Andrew Fitzgerald, individually and on behalf of all others similarly situated v. Jeff Anderson & Associates, PA

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MINNESOTA

Andrew Fitzgerald, individually and on File No. 26-CV-1486 (JMB/DJF) behalf of all others similarly situated,

Plaintiff, ORDER v.

Jeff Anderson & Associates, PA,

Defendant.

Rhett A. McSweeney, McSweeney / Langevin LLC, Minneapolis, MN; and Laura Grace Van Note (pro hac vice), Cole & Van Note, Oakland, CA; for Plaintiff Andrew Fitzgerald. Barry M. Landy and Gus Cochran, Ciresi Conlin LLP, Minneapolis, MN, for Defendant Jeff Anderson & Associates, PA.

This matter is before the Court on Defendant Jeff Anderson & Associates, PA’s (Anderson) Motion to Dismiss Plaintiff Andrew Fitzgerald’s claims for lack of standing under Federal Rule of Civil Procedure 12(b)(1) and for failure to state a claim under Federal Rule of Civil Procedure 12(b)(6). (Doc. No. 17.) For the reasons explained below, the Court grants the motion to dismiss without prejudice for lack of standing. BACKGROUND Fitzgerald is a citizen of California who received legal services from Anderson, a Minnesota law firm that has represented victims of childhood sexual abuse. (Doc. No. 5 [hereinafter, “Am. Compl.”] ¶¶ 11, 20; see Doc. No. 20-1.) The Amended Complaint alleges that Anderson stored confidential client information and other personally identifiable information (PII). (Am. Compl. ¶ 1.) In September 2025, Anderson detected suspicious activity in its network and worked with cybersecurity specialists to investigate. (Id. ¶ 2; Doc. No. 20-3 at 2.) Anderson’s investigation revealed that on September 18, 2025, “an unauthorized party gained access to parts of [their] computer environment and copied certain data.” (Doc. No.

20-3 at 2.) Anderson’s review ended in December 2025, and it began informing individuals affected by the Data Breach in February 2026. (Id.) Anderson informed Fitzgerald that his social security number was “present in the potentially impacted data,” but there was “no evidence that [his] information has been made public or misused as a result of this incident” and Anderson had “no reason to believe that it ever will.” (Id.) Anderson offered

complimentary credit monitoring services for 24 months through Experian as an added precaution and encouraged those affected to review their account statements and monitor their credit reports for any unusual activity. (Id. at 2–3.) Fitzgerald alleges that after the Data Breach he “spent time dealing with the consequences,” including “time spent verifying the legitimacy and impact of the Data

Breach, exploring credit monitoring and identity theft insurance options, self-monitoring Representative Plaintiff’s accounts and seeking legal counsel regarding Representative Plaintiff’s options for remedying and/or mitigating the effects of the Data Breach.” (Am. Compl. ¶ 15.) He also alleges that he “suffered actual injury in the form of damages to and diminution in the value of” his PII, that he “suffered lost time, annoyance, interference and inconvenience as a result of the Data Breach and has anxiety and increased concerns for

the loss of privacy, as well as anxiety over the impact of cybercriminals accessing, using and selling” his PII. (Id. ¶¶ 16–17.) Finally, Fitzgerald alleges that he “suffered imminent and impending injury arising from the substantially increased risk of fraud, identity theft and misuse” resulting from his PII “being placed in the hands of unauthorized parties/criminals” and that he has a continuing interest in his PII being “protected and safeguarded from future breaches.” (Id. ¶¶ 18–19.)

Fitzgerald commenced this action in February 2026, and the Amended Complaint asserts the following three claims on behalf of himself and others: negligence (Count I) (Am. Compl. ¶¶ 69–93), breach of implied contract (Count II) (id. ¶¶ 94–101), and breach of the implied covenant of good faith and fair dealing (Count III) (id. ¶¶ 102–106). DISCUSSION

Anderson has moved to dismiss Fitzgerald’s claims for lack of standing and for failure to state a claim. Because the Amended Complaint contains inadequate factual allegations concerning the alleged injury, the Court grants the motion for lack of standing. Article III standing is a jurisdictional prerequisite and must be established before courts reach the merits of a complaint. City of Clarkson Valley v. Mineta, 495 F.3d 567,

569 (8th Cir. 2007); see also Fed. R. Civ. P. 12(h)(3) (providing that courts must dismiss any part of a lawsuit over which it lacks subject matter jurisdiction). When assessing Article III standing at the pleading stage, courts consider whether a plaintiff has “clearly allege[d] facts” that demonstrate the following three elements: (1) the plaintiff has suffered an injury in fact; (2) the claimed injury is “fairly traceable” to the defendant’s alleged conduct; and (3) the relief sought will redress the claimed injury. Alleruzzo v. SuperValu,

Inc. (In re SuperValu, Inc. Customer Data Sec. Breach Litig.), 870 F.3d 763, 768 (8th Cir. 2017) (quoting Spokeo v. Robins, 578 U.S. 330, 338 (2016)). To establish injury in fact, a plaintiff must show that he suffered an injury that is “concrete and particularized” and “actual or imminent, not conjectural or hypothetical.” Spokeo, 578 U.S. at 339. “Concrete” injuries include “traditional tangible harms, such as physical harms and monetary harms,” as well as “intangible harms” that are closely related

to traditional harms, such as “reputational harms, disclosure of private information, and intrusion upon seclusion.” TransUnion LLC v. Ramirez, 594 U.S. 413, 424–25 (2021). “Particularized” injuries must “affect the plaintiff in a personal and individual way.” Spokeo, 578 U.S. at 339 (quotation omitted). To establish traceability, “there must be a causal connection between the injury and the conduct complained of”; the injury has to be

fairly traceable to the challenged action of the defendant and not the result of the independent action of a third party not before the court. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). “A plaintiff must ‘demonstrate standing separately for each form of relief sought.’” TransUnion, 594 U.S. at 436 (quoting Friends of the Earth, Inc. v. Laidlaw Env’t Servs. (TOC), 528 U.S. 167, 185 (2000)). Here, Fitzgerald seeks both

equitable and monetary relief, and the Court addresses each in turn. I. STANDING FOR EQUITABLE RELIEF Fitzgerald seeks injunctive and declaratory relief, requiring implementation of a comprehensive cybersecurity system and policies to protect PII from future data breaches. (Am. Compl. at 26–27.) The allegations contained in the Amended Complaint, however, are insufficient to establish standing for equitable relief.

When a plaintiff seeks equitable relief to prevent future harm from occurring, concrete injuries can include “the risk of real harm,” so long as the risk is “sufficiently imminent and substantial.” TransUnion, 594 U.S. at 435–36. However, “[t]he universal interest in the security of one’s private data does not equate to a substantial and imminent risk of harm.” Thomas v. Pawn Am. Minn., LLC (In re Pawn), No. 21-CV-2554 (PJS/JFD), 2022 WL 3159874, at *3 (D. Minn. Aug. 8, 2022).

Here, to justify injunctive and declaratory relief, the allegations in the Amended Complaint must establish a likelihood that Anderson will experience a future breach. These allegations, however, fail to do so. At most, the Amended Complaint states that Fitzgerald has a “continuing interest” in ensuring that his PII is “protected and safeguarded from future breaches.” (Am. Compl. ¶ 19.) Such allegations, without more, do not

establish an “imminent and substantial risk” of a future breach absent; instead, they merely establish that Anderson “faces much the same risk of future cyberhacking as virtually every holder of private data.” Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 376, 378 (1st Cir. 2023) (concluding that such general allegations cannot support equitable relief). Because Fitzgerald has not demonstrated standing for the requested equitable relief, the

Court dismisses these requests. II. STANDING FOR MONETARY RELIEF Fitzgerald also seeks monetary damages. In suits for damages, “the mere risk of future harm, standing alone, cannot qualify as a concrete harm . . . unless the exposure to the risk of future harm itself causes a separate concrete harm.” TransUnion, 594 U.S. at 436. Under this portion of the analysis, courts no longer focus on harm that plaintiffs might

suffer from future breaches; instead, courts focus on harm that plaintiffs have suffered or will likely suffer in the future because of the breach that already occurred. See Pawn, 2022 WL 3159874, at *9. The Amended Complaint alleges four separate categories of harm stemming from the Data Breach. The Court addresses each category in turn and concludes that the allegations are insufficient to establish any concrete injury. A. Expenses and Lost Time Spent Monitoring Credit

Fitzgerald argues that his exposure to the risk of future harm caused him to expend time and effort “verifying the legitimacy and impact of the Data Breach, exploring credit monitoring and identity theft insurance options, self-monitoring [his] accounts and seeking legal counsel regarding [his] options for remedying and/or mitigating the effects of the Data Breach.” (Am. Compl. ¶ 15.) Absent allegations that his own PII was disclosed,

however, the Amended Complaint contains insufficient allegations to state an injury stemming from the time and money that Fitzgerald spent monitoring his accounts. A plaintiff “cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 416 (2013). If “plaintiffs have not alleged a substantial

risk of future identity theft, the time they spent protecting themselves against this speculative threat cannot create an injury.” SuperValu, 870 F.3d at 771. In contrast, time spent responding to actual identity theft stemming from a data breach can constitute a concrete injury. Webb, 72 F.4th at 376–77 (reversing in part the district court’s dismissal because the complaint alleged that the data breach resulted in the actual misuse of the plaintiff’s own PII by an unauthorized third party to file a fraudulent tax return).

In this case, the Amended Complaint includes no allegations of any actual misuse of Fitzgerald’s PII. Absent such allegations, the time and costs that Fitzgerald has allegedly spent to monitor his bank accounts and credit reports have been in response to a purely speculative concern, and Fitzgerald lacks standing to recover monetary damages for any asserted lost time and costs. B. Imminent and Substantial Risk of Identity Theft and Fraud

Fitzgerald also alleges that he has “suffered imminent and impending injury arising from the substantially increased risk of fraud, identity theft and misuse resulting from [his PII] being placed in the hands of unauthorized third parties/criminals.” (Am. Compl. ¶ 18.) However, the Amended Complaint does not adequately allege any future risk of identity theft as a result of the Data Breach.

First, as noted above, the Amended Complaint does not adequately allege what information was disclosed. The Notice of Data Breach states only that Fitzgerald’s social security number “was present in the potentially impacted data,” but that Anderson had “no evidence that [Fitzgerald’s] information has been made public or misused as a result of this incident” and that Anderson had “no reason to believe that it ever will.” (Doc. No. 20-3 at

2.) Without specific allegations setting forth what information was actually disclosed, the Amended Complaint cannot adequately tie future harm to the Data Breach. Second, even if the Amended Complaint specified what of Fitzgerald’s PII had actually been disclosed in the Data Breach, the Amended Complaint does not allege that Fitzgerald’s unique PII has been affected by the breach, that his PII has been misused in any way, or that he has experienced any concrete or particularized injury resulting from the

alleged disclosure of his own PII. Although Fitzgerald urges the Court to follow the outcome in Perry and Pawn, the Court declines to do so because the factual allegations in those two cases go well beyond those in this case. The plaintiff in Perry alleged that cybercriminals misused his specific private information that had been disclosed in the data breach to contact him, impersonate his bank, and scam him out of $500. Perry v. Bay & Bay Transp. Servs., Inc., 650 F. Supp. 3d 743, 749 (D. Minn. 2023). Likewise, at least

some of the plaintiffs in Pawn alleged that they experienced identity theft as a direct result of the disclosure of their private data. 2022 WL 3159874, at *4. Unlike the plaintiffs in these two cases, Fitzgerald has not alleged actual misuse of his PII or actual identity theft as a result of the Data Breach. Thus, Fitzgerald has not pleaded facts to show a sufficient risk of future harm. See TransUnion, 594 U.S. at 437.

C. Diminished Value of PII Fitzgerald next asserts that monetary damages are appropriate to recover from the diminution of value in his PII. (Am. Compl. ¶ 16.) The factual allegations supporting this claim, however, are too general and conclusory to plausibly plead an injury in fact resulting from diminution of value of his PII. For instance, the allegations do not purport to state the monetary value of Fitzgerald’s specific PII—either before or after the Data Breach.1

Nor does the Amended Complaint include factual allegations explaining how the monetary value was reduced or diminished as a result of the Data Breach or how such a change could

1 To the extent that Fitzgerald asserts a lost “benefit of their bargains” separately from the diminution of value in his PII (Am. Compl. ¶ 106), the Court concludes that the Amended Complaint contains insufficient allegations to establish an injury in fact. As discussed, Fitzgerald has not alleged any misuse of his PII. Contra In re Marriott Int’l, Inc., 440 F. Supp. 3d 447, 462–65 (D. Md. 2020). Furthermore, the Amended Complaint does not allege that Fitzgerald’s PII was of any material economic value with respect to any service he received from Anderson. See In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., No. 19-MD-2904, 2021 WL 5937742, at *11 (D.N.J. Dec. 16, 2021). Thus, Fitzgerald lacks standing to assert a claim for a lost benefit of the bargain. have affected Fitzgerald. Indeed, the factual allegations contain no information about whether Fitzgerald was hoping to sell his PII but was unable to do so at his preferred price, or whether Fitzgerald was otherwise affected by any change in the economic value of his PII resulting from the Data Breach. See Blood v. Labette Cnty. Med. Ctr., No. 5:22-CV-

04036-HLT-KGG, 2022 WL 11745549 (D. Kan. Oct. 20, 2022); Chambliss v. CareFirst, Inc., 189 F. Supp. 3d 564, 572 (D. Md. 2016). Thus, the Amended Complaint fails to allege an injury based on diminution in value of Fitzgerald’s PII. D. Anxiety and Emotional Distress Finally, the Amended Complaint includes allegations that Fitzgerald experienced

emotional injury. However, without additional allegations that Fitzgerald’s own PII was disclosed and allegations that it was this disclosure that caused the emotional distress, these allegations are not fairly traceable to the Data Breach. A plaintiff’s knowledge of their exposure to “a risk of future physical, monetary, or reputational harm” could cause the plaintiff to suffer “emotional or psychological harm.”

TransUnion, 594 U.S. at 436 n.7. Such emotional or psychological harm, however, must be sufficiently connected to an actual disclosure of information to establish standing. See SuperValu, 870 F.3d at 771 (concluding that because the plaintiffs “have not alleged a substantial risk of future identity theft,” they lacked standing to seek relief for injuries created by “this speculative threat” of future identity theft); see also Clapper, 568 U.S. at 416 (concluding that a plaintiff “cannot manufacture standing merely by inflicting harm on

themselves based on their fears of hypothetical future harm that is not certainly impending”); Pawn, 2022 WL 3159874, at *4 (concluding that allegations of emotional distress directly caused by the theft of plaintiffs’ private information were sufficient to establish standing because “at least some plaintiffs ha[d] alleged that their identities ha[d] already been stolen because of the data breach”). Here, as noted above, the Amended Complaint does not allege that Fitzgerald’s own

PII was disclosed or that Fitzgerald faces a substantial risk of identity theft stemming from the disclosure of his PII. While the Amended Complaint alleges that Fitzgerald experienced “anxiety and increased concerns for the loss of privacy, as well as anxiety over the impact of cybercriminals accessing, using and selling” his PII (Am. Compl. ¶ 17), these fears are not plausibly traceable to the Data Breach absent allegations of actual disclosure

and actual misuse of Fitzgerald’s own PII. Therefore, the Amended Complaint does not establish standing for a claim of emotional distress. In sum, Fitzgerald has not demonstrated standing for his request for monetary relief, and the Court dismisses this request for lack of jurisdiction.2 ORDER

Based on the foregoing, and on all of the files, records, and proceedings herein, IT IS HEREBY ORDERED THAT Defendant’s Motion to Dismiss (Doc. No. 17) is GRANTED WITHOUT PREJUDICE. LET JUDGMENT BE ENTERED ACCORDINGLY.

Dated: August 3, 2026 /s/ Jeffrey M. Bryan Judge Jeffrey M. Bryan United States District Court

2 Because the Court concludes that Fitzgerald lacks standing, it need not address whether Fitzgerald has also failed to state a claim under Rule 12(b)(6).