Abernathy v. Brandywine Urology Consultants, P.A.

• Court: Superior Court of Delaware
• Decided: January 21, 2021
• Docket: N20C-05-057 MMJ CCLD
• Status: Published

Opinion

IN THE SUPERIOR COURT OF THE STATE OF DELAWARE

CECILIA ABERNATHY, FLINT ) DELON, TINA MURPHY and ) JEFFREY WASKO, INDIVIDUALLY ) AND ON BEHALF OF ALL OTHERS ) SIMILARLY SITUATED, ) ) C.A. No. N20C-05-057 MMJ CCLD Plaintiffs, ) ) v. ) ) BRANDYWINE UROLOGY ) CONSULTANTS, P.A., ) ) Defendant. )

Submitted: October 30, 2020 Decided: January 21, 2021

On Defendant’s Motion to Dismiss

GRANTED OPINION

Gary M. Klinger, Esq., (Argued) Mason Lietz & Klinger LLP, Chicago, Illinois, Gary E. Mason, Esq., David K. Lietz, Esq., Mason Lietz & Klinger LLP, Washington, District of Columbia, Jared T. Green, Esq., Seitz, Van Ogtrop & Green, P.A., Wilmington, Delaware, Attorneys for Plaintiffs and the Proposed Class.

William E. Manning, Esq., Saul Ewing Arnstein & Lehr LLP, Wilmington, Delaware, Turner A. Broughton, Esq. (Argued), Brendan D. O’Toole, Esq. (Argued), Amanda Bird, Esq., Williams Mullen, Richmond, Virginia, Attorneys for Defendant.

JOHNSTON, J. FACTUAL AND PROCEDURAL CONTEXT

Parties

This case arises from a data breach. On January 27, 2020, Brandywine

Urology Consultants, P.A. (“Defendant”) discovered that it was the victim of a

ransomware attack (the “Attack”) on its network.1 The Attack blocked access to

Defendant’s computer system and data, which included sensitive patient medical

records.2 During the Attack, cyberthieves accessed and encrypted records that

included patient names, addresses, Social Security numbers, medical file numbers,

claim data, and other financial and personal data.3 During and after the attack,

there was no attempt to extract a ransom.

Plaintiffs Cecilia Abernathy, Flint Delong, Tina Murphy, and Jeffrey Wasko

(collectively, “Plaintiffs”) bring this suit individually and on behalf of a Proposed

Class.4 Defendant is a Delaware-based urology practice.5 Plaintiffs are patients of

Defendant.6

1 Defendant’s Opening Brief in Support its Motion to Dismiss (“OB”), at 9. 2 Plaintiff’s Response and Opposition to Defendant’s Motion to Dismiss at 1-2. 3 Id. at 2. 4 Compl. at 1. Plaintiffs have not made a request to certify the class at this stage. 5 OB at 10. 6 Resp. at 2. 2 Defendant’s Response to the Attack

Defendant states that it took immediate steps to “isolate and mitigate the

intrusion to its network” after the Attack was discovered.7 Defendant removed the

malicious software from its network.8 Defendant also hired an outside security

firm to investigate whether protected health information (“PHI”) on the network

had been compromised by the Attack.9 After examining the extent of the Attack,

the security firm confirmed that no PHI had been compromised.10

On March 27, 2020, Defendant notified all of its patients of the Attack.11 On

March 28, 2020, Defendant issued an updated Notice of Potential Data Breach (the

“Notice”).12 The Notice informed Defendant’s patients that it was possible, though

Defendant believed that it was “unlikely,” that their personal and financial

information was compromised.13 The Notice also stated that Defendant would

inform patients as soon as possible of the results of its ongoing investigation. 14

7 OB at 9-10. 8 Id. at 10. 9 Id. 10 Id. 11 Id. 12 Id. 13 Id. 14 Id. 3 Procedural History

Plaintiffs filed suit on May 06, 2020.15 Plaintiffs assert claims for: (1)

negligence; (2) invasion of privacy; (3) breach of express contract; (4) breach of

implied contract; (5) negligence per se; (6) breach of fiduciary duty; (7)

noncompliance with the Delaware Computer Security Breach Act; and (8)

violation of the Delaware Consumer Fraud Act.

Defendant filed a Motion to Dismiss and supporting brief on July 15, 2020.

Plaintiffs filed their Response on August 28, 2020. Defendant filed its Amended

Reply on September 25, 2020.

STANDARD OF REVIEW

Lack of Standing

Rule 12(b) provides for dismissal of a claim when a court lacks subject

matter jurisdiction or a plaintiff lacks standing to appear and be heard.16 Factual

challenges under Rule 12(b)(1) permit a court to consider matters outside the

pleading, such as testimony and affidavits. 17 The burden is on the plaintiff to

demonstrate that it meets the elements for standing. 18

15 Compl. at 1. 16 Super. Ct. Civ. R. 12(b)(1)-(2). 17 Id. 18 Lujan v. Defs. Of Wildlife, 504 U.S. 555, 561 (1992). 4 Failure to State a Claim Upon Which Relief Can Be Granted

In a Rule 12(b)(6) Motion to Dismiss, the Court must determine whether the

claimant “may recover under any reasonably conceivable set of circumstances

susceptible of proof.”19 The Court must accept as true all well-pleaded

allegations.20 Every reasonable factual inference will be drawn in the non-moving

party’s favor.21 If the claimant may recover under that standard of review, the

Court must deny the Motion to Dismiss.22

ANALYSIS

Defendant’s Contentions

Defendant argues that Plaintiffs lack standing to bring this case. Defendant

contends that Plaintiffs have failed to allege an injury in fact. Further, Plaintiffs’

alleged injuries cannot be traced back to Defendant. Defendant asserts that

Plaintiffs have failed to state a claim for Counts 1-5. As for Plaintiffs’ other

claims, Defendant argues that: (1) the economic loss doctrine bars any recovery;

(2) the breach of fiduciary duty claim must be dismissed because the Court lacks

subject matter jurisdiction; (3) the Delaware Computer Security Breach Act claim

must be dismissed because Plaintiffs lack standing and Defendant satisfied the

19 Spence v. Funk, 396 A.2d 967, 968 (Del. 1978). 20 Id. 21 Wilmington Sav. Fund Soc’y v. Anderson, 2009 WL 597268, at *2 (Del. Super.) (citing Doe v. Cahill, 884 A.2d 451, 458 (Del. 2005)). 22 Spence, 396 A.2d at 968. 5 statute’s notice requirement; and (4) the Delaware Consumer Fraud Act claim must

be dismissed because Plaintiffs have failed to state a claim under the statute.

Plaintiffs’ Contentions

Plaintiffs maintain that they have sustained an injury in fact sufficient to

confer standing. Plaintiffs specifically allege the following harms: (1) the

imminent risk of future harm; (2) mitigation expenses; (3) loss of privacy; (4)

anxiety; (5) failure to receive the benefit of a bargain; (6) loss of value of property

in personally identifying information; and (7) disruption to Plaintiffs’ medical care.

Plaintiffs contend that these alleged harms are legally cognizable and can be traced

back to Defendant.

In response to Defendant’s other arguments, Plaintiffs argue that the

economic loss doctrine does not foreclose the possibility of recovery because

Defendant denies the existence of any contract. Further, Plaintiffs properly state

claims for negligence, negligence per se, invasion of privacy, breach of express

contract, and breach of implied contract. Plaintiffs maintain that they properly

stated a claim under Delaware’s Consumer Fraud Act. Plaintiffs concede that the

Court lacks subject matter jurisdiction over their fiduciary duty claim. Finally,

Plaintiffs elect to withdraw their claim under the Delaware Computer Security

Breach Act.

6 Standing

Plaintiffs bear the burden of establishing all of the elements for standing.23

Plaintiffs must demonstrate: (1) an injury in fact; (2) a causal relationship between

the injury and the challenged conduct; and (3) a likelihood that the injury will be

redressed by a favorable decision.24 The requisite injury-in-fact must be

concrete, particularized, and actual or imminent—not conjectural or hypothetical. 25

Additionally, it must be “fairly traceable to the challenged action of the

defendant.”26

“A plaintiff alleging that it will suffer future injuries from a defendant’s

allegedly improper conduct must show that such injuries are certainly

impending.”27 In data breach cases, Plaintiffs must provide at least some plausible

specific allegations of actual or likely misuse of data to satisfy the standing

requirement and avoid dismissal under rule 12(b)(1). 28 “Standing is a threshold

question that must be answered by a court affirmatively to ensure that the litigation

before the tribunal is a ‘case or controversy’ that is appropriate for the exercise of

the court's judicial powers.”29

23 Lujan, 504 U.S. at 561. 24 Id. at 560-61. 25 Id. 26 Id. 27 Clapper v. Amnesty Int’l USA, 568 U.S. 409, 416-18 (2013). 28 Blahous v. Sarrell Regional Dental Center for Pub. Health, 2020 WL 4016246, at *4 (M.D. Ala.). 29 Dover Historical Soc. v. City of Dover Planning Com’n, 838 A.2d 1103, 1110 (Del. 2003). 7 Delaware courts have not addressed the question of whether the imminent

risk of future harm from a data breach constitutes an injury-in-fact sufficient to

confer standing. Defendant argues that it does not. To support its assertion,

Defendant relies on Reilly v. Ceridian Corporation.30 In Reilly, hackers accessed

information stored on the computer system of a payroll processing company. The

hackers potentially gained personal and financial information of 27,000

individuals.31 The Third Circuit noted in that case that “it [was] not known

whether the hacker read, copied, or understood the data.” 32 There “was no

evidence that the intrusion was intentional or malicious” and “no identifiable

taking occurred.”33 The Third Circuit was unwilling to recognize the plaintiff’s

injury because it was too attenuated to confer standing and amounted to nothing

more than speculation. 34

Various federal courts have held that a plaintiff lacks standing to sue the

party who failed to protect its data—in a lost data or potential identity theft case—

where there is no proof of actual misuse or fraud. 35 Although some lower courts

30 664 F.3d 38 (3rd Cir. 2001). 31 Id. at 42. 32 Id. at 40. 33 Id. at 44. 34 Id. at 43. 35 See, e.g., Blahous, 2020 WL 4016246, at *5 (data breach, without evidence of use of stolen data, is insufficient to confer standing); In re: Cmty. Health Sys., Inc., 2016 WL 4732630, at *10 (N.D. Ala.) (“[T]he Plaintiffs in the instant case who did not have allegations of misuse accompanying their claims of an increased risk of harm, the facts pled here do not meet the definition of injury-in-fact; the alleged injuries are “conjectural and hypothetical” and are not 8 have disagreed, those courts still require a plaintiff to allege a “credible threat.”36

“Furthermore, the passage of months, and then, years, only renders any

[] conjectural threat increasingly less imminent.” 37

The Notice that Defendant sent to its patients, including Plaintiffs, stated

there was a possibility that personal and financial information was compromised

during the Attack. 38 However, such notice is not a concession of a plausible,

concrete, imminent, or certain threat.39

As the direct victim of a hacker, Defendant appeared to take swift and

appropriate measures to investigate and mitigate the data breach. The Notice sent

to those whose information possibly was breached is part of the standard process

under such circumstances. Defendant should not be punished for sending out the

“concrete,” nor are they “actual or imminent.”) (internal citation omitted); Chambliss v. Carefirst, Inc, 189 F.Supp.3d 564, 572 (D. Md. 2016) (“Plaintiffs' efforts to establish the imminence of their theory of harm are unpersuasive,” where plaintiff relied on cases which “either concerned information more easily used in fraudulent transactions or relied on factual allegations that the hackers had already misused the stolen data such that the risk of future harm was certainly impending.”). 36 See, e.g., Blahous, 2020 WL 4016246, at *6; Krottner v. Starbucks, 628 F.3d 1139, 1143 (9th Cir. 2010) (finding that plaintiffs “alleged a credible threat of real and immediate harm stemming from the theft of a laptop containing their unencrypted personal data” but noting that plaintiffs might not have alleged a credible threat if the allegations had been “more conjectural or hypothetical—for example, if no laptop had been stolen.”). 37 Blahous, 2020 WL 4016246, at *6 (citing Storm v. Paytime, Inc., 90 F.Supp.3d 359, 366-67 (M.D. Pa. 2015) and In re Zappos.com, Inc., 108 F.Supp.3d 949, 958 (D. Nev. 2015)). 38 OB at 10. 39 The Notice additionally stated that Defendant believed it was unlikely that any information was compromised. An outside security firm later confirmed that no PHI was compromised. Plaintiffs do not contest this finding but rather argue it is still possible that their information may be misused. 9 Notice. So long as the Notice is accurate, it cannot be the basis for liability, or

deemed to be an admission. The Court is reluctant to make any ruling that would

chill efforts to notify patients or clients of security breaches out of an abundance of

caution.

The injury alleged by Plaintiffs—imminent risk of future harm from the

Attack—is nothing more than conjecture and a collection of hypothetical risks.

Additionally, the time that has elapsed since the Attack is problematic. In a similar

case, the United States District Court for the Middle District of Pennsylvania

stated:

Plaintiffs' alleged harm—that they are now at an increased risk of identity theft—does not suffice to allege an imminent injury. Perhaps this strict imminency standard has some wisdom, for even though Plaintiffs may indeed be at greater risk of identity theft, the data breach in this case occurred in April 2014—almost a year ago—and Plaintiffs have yet to allege that any of them have become actual victims of identity theft. Indeed, putting aside the legal standard for imminence, a layperson with a common sense notion of “imminence” would find this lapse of time, without any identity theft, to undermine the notion that identity theft would happen in the near future. 40

In the same way, Plaintiffs in this case have failed to allege that any of them

have been victims of any actual harm stemming from the Attack. As almost a year

has now passed without any harm occurring, it appears unlikely that Plaintiffs

would be harmed in the near future.

40 Storm, 90 F.Supp.3d at 366-67 (emphasis added). 10 The mere fact that the Attack occurred, without more, is insufficient to

confer standing on Plaintiffs. Under the facts of this case, the “imminent risk of

future harm” alleged by Plaintiffs is not concrete, particularized, actual or

imminent. Therefore, Plaintiffs have failed to meet their burden for showing that

they have standing.

Other Alleged Damages are Not Sufficient to Confer Standing

Mitigation Damages

Plaintiffs assert that mitigation expenses are legally cognizable damages.

Plaintiffs claim that they have incurred out-of-pocket expenses and lost the value

of their time spent: (1) monitoring their accounts for fraudulent charges; (2)

canceling and issuing credit and debit cards; (3) purchasing credit monitoring and

identity theft prevention services; and (4) placing freezes and alerts with credit

reporting agencies.41 However, “allowing [Plaintiffs] to bring this action based on

costs they incurred in response to a speculative threat would be tantamount to

accepting a repackaged version of [Plaintiffs] first failed theory of standing.”42 The

Court finds that mitigation costs do not create an injury sufficient to confer

standing on Plaintiffs who allege speculative harms resulting from a data breach.43

41 Compl. ¶¶ 82, 86. 42 Clapper, 568 U.S. at 416. 43 See Blahous at *8 (finding that a plaintiff’s alleged monetary damages were insufficient to confer standing); In re 21st Century Oncology Customer Data Sec. Breach Litig., 380 F.Supp.3d, 1243, 1256 (M.D. Fla. 2019) (“[W]here the risk of identity theft is too speculative to constitute an injury in fact, the alleged injury of mitigation efforts to minimize that risk is 11 Increased Anxiety and Emotional Distress

Plaintiffs argue that they experienced increased anxiety and emotional

distress as a result of the Attack.44 Plaintiffs rely on Shqeirat v. U.S. Airways

Group., Inc.,45 in which the United States District Court for the District of

Minnesota found that fear of identity theft resulting from disclosure of a social

security number was sufficient to support an emotional distress claim.46 However,

in the facts of that case, the plaintiff did not merely speculate that his social

security numbers had been disclosed; the information had been published online. 47

Plaintiffs have not shown that any of their information has been disclosed

following the Attack.48 The Court finds that alleged emotional distress following a

data breach cannot confer standing where a plaintiff fails to show that information

actually has been published or otherwise misused.49

likewise typically found to be non-cognizable.”); In re SuperValu, Inc. Consumer Data Sec. Breach Litig., 870 F.3d 763, 771 (8th Cir. 2017) (“Because plaintiffs have not alleged a substantial risk of future identity theft, the time they spent protecting themselves against this speculative threat cannot create an injury.”). 44 Compl. ¶¶ 88, 89. 45 515 F. Supp. 2d 984 (D. Minn. 2007). 46 Id. at 998. 47 Id. at 997. 48 The Court additionally notes that under Delaware law, a plaintiff must allege physical manifestations of emotional harm. See Robb v. Pennsylvania R. Co., 210 A.2d 709, 711 (Del. 1965) (“[I]t is accepted as settled that there can be no recovery for fright alone, not leading to bodily injury or sickness, arising from the negligence of another.”). Plaintiffs’ complaint fails to allege any physical manifestations resulting from the emotional distress caused by the Attack. 49 See Crisafulli v. Amertias Life Ins. Corp., 2015 WL 1969176, at *3-4 (D. N.J.) (finding that “bald assertions” of “emotional distress including anxiety, fear of being victimized, harassment and embarrassment” are insufficient to confer standing); In re SAIC Backup Tape Data Theft Litig., 45 F.Supp.3d 14, 29 (D.D.C. 2014) (“To be sure, the Supreme Court has intimated that 12 Benefit of the Bargain

Plaintiffs also assert that they did not receive the benefit of the bargain

because they did not get the data security that they bargained and paid for.

However, a number of courts have rejected an “overpayment” theory of damages

as an injury-in-fact for standing purposes.50 A plaintiff’s “claim that some

indeterminate part of their premiums went toward paying for security measures …

is too flimsy to support standing.” 51

Plaintiffs allege in their complaint that “[p]art of the price [Plaintiffs] paid to

Defendant was intended to be used by Defendant to fund adequate security of

[Defendant’s] computer property and Plaintiffs’ [] Private Information. Thus,

Plaintiffs [] did not get what they paid for.”52 The complaint does not provide any

additional information. It does not provide anything that would show Plaintiffs

intended that their money be used to pay for security costs. Nor does it “allege

facts showing how the price [Plaintiffs] paid for [medical care from Defendant]

incorporated some particular sum that was understood by both parties to be

disclosure of personally identifiable information alone, along with some attendant emotional distress, may constitute ‘injury enough to open the courthouse door’ in privacy actions . . . But again, disclosure involves publication to a third party.”). 50 See Fero v. Excellus Health Plan Inc., 236 F.Supp.3d 735, 754-55 (W.D.N.Y. 2017) (compiling cases from various jurisdictions that rejected an overpayment theory). 51 In re SAIC, 45 F.Supp.3d at 30. 52 Compl. ¶ 84. 13 allocated towards the protection of [] data.”53 Therefore, the Court finds that

Plaintiffs’ benefit of the bargain argument is insufficient to confer standing.

Loss of Value of Property

Plaintiffs further contend that the loss of value of property in personally

identifying information (“PII”) is an injury-in-fact. They argue that “their PII [is] a

valuable commodity, that a market exists, and that the PII is likely being sold on

the dark web.”54 This argument fails for two reasons.

Plaintiffs merely state that they “believe their Private Information was stolen

(and subsequently sold) in the Attack” and provide a list of actions hackers may

take.55 While this cited information may support their belief that some information

was stolen, Plaintiffs do not provide anything that supports their belief that the

information was sold. Therefore, alleged loss of value, in this case, is insufficient

to confer standing.

Disruption to Medial Care

Plaintiffs state that “the easiest identifiable harm Plaintiffs allege is the

disruption to their medical care and treatment as a result of the ransomware

attack.”56 The complaint states that “the [A]ttack disrupted [Defendant’s]

53 In re Zappos Inc., 108 F.Supp.3d at 962 n.5. 54 Resp. at 15. 55 Compl. ¶¶ 39-40. 56 Resp. at 16. 14 computer network, leaving data stored on [Defendant’s] network encrypted and

inaccessible, and forcing Defendant to reschedule certain procedures.”57 The

complaint goes on to list all of the reasons why ransomware attacks at medical

facilities cause disruption to medical treatment. 58 However, again, Plaintiffs fail to

provide anything more than speculation and conjecture.

While the complaint provides information about medical disruption in the

abstract, it fails to identify even one plaintiff who was denied access to their

medical records or had their medical treatment otherwise disrupted. The Court

finds that the conclusory statements that Plaintiffs had their medical treatment

disrupted are insufficient to confer standing.

CONCLUSION

Plaintiffs have not alleged any injury-in-fact; they merely allege possible

future injuries. The alleged “imminent risk of future harm” to Plaintiffs is not

concrete, particularized, actual, or imminent. Because a year has passed since the

Attack without any harm actually occurring, the alleged harm also is not “certainly

impending.” The various additional damages alleged by Plaintiffs are likewise

insufficient to confer standing. Therefore, the Court finds that Plaintiffs lack

57 Compl. ¶ 35. 58 Id. at ¶¶ 52-57. 15 standing in this case. Because standing is a threshold requirement, the Court need

not resolve the remaining issues.

THEREFORE, Defendant’s Motion to Dismiss is hereby GRANTED.

IT IS SO ORDERED.

/s/ Mary M. Johnston The Honorable Mary M. Johnston