Smahaj v. Retrieval-Masters Creditors Bureau, Inc.

69 Misc.3d 597

131 N.Y.S.3d 817

Michelle SMAHAJ, Individually and On behalf of All Others Similarly Situated, Plaintiff,

v.RETRIEVAL-MASTERS CREDITORS BUREAU, INC. d/b/a American Medical Collections Agency, and CBLPATH, Inc., Defendants.

62076/2019

Supreme Court, Westchester County, New York.

Decided on September 4, 2020

Lewis Brisbois Bisgaard & Smith LLP (Jeffrey Spiegel of counsel) for CBLPath, Inc., defendant.

Blau Leonard Law Group LLC (Steven Bennett Blau and Shelly A. Leonard of counsel) and Kleinman LLC (Abraham Kleinman of counsel) for plaintiff.

Lawrence H. Ecker, J.

In accordance with CPLR 2219 (a), the decision herein is made upon considering all papers filed in NYSCEF relative to the motion of codefendant CBLPATH, INC. (CBLPATH) (Mot. Seq. 2), made pursuant to CPLR 3211 (a) (3) and (7), for an order dismissing the complaint of plaintiff MICHELLE SMAHAJ, Individually and On Behalf of All Others Similarly Situated, as asserted against CBLPATH.

This is a class action suit stemming from a data breach of a debt collection agency. Plaintiff is an individual residing in Garnerville, NY Defendant Retrieval-Masters Creditors Bureau, Inc. d/b/a American Medical Collections Agency (AMCA) is a debt collection corporation who contracts with laboratories, hospitals, and medical providers to collect unpaid debts from consumers. Codefendant CBLPATH is a provider of sub-specialized anatomic pathology and molecular diagnostic laboratory services with a laboratory facility in the Village of Rye Brook. AMCA retained CBLPATH to provide collection services.

During some unspecified period of time, plaintiff and class members received medical services from CBLPATH and failed to pay an invoice for the services. CBLPATH provided AMCA with personal information of plaintiff and certain class members, including their names, dates of birth, social security numbers, and other information so that AMCA could collect on plaintiff's debt.

From August 2018 to March 2019, a data breach allegedly occurred at AMCA. The nonparty unidentified hackers accessed AMCA's database. Plaintiff alleges that the hackers attempted to "place a batch of 200,000 payment card numbers for sale on a popular Darknet Market." Plaintiff claims that due to the data breach, it is likely that she and other class members' private information "will or has been disclosed already on the Darknet," though there is "uncertainty as to the nature and extent" of the information that was compromised. Plaintiff claims that the hack was "directly caused by the omissions and commissions of AMCA" and that CBLPATH became aware of the breach on or about May 10, 2019,¹ but allegedly did not inform plaintiff of the data breach until July 15, 2019.

Plaintiff commenced this action in August 2019, asserting causes of action for negligence, negligence per se, breaches of implied and express contract, and several violations of the General Business Law. In the complaint, plaintiff defines the class as: "[a]ll individuals in the State of New York whose personal information was provided to AMCA by CBLPATH and was compromised as a result of the AMCA data breach." In support of her claims, plaintiff alleges that she and the class suffered three principal categories of damages: (1) an increased risk of suffering from identity theft and fraud; (2) time, money, and other resources spent to mitigate against risks, both now and in the future, by cancelling credit cards, ability to open new bank accounts, reversing fraudulently imposed charges, and incurring high interest rates due to the inevitable decline in credit score when plaintiff and class members reasonably do not pay for items and services they did not purchase; and (3) the diminution of the value and/or loss of the benefits or products and services purchased directly or indirectly from defendants.²

AMCA is bankrupt and has not appeared in this action. In October 2019, CBLPATH filed a pre-answer motion for, among other things, an extension of time to answer or otherwise move with respect to the complaint. This court granted the motion by decision and order in December 2019. Shortly thereafter, CBLPATH made this motion to dismiss the complaint against it pursuant to CPLR 3211 (a) (3) and (7), contending that plaintiff lacks standing and that she failed to state a viable claim for all causes of action asserted in the complaint.

I. Lack of Standing

CBLPATH primarily relies on dismissal under CPLR 3211 (a) (3) inasmuch as it claims that plaintiff did not sufficiently allege an injury in fact. " ‘On a defendant's motion to dismiss the complaint based upon the plaintiff's alleged lack of standing, the burden is on the moving defendant to establish, prima facie, the plaintiff's lack of standing’ " ( Gobindram v. Ruskin Moscou Faltischek, P.C. , 175 A.D.3d 586, 591, 106 N.Y.S.3d 339 [2d Dept. 2019], quoting BAC Home Loans Servicing, LP v. Rychik , 161 A.D.3d 924, 925, 77 N.Y.S.3d 522 [2d Dept. 2018] ; see CPLR 3211 [a] [3] ). "The motion will be defeated if the plaintiff's submissions raise a question of fact as to its standing" ( Gobindram v. Ruskin Moscou Faltischek, P.C. , 175 A.D.3d at 591, 106 N.Y.S.3d 339 ).

As the parties point out, Manning v. Pioneer Sav. Bank, 56 Misc. 3d 790, 55 N.Y.S.3d 587 (Sup. Ct., Rensselaer County 2016) appears to be the only reported case in New York State addressing standing in the context of a data breach. There, the named plaintiff commenced a class action suit alleging, inter alia, negligence and breach of implied and express contract after a bank-owned laptop containing customer information (including names, social security numbers, addresses, and account numbers) was stolen from a bank employee's vehicle (see id. at 791, 55 N.Y.S.3d 587 ). Ultimately, the Court in Manning dismissed the complaint for lack of standing, finding that plaintiff's claimed injuries were speculative since they were based on future risks of identity theft and, thus, did not constitute an injury in fact (see id. at 797, 55 N.Y.S.3d 587 ).

Plaintiff in this case, however, directs this court's attention to federal and out-of-state cases involving data breach victims who were found to have standing despite not having suffered actual monetary damages or were the victims of identity theft. For example, in Sackin v. TransPerfect Global, Inc., 278 F. Supp. 3d 739 (S.D. N.Y. 2017), an employee of defendant Transperfect disclosed plaintiffs' personal information to unidentified cyber-criminals in response to a "phishing" email received on or about January 17, 2017 ( id. at 744 ). About one month later, the plaintiffs in Sackin filed a complaint alleging four categories of injury as a consequence of the data breach: "(1) an imminent risk of future identity theft; (2) lost time and money expended to mitigate the threat of identity theft; (3) diminished value of personal information; and (4) [ ] loss of privacy" ( id. at 745 ). In finding that plaintiffs' first two alleged categories constitute injuries in fact, the court in Sackin considered the circumstances of the disclosure, which created "a risk of identity theft sufficiently acute as to fall comfortably into the category of ‘certainly impending’ " ( id. at 746 ). In so doing, it distinguished cases where "courts found standing to be lacking when a plaintiff's [information] was on a stolen computer, and the plaintiffs did not allege or could not show that obtaining their [information] was the motivation for the theft" ( id. at 747 ).

Notwithstanding the Sackin decision, the court notes that a temporal component may factor into determining whether a threatened harm is sufficient for standing within the Second Circuit. For example, in Fero v. Excellus Health Plan, Inc., 236 F. Supp. 3d 735 (W.D. N.Y. 2017), hackers breached the computer network in December 2013 for a health care provider and accessed certain personal and financial information (see id. at 744 ). About two years later, the initial complaint was filed, and the action was consolidated with some plaintiffs alleging that their information had been misused, while other plaintiffs did not allege any misuse (the non-misuse plaintiffs) (see id. at 744-745 ). The Fero Court held that the non-misuse plaintiffs lacked standing because the alleged harm of increased identity fraud, without more, was too speculative given that three years had passed without any suspicious activity, which undercut assertions of "certainly impending" harm ( id. at 753 ).³ Moreover, the Court in Fero found that with respect to those non-misuse plaintiffs, there was a lack of standing based on: (1) the alleged mitigation efforts against future identify fraud because such harm was not imminent; and (2) the alleged diminution in value of their personal information because the complaint lacked "factual allegations to support the proposition that their personal information was made less valuable to them as a result of the breach, or that the data breach negatively impacted the value of their data such that [p]laintiffs could not use or sell it" ( id. at 755 ).

Here, plaintiff has failed to establish that she and the class members have suffered injuries or that the alleged injuries are imminent (see Silver v. Pataki , 96 N.Y.2d 532, 538, 730 N.Y.S.2d 482, 755 N.E.2d 842 [2001] ; Society of Plastics Indus. v. County of Suffolk , 77 N.Y.2d 761, 772-773, 570 N.Y.S.2d 778, 573 N.E.2d 1034 [1991] ; Warth v. Seldin , 422 U.S. 490, 503-504, 95 S.Ct. 2197, 45 L.Ed.2d 343 [1975] ). In contrast to Manning , the data breach at issue creates an inference of malicious intent to steal private information, supporting an increased risk of identity theft (compare Sackin v. TransPerfect Global, Inc. , 278 F. Supp. 3d at 746 ). However, a lengthy passage of time without any suspicious activity weighs against finding an injury in fact. Nearly one year elapsed from when the subject data breach occurred and more than one year has now passed since when this action was commenced. The...