upon which it rests.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007) (internal quotation marks omitted). The complaint's “[f]actual allegations must be enough to raise a right to relief above the speculative level,” Twombly, 550 U.S. at 555; that is, the “complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.'” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Twombly, 550 U.S. at 570). “A claim has facial plausibility when the plaintiff pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Iqbal, 556 U.S. at 678. The Court must “construe the complaint in the light most favorable to plaintiff, accept all well-pleaded facts as true, and draw reasonable inferences in plaintiff's favor.” Taha v. Int'l Bhd. of Teamsters, Loc. 781, 947 F.3d 464, 469 (7th Cir. 2020); see also Silha, 807 F.3d at 174 (noting that courts apply the same standard to facial challenges to standing). However, it need not “accept as true legal conclusions, or threadbare recitals of the elements of a cause of action, supported by mere conclusory statements.” Brooks v. Ross, 578 F.3d 574, 581 (7th Cir. 2009).

III. Standing

The Court begins with standing-as it must, because standing is jurisdictional, and “it [is] improper for courts to skip over jurisdictional issues in order to reach the merits.” Yassan v. J.P. Morgan Chase & Co., 708 F.3d 963, 967 n.1 (7th Cir. 2013) (citing Steel Co. v. Citizens for a Better Env't, 523 U.S. 83, 93-94 (1998)). “To establish standing, a plaintiff must show that he has suffered or is at imminent risk of suffering an injury caused by the defendant and that the injury could likely be redressed by favorable judicial relief.” Patterson v. Howe, 96 F.4th 992, 996 (7th Cir. 2024) (citing TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021)). An injury only confers standing to sue if it is an “injury in fact,” which means it must be “concrete, particularized, and actual or imminent.” Id.

Defendants argue that plaintiffs lack standing because they have not suffered an injury in fact. According to defendants, although plaintiffs' personal information was exposed in a data breach, plaintiffs allege nothing to indicate that their information has been misused in any way. That is, despite the fact that the data breach occurred over a year ago, plaintiffs do not allege that they have been sent fraudulent bills, that unauthorized accounts have been opened in their names, that their information has been posted on the dark web, or that there are any other indicia of identity theft or fraud.

Years ago, the Seventh Circuit held that plaintiffs “whose data has been compromised, but not yet misused,” have suffered an injury-in-fact sufficient to confer standing, explaining that a plaintiff may have standing if the defendant's actions leave her under a “threat of future harm” or “increase[e] the risk of future harm that the plaintiff would have otherwise faced, absent the defendant's actions.” Pisciotta v. Old Nat. Bancorp, 499 F.3d 629, 634 (7th Cir. 2007). Since then, the Supreme Court has explained that, to confer standing, a threatened injury must be “certainly impending,” not merely feared based on “speculation” that a “highly attenuated chain of possibilities” might occur. Clapper v. Amnesty Int'l USA, 568 U.S. 398, 409-10 (2013). But the Seventh Circuit has warned courts “not to overread Clapper,” which was “addressing speculative harm based on something that may not even have happened to some or all of the plaintiffs.” Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 694 (7th Cir. 2015). When the plaintiffs are victims of an “alleged data theft” that has “already occurred,” there is-unlike in Clapper- “‘no need to speculate as to whether . . . information has been stolen.'” Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963, 966 (7th Cir. 2016) (quoting Remijas, 794 F.3d at 693). Similarly, it is common sense that hackers steal personal information to profit from it, so there is no need “‘to wait until hackers commit identity theft or credit-card fraud in order to give the class standing, because there is an objectively reasonable likelihood that such injury will occur.'” Id. at 966-67 (quoting Remijas, 794 F.3d at 693). Further, if the plaintiffs incur “mitigation expenses” to minimize the risk of harm from their stolen data being used for fraudulent purposes, these expenses qualify as “actual injuries” for standing purposes, because and to the extent that the data breach has “already occurred.” Lewert, 819 F.3d at 967.

Since Remijas and Lewert, the Supreme Court has addressed standing again, explaining that, “in a suit for damages, the mere risk of future harm, standing alone cannot qualify as a concrete harm-at least unless the exposure to the risk of future harm itself causes a separate concrete harm.” TransUnion, 594 U.S. at 436. Some district courts have since concluded that the mere exposure of personal information in a data breach, absent some reason apart from the breach itself to believe that identity theft or fraud is imminent, does not suffice to confer standing to sue for damages based on a risk of future harm. See, e.g., Kim v. McDonald's USA, LLC, No. 21-CV-05287, 2022 WL 4482826, at *5 (N.D. Ill. Sept. 27, 2022). It follows, these...