FILED IN THE U.S. DISTRICT COURT EASTERN DISTRICT OF WASHINGTON Aug 19, 2025 SEAN F. MCAVOY, CLERK EASTERN DISTRICT OF WASHINGTON
CHASE BARNES, on behalf of himself individually and all others NO. 2:25-CV-0081-TOR similarly situated, Plaintiff, ORDER GRANTING IN PART v. DISMISS KEY TRONIC CORPORATION, a Washington corporation, Defendant.
BEFORE THE COURT is Defendant’s Motion to Dismiss (ECF No. 10). The Court has reviewed the record and files herein, determined that oral argument is unnecessary, and is fully informed. For the reasons discussed below, Defendant’s Motion to Dismiss (ECF No. 10) is GRANTED in part. This matter arises out of a data breach which resulted in the compromise of Plaintiff’s personally identifiable information (“PII”). Plaintiff, a citizen of Alabama, was employed with Defendant, a Washington corporation that designs and manufactures precision injection molding products, with locations in Washington, Texas, Arkansas, Minnesota, and Mississippi. ECF No. 1 at 7, 36, ¶¶
23, 107. Plaintiff was working at Defendant’s manufacturing facility in Mississippi when he learned that his PII provided to his employer had likely been stolen in a May 2024 data breach. Id. at 36, ¶ 106. Plaintiff received a notice from
Defendant in July 2023 stating that the company had experienced a data breach by cybercriminals, and that his name and social security number was among the material stolen. Id. at 60. He and other employees had provided this information to Defendant as a condition of employment. Id. at 7, ¶ 24. Defendant offered two
years of credit monitoring in response to the breach. Id. at 37, ¶ 114. Since the breach, Plaintiff has undertaken monitoring of his credit information and suffers from fear, anxiety, and stress. Id. at 39–40, ¶ 137.
Plaintiff filed the present lawsuit on behalf of himself and similarly situated individuals, bringing claims of negligence, breach of implied contract, breach of fiduciary duty, and unjust enrichment. ECF No. 1. Defendant has filed this motion to dismiss, arguing that Plaintiff lacks standing, and that even if he has
standing, his claims are untenable. ECF No. 11. I. Article III Standing
Defendant challenges Plaintiff’s standing to bring suit, arguing that he has not alleged an injury in fact or a concrete risk of future harm. ECF No. 10 at 11‒ 12. A jurisdictional challenge brought under Rule 12(b)(1) may present as either a
facial or factual attack. White v. Lee, 227 F.3d 1214, 1242 (9th Cir. 2000). “In a facial attack, the challenger asserts that the allegations contained in a complaint are insufficient on their face to invoke federal jurisdiction. By contrast, in a factual
attack, the challenger disputes the truth of the allegations that, by themselves, would otherwise invoke federal jurisdiction.” Safe Air for Everyone v. Meyer, 373 F.3d 1035, 1039 (9th Cir. 2004). The court “resolves a facial attack as it would a motion to dismiss under Rule 12(b)(6): Accepting the plaintiff's allegations as true
and drawing all reasonable inferences in the plaintiff's favor, the court determines whether the allegations are sufficient as a legal matter to invoke the court's jurisdiction.” Leite v. Crane Co., 749 F.3d 1117, 1121 (9th Cir. 2014) (citation
omitted). Article III of the United States Constitution vests in federal courts the power to entertain disputes over “cases” or “controversies.” U.S. CONST. art. III, § 2. To satisfy the case or controversy requirement, and thereby show standing, a
plaintiff must demonstrate that throughout the litigation, they suffered, or will be threatened with, an actual injury traceable to the defendant which will likely be redressed by a favorable judicial decision. Spencer v. Kemna, 523 U.S. 1, 7 (1998)
(quoting Lewis v. Cont'l Bank Corp., 494 U.S. 472, 477 (1990)); see also Deakins v. Monaghan, 484 U.S. 193, 199 (1988) (“Article III of the Constitution limits federal courts to the adjudication of actual, ongoing cases or controversies between
litigants.”). Three elements must be shown in order to establish Article III standing: (1) the plaintiff must have suffered an “injury in fact” which is both concrete and particularized and not “conjectural” or “hypothetical”; (2) there must
be a causal connection between the injury and the conduct complained of; and (3) it must be “likely” as opposed to “speculative” that the injury will be “redressed by a favorable decision.” Lujan v. Defs. of Wildlife, 504 U.S. 555, 560–61 (1992) (internal citations and quotations omitted). The party invoking federal jurisdiction
bears the burden of establishing the elements. Id. at 561 (citing FW/PBS, Inc. v. Dallas, 493 U.S. 215, 231 (1990)). However, “[a]t the pleading stage, general factual allegations of injury resulting from the defendant's conduct may suffice.”
Lujan, 504 U.S. at 561. “[A] 12(b)(1) motion to dismiss for lack of standing can only succeed if the plaintiff has failed to make ‘general factual allegations of injury resulting from the defendant's conduct.’” Id. Further, “in determining constitutional standing, ‘it is
within the trial court's power to allow or to require the plaintiff to supply, by amendment to the complaint or by affidavits, further particularized allegations of fact deemed supportive of plaintiff's standing.’” Maya v. Centex Corp., 658 F.3d
1060, 1067 (9th Cir. 2011) (quoting Warth v. Seldin, 422 U.S. 490, 501 (1975)). The burden of proof rests with the party invoking federal jurisdiction, and the party must support the elements of standing “with the manner and degree of evidence
required at the successive stages of the litigation.” Lujan, 504 U.S. at 561. Here, Defendant challenges that injury-in-fact portion of standing, arguing that any injury Plaintiff (and the class that may be formed) alleges is too abstract to
support his claims. ECF No. 10 at 12. The Court agrees in part. An injury in fact must be concrete, and absent this demonstration, a plaintiff does not have standing. TransUnion LLC v. Ramirez, 594 U.S. 413, 417 (2021). Concrete injuries can be tangible, like monetary loss or physical harms, or they may be intangible, which
the Supreme Court has noted as those which have a “close relationship to a harm that has traditionally been regarded as providing a basis for a lawsuit in English or American courts.” Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). The Court
has described these traditional bases as causes of action for things like intrusion upon seclusion, public disclosure of private fact, and reputational damage. TransUnion LLC, 594 U.S. at 425. However, future harms cannot form the basis of a concrete injury “unless the exposure to the risk of future harm itself causes a
separate concrete harm.” Id. at 436. Plaintiff argues that he has alleged an injury in fact because he faces a future risk of harm related to the leak of his personal data and has spent time and money
monitoring his personal information online. ECF No. 11 at 9. In application of Trans Union, the Ninth Circuit and district courts within it have rejected the notion that the time and energy expended from monitoring for identity theft, and the
related anxiety, are not, on their own, enough to construe an injury in fact for standing purposes. Clapper v. Amnesty Int'l USA, 568 U.S. 398, 416 (2013) (“Respondents' contention that they have standing because they incurred certain
costs as a reasonable reaction to a risk of harm is unavailing—because the harm respondents seek to avoid is not certainly impending. In other words, respondents cannot manufacture standing merely by inflicting harm on themselves based on their fears of hypothetical future harm that is not certainly impending.”); In re
California Pizza Kitchen Data Breach Litig., 129 F.4th 667, 678 (9th Cir. 2025) (internal citation omitted) (“Article III standing can be an uphill battle for data- breach plaintiffs, who must allege a ‘concrete harm,’ not just an ‘asserted risk of
future harm’ . . . Here, the class's standing rested on questionable footing—there is no evidence that any CPK employee's compromised data was misused . . .”); Bozek v. Arizona Labor Force Inc., CV-24-00210-PHX-SMB, 2025 WL 264174, at *5 (D. Ariz. Jan. 22, 2025). Cf. Kirsten v. California Pizza Kitchen, Inc.,
221CV09578DOCKES, 2022 WL 16894503, at *7 (C.D. Cal. July 29, 2022) (“Specifically, Plaintiffs allege that since the data breach, Plaintiff [] has experienced repeated attacks on his identity and was locked out of his
Amazon.com account when another individual unlawfully accessed it.”); Black v. IEC Grp., Inc., 1:23-CV-00384-AKB, 2024 WL 3623361, at *6 (D. Idaho July 30, 2024) (“Absent a credible risk of fraud or identity theft, the [plaintiff’s] other
alleged injuries—including their mitigation costs and their fear, anxiety, and stress—fail to establish an injury-in-fact for purposes of standing.”). Plaintiff has not alleged that he has experienced any actual or attempted identity theft in the
year since the data breach occurred and thus has not experienced a concrete harm sufficient for standing. Leonard v. McMenamins, Inc., 2022 WL 4017674, at *4 (W.D. Wash. Sept. 2, 2022). However, much like in Leonard, Plaintiff has established an injury related to
the actual theft of his personal information. In TransUnion, the Supreme Court affirmed that standing exists where a plaintiff alleges a harm bearing, “a close relationship to a harm traditionally recognized as providing a basis for a lawsuit in
American courts.” 594 U.S. at 440 (citing Spokeo, 578 U.S. at 341). District courts have acknowledged that information exposed in a data breach is sufficiently analogous to the common law tort of “disclosure of private information,” and therefore constitutes an injury in fact. See, e.g., Leonard, 2022 WL 4017674, at *5
(collecting cases); Woodard v. Boeing Employees Credit Union, 2:23-CV-00033, 2023 WL 4847126, at *3 (W.D. Wash. July 28, 2023) (“Here, Plaintiff alleges that she shared private, sensitive data with BECU, and that BECU failed to safeguard
her information, which allowed malicious third parties to carry out the Data Breach . . . The Court finds that Plaintiff's asserted injuries flowing from these acts have a close historical and common-law analog since the theft and loss of control over PII
is akin to traditional claims for invasions of privacy and intrusion upon seclusion.”); Medoff v. Minka Lighting, LLC, 2:22-CV-08885-SVW-PVC, 2023 WL 4291973, at *3 (C.D. Cal. May 8, 2023). The Court finds that consistent with
the reasoning contained in TransUnion and the collection of cases from district courts in this Circuit, Plaintiff’s allegation of loss of control of his personal information bears a sufficient relationship to harm protected in tort. He therefore has satisfied Article III standing and the Court moves to consider each claim
specifically. II. Motion to Dismiss Standard Defendant next argues that, even if Plaintiff has established standing, he has
failed to state a claim with respect to negligence, breach of implied contract, unjust enrichment, and breach of fiduciary duty. ECF No. 10. Federal Rule of Civil Procedure 12(b)(6) provides that a defendant may move to dismiss the complaint for “failure to state a claim upon which relief can be
granted.” A 12(b)(6) motion will be denied if the plaintiff alleges a “sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (quoting Bell Atl. Corp. v.
Twombly, 550 U.S. 544, 570 (2007)). A motion to dismiss for failure to state a claim “tests the legal sufficiency” of the plaintiff’s claims. Navarro v. Block, 250 F.3d 729, 732 (9th Cir. 2001). While the plaintiff’s “allegations of material fact
are taken as true and construed in the light most favorable to the plaintiff” the plaintiff cannot rely on “conclusory allegations of law and unwarranted inferences . . . to defeat a motion to dismiss for failure to state a claim.” In re Stac Elecs. Sec.
Litig., 89 F.3d 1399, 1403 (9th Cir. 1996) (citation and brackets omitted). That is, the plaintiff must provide “more than labels and conclusions, and a formulaic recitation of the elements.” Twombly, 550 U.S. at 555. Instead, a plaintiff must show “factual content that allows the court to draw the reasonable inference that
the defendant is liable for the alleged misconduct.” Iqbal, 556 U.S. 662. A claim may be dismissed only if “it appears beyond doubt that the plaintiff can prove no set of facts in support of his claim which would entitle him to relief.” Navarro,
F.3d at 732. III. Negligence Plaintiff alleges that Defendant breached its duty of care in safeguarding his PII, resulting in injury to himself and the putative class members. ECF No. 1 at
46‒49, ¶¶ 144‒56. Defendant argues that Plaintiff is unable to demonstrate harm as a result of the data breach and thus cannot maintain a claim of negligence. ECF No. 10 at 18‒19. The Court agrees.
Negligence requires proof of four elements: (1) the existence of a duty, (2) a breach of that duty, (3) damage or injury that was (4) proximately caused by the breach. Hartley v. State, 103 Wash. 2d 768, 777 (1985). However, Washington
law requires actual loss or damage as it “is an essential element in the formulation of the traditional elements necessary for a cause of action in negligence . . .The mere danger of future harm, unaccompanied by present damage, will not support a
negligence action.” Krottner v. Starbucks Corp., 406 Fed. Appx. 129, 131 (9th Cir. 2010) (quoting Gazija v. Nicholas Jerns Co., 86 Wash.2d 215, 219 (1975)). Having already rejected the idea that the risk of future identity theft can confer Article III standing, the Court moves to consider the remaining claims of damages
Plaintiff brings under a theory of negligence: anxiety surrounding the loss of control of his PII, diminution of value to his PII, and loss of time and expense in mitigating potential identity theft. ECF No. 11 at 13.
There is currently disagreement within federal district courts in this Circuit, as well as Washington state courts, in determining what specifically supports negligence injury stemming from a data breach of PII. Some courts have rejected an argument that a negligence injury can be based solely on a loss of privacy, and
instead require a showing that financial loss as a result of the breach or those which demonstrate in some tangible way that the plaintiff’s identity was actually stolen. See Leonard, 2024 WL 4188974, at *6; Nienaber v. Overlake Hosp. Med. Ctr.,
2:23-CV-01159-TL, 2025 WL 692097, at *7 (W.D. Wash. Mar. 4, 2025). Additionally, absent actual loss, some courts have required diminution of value to be demonstrated through either (1) the existence of a market for plaintiff’s private
information, and (2) an impairment of the plaintiff’s ability to participate in that market. Leonard, 2024 WL 4188974, at *8 (citing Griffey v. Magellan Health Inc., 562 F. Supp. 3d 34, 46 (D. Ariz. 2021)). Moreover, “[t]he mere danger of future
harm, unaccompanied by present damage, will not support a negligence action . . . Until a plaintiff suffers appreciable harm as a consequence of negligence, he cannot establish a cause of action.” Gazija, 86 Wn.2d at 219 (internal citation omitted).
A case from the Washington State Court of Appeals has reached a different conclusion, finding that a loss of property value in a claimant’s PII can be sufficient to support the injury element of a negligence claim. Nunley v. Chelan-
Douglas Health Dist., 32 Wn. App. 2d 700, 724 (2024). The court in Nunely also recognized disagreements among various courts, noting that there has been no determination from the Washington State Supreme Court on the issue of emotional distress and loss of control over PII, but ultimately held that the reasoning in In re
Marriott International, Inc., Customer Data Security Breach Litigation, 440 F. Supp. 3d 447, 460-61 (D. Md. 2020) was persuasive. Id. at 721. In borrowing from In re Marriott, the Washington court determined that “a person's means of
identification, PII and PHI, can have value and conceivably that value can be diminished or destroyed when their identities are misappropriated for illegal purposes,” given Washington’s robust personal data laws and support from other
cases which made similar findings. Nunley, 32 Wn. App. 2d at 724. However, even in Nunley, after a data breach which compromised their PII, the plaintiffs experienced an increase in spam calls and one plaintiff found her social security
number on the dark web and an unauthorized business license opened in her name. Id. at 725. Defendant contends that Plaintiff has not sufficiently alleged any injury that would support a claim of negligence based on any proffered theories. ECF No. 10
at 18‒20. The Court agrees, finding that Plaintiff’s allegations do not amount to an actual injury, and instead deal with monitoring and the related anxiety. Without any suggestion that Plaintiff and other putative class members did experience some
sort of concrete injury that would place this case squarely within Nunley and other cases within the district courts of the Ninth Circuit in pleading a cognizable injury, dismissal is proper. See Nunley, 32 Wn. App. 2d at 725 (“The loss in value of their PII and PHI is a current harm and a cognizable injury sufficient to support a cause
of action for negligence. Whether and how the Plaintiffs can prove such damages is not a question before us.”). Cf. Krefting v. Kaye-Smith Enterprises Inc., 2:23- CV-220, 2023 WL 4846850, at *3 (W.D. Wash. July 28, 2023) (finding that after a
data breach, the plaintiff’s discovery of a credit account opened using his personal information, an attempt to change his home address, and a credit inquiry made without his permission were concrete harms). Plaintiff does not detail any
monitoring efforts that have resulted in the detection of data misuse or make any related argument in his Response to Defendant’s Motion to Dismiss. The Court finds amendment necessary to clarify what, if any, redressable injury Plaintiff and
the putative class may have faced. Therefore, Plaintiff may amend his negligence claim if possible. Novak v. United States, 795 F.3d 1012, 1020 (9th Cir. 2015) (citation omitted). IV. Implied Contract and Unjust Enrichment
Plaintiff argues that he exchanged his PII as a condition of employment with Defendant, and therefore formed an implied contract whereby Defendant implicitly agreed to safeguard the information. ECF No. 1 at 49, ¶ 158. Alternatively, he
argues that Defendant was unjustly enriched by retaining employee’s private information without investing in adequate data security to ensure the safety of the sensitive material. Id. at 53‒54, ¶¶ 179‒81. In Washington, an implied contract exists where parties make “an agreement
depending for its existence on some act or conduct of party sought to be charged and arising by implication from circumstances which, according to common understanding, show mutual intention on part of parties to contract with each
other.” Johnson v. Nasi, 50 Wash. 2d 87, 91 (1957). If a contract is implied in fact, a claim of quantum meruit exists, which “is the method of recovering the reasonable value of services provided.” Young v. Young, 164 Wn.2d 477, 485
(2008). “Before a court can find the existence of an implied contract in fact, there must be an offer; there must be an acceptance; the acceptance must be in the terms of the offer; it must be communicated to the offeror; there must be a mutual
intention to contract, . . . there must be a meeting of the minds of the parties.” Milone & Tucci, Inc. v. Bona Fide Builders, Inc., 49 Wn.2d 363, 368 (1956) (internal citations omitted). Alternatively, Washington recognizes unjust enrichment as a contract
implied in law, and recovery for damages suffered therein compensate “the benefit retained absent any contractual relationship because notions of fairness and justice require it.” Young, 164 Wn.2d at 484. Unjust enrichment requires a showing of
three elements: (1) the defendant received a benefit, (2) the received benefit is at the plaintiff's expense, and (3) the circumstances make it unjust for the defendant to retain the benefit without payment. Id. at 484‒85. Defendant argues that Plaintiff does not support his implied contract claim
because there was never a mutual understanding that it would safeguard the PII, that the exchange of such information was a requirement under federal law rather than consideration for employment, and that he fails to present that he did not
receive “the benefit of the bargain.” ECF No. 10 at 22. At the pleadings stage, Courts have recognized that an employment contract which requires the exchange of personal information as a condition of employment supports a claim for breach
of an implied contract if the information is not safeguarded. See Guy v. Convergent Outsourcing, Inc., C22-1558 MJP, 2023 WL 4637318, at *6 (W.D. Wash. July 20, 2023) (collecting cases); Kirsten, 2022 WL 16894503, at *5
(“Other courts in this district have held, and the Court agrees, that the mandatory receipt of PII implies the recipient's assent to protect the PII sufficiently.”); Castillo v. Seagate Tech., LLC, 16-CV-01958-RS, 2016 WL 9280242, at *9 (N.D. Cal. Sept. 14, 2016) (“While Seagate made no explicit promises as to the ongoing
protection of personal information, it is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of Social Security numbers or other sensitive personal information would not imply the recipient's assent to
protect the information sufficiently.”). With respect to his contract implied in fact claim, Plaintiff alleges that a requirement of employment with Defendant was to provide his PII, and in exchange there was an expectation that Defendant would safeguard the
information. ECF No. 1 at 49, ¶ 149. At the motion to dismiss stage of litigation, Plaintiff’s allegation that his labor was exchanged, at least in part, for the disclosure of his PII will support a breach of an implied contract in fact in order to
survive dismissal. However, Plaintiff’s claim that Defendant was unjustly enriched through the retention of his PII because it utilized less expensive, and therefore less effective,
data security measures in a cost saving effort, is less successful. ECF No. 1 at 53– 54, ¶¶ 180–81. While Plaintiff has likely successfully established that he conferred a benefit to Defendant in the form of PII, he has not demonstrated circumstances
which would make it unjust for Defendant to retain that benefit. Nienaber, 733 F. Supp. 3d at 1093. Washington courts have typically required some measure of tangible economic benefit retained by Defendant in order to support an unjust enrichment claim. See Cousineau v. Microsoft Corp., 992 F. Supp. 2d 1116, 1130
(W.D. Wash. 2012) (“However, to the Court's knowledge, Washington courts have not applied the doctrine of unjust enrichment outside the context of an ‘expense’ stemming from some tangible economic loss to a plaintiff.”). Here, Plaintiff’s
argument that Defendant could have invested in better security, but chose not to as a way to save money, falls short because it lacks a tangible economic benefit retained at Plaintiff’s expense. Amendment would be futile in this situation, as Plaintiff has not alleged a proper contract in law claim, and the Court is doubtful
he will be able to do so moving forward. See United States v. Corinthian Colleges, 655 F.3d 984, 995 (9th Cir. 2011). V. Breach of Fiduciary Duty
Finally, Plaintiff’s Complaint alleges that Defendant owes him a fiduciary duty because it became a guardian of his private information and thus formed a special relationship. ECF No. 1 at 51, ¶ 171. Plaintiff argues that Defendant failed
to properly implement safeguards around his PII, and therefore breached its fiduciary duty. Id. at 52, ¶ 173. Washington recognizes two instances where a fiduciary relationship may
arise, those which have historically been recognized such as a doctor/patient or attorney/client relationship, and those which arise in fact when there is “something in the particular circumstances which approximates a business agency, a professional relationship, or a family tie, something which itself impels or induces
the trusting party to relax the care and vigilance which he otherwise should, and ordinarily would, exercise.” Alexander v. Sanford, 181 Wn. App. 135, 173 (2014) (internal citation and quotation omitted).
The employee/employer relationship is not a traditionally recognized fiduciary relationship. Nevertheless, Plaintiff argues that a special “guardianship” relationship exists between himself and Defendant, which gives rise to a fiduciary duty to protect his PII. ECF No. 11 at 19. A theory of a fiduciary relationship
premised on a duty to guard personal information has been disfavored. In re Premera Blue Cross Customer Data Sec. Breach Litig., 198 F. Supp. 3d 1183, 1203 (D. Or. 2016) (applying Washington law) (collecting cases). Moreover,
Plaintiff’s argument that Defendant should have safeguarded his PII does not in itself establish that he was induced to relax any ordinary care with respect to the information such that would support the establishment of a fiduciary relationship. at 1203 (finding that plaintiff's argument that they would not have contracted with defendant had they known it would not safeguard their personal information does not support the establishment of a fiduciary relationship). Therefore, Plaintiff's claim of breach of fiduciary duty is dismissed without leave to amend. ACCORDINGLY, IT IS HEREBY ORDERED: 1. Defendant’s Motion to Dismiss (ECF No. 10) is GRANTED in part. a. Plaintiffs claim for negligence is DISMISSED without prejudice. b. Plaintiff's claims of unjust enrichment and breach of fiduciary duty are DISMISSED with prejudice. c. The Court retains Plaintiff's breach of implied contract claim. 2. Plaintiff may file an Amended Complaint within twenty-one (21) days of this Order consistent with the reasoning above. The District Court Executive is directed to enter this Order and furnish copies to counsel. DATED August 19, 2025.
a Hegwae, 0 Kies oe KS THOMAS O. RICE <=> United States District Judge