UNITED STATES DISTRICT COURT WESTERN DISTRICT OF LOUISIANA LAFAYETTE DIVISION
MOISES CASTILLO CASE NO. 6:24-CV-01723
VERSUS JUDGE JAMES D. CAIN, JR.
BERRY BROS GENERAL MAGISTRATE JUDGE CAROL B. CONTRACTORS INC WHITEHURST
MEMORANDUM RULING Before the court are a Motion to Dismiss for Lack of Jurisdiction and Motion to Dismiss for Failure to State a Claim [doc. 8], filed by defendant Berry Bros. General Contractors, Inc. under, respectively, Federal Rules of Civil Procedure 12(b)(1) and 12(b)(6). Plaintiff Moises Castillo opposes the motion. Doc. 14. I. BACKGROUND
This suit arises from an August 2024 data breach impacting defendant, who was plaintiff’s employer, and the alleged resulting theft of personally identifiable information (“PII”) of defendant’s customers and employees. Plaintiff alleges that he received a Notice Letter in October 2024, “stating that his ‘first and las[t] name as well as his Social Security’ were contained in files obtained by an ‘unauthorized third party.’” Doc. 1, ¶ 72. As a result, and based on the recommendation in the Notice Letter, plaintiff “made reasonable efforts to mitigate the effect of the Data Breach, including, but not limited to, researching the Data Breach and monitoring his credit and financial statements.” Id. at ¶ 73. He also alleges that the 24 months of credit monitoring offered by defendant is “wholly inadequate” because it does not account for the fact that financial fraud may occur years after such an occurrence. Id. at ¶ 79. Accordingly, he maintains that he will continue to spend “valuable time he
otherwise would have spent on other activities” responding to the data breach. Id. at ¶ 74. Plaintiff filed suit in this court on December 11, 2024, on behalf of himself and a prospective class of other individuals whose PII was compromised by the 2024 Berry Bros. data breach. He raises claims of negligence, breach of implied contract, and unjust enrichment. Defendant now moves to dismiss the suit, arguing that (1) plaintiff cannot satisfy the jurisdictional requirements of the Class Action Fairness Act (“CAFA”), 28
U.S.C. § 1332(d), because there is nothing in the complaint to support a good faith assumption that the class’s damages will exceed $5 million; (2) plaintiff lacks standing to pursue his claims because he has not suffered an injury in fact; and (3) plaintiff fails to state a valid claim for relief. Doc. 8. Plaintiff opposes the motions and requests leave to amend his complaint if any deficiencies are found. Doc. 14.
II. LAW & APPLICATION
A. Legal Standards 1. Rule 12(b)(1) A motion under Rule 12(b)(1) attacks the court's jurisdiction to hear and decide the case. FED. R. CIV. P. 12(b)(1). The burden lies with the party seeking to invoke the court's jurisdiction. Ramming v. United States, 281 F.3d 158, 161 (5th Cir. 2001). Lack of subject matter jurisdiction may be found based on: (1) the complaint alone; (2) the complaint supplemented by undisputed facts in the record; or (3) the complaint supplemented by undisputed facts plus the court's resolution of disputed facts. Id. No party has requested an evidentiary hearing and the court finds that they have had adequate opportunity to present
their arguments based on the record. 2. Rule 12(b)(6) Rule 12(b)(6) allows for dismissal when a plaintiff “fail[s] to state a claim upon which relief can be granted.” When reviewing such a motion, the court should focus on the complaint and its attachments. Wilson v. Birnberg, 667 F.3d 591, 595 (5th Cir. 2012). The court can also consider documents referenced in and central to a party’s claims, as well as
matters of which it may take judicial notice. Collins v. Morgan Stanley Dean Witter, 224 F.3d 496, 498–99 (5th Cir. 2000); Hall v. Hodgkins, 305 Fed. App’x 224, 227 (5th Cir. 2008) (unpublished). Such motions are reviewed with the court “accepting all well-pleaded facts as true and viewing those facts in the light most favorable to the plaintiff.” Bustos v. Martini Club,
Inc., 599 F.3d 458, 461 (5th Cir. 2010). However, “the plaintiff must plead enough facts ‘to state a claim to relief that is plausible on its face.’” In re Katrina Canal Breaches Litig., 495 F.3d 191, 205 (5th Cir. 2007) (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). Accordingly, the court’s task is not to evaluate the plaintiff’s likelihood of success but instead to determine whether the claim is both legally cognizable and plausible. Lone
Star Fund V (U.S.), L.P. v. Barclays Bank PLC, 594 F.3d 383, 387 (5th Cir. 2010). B. Application 1. CAFA jurisdiction
The court must consider any jurisdictional attack before proceeding to the merits. Ramming v. United States, 281 F.3d 158, 161 (5th Cir. 2001). The undersigned thus turns first to defendant’s assertion that the court lacks subject matter jurisdiction because the amount in controversy requirement is not satisfied. Jurisdiction under CAFA requires minimal diversity between the parties and an aggregate amount in controversy for the class in excess of $5 million. 28 U.S.C. § 1332(d)(2); Smith v. Am. Pain and Wellness, PLLC,
747 F.Supp.3d 989, 999 (E.D. Tex. 2024) (citing Mississippi ex rel. Hood v. AU Optronics Corp., 571 U.S. 161, 166 (2014)). The plaintiff can ordinarily satisfy his burden by claiming a sum greater than the jurisdictional amount, and “[t]he required demonstration” concerns what he is claiming rather than his chances of success. Id. (citing Robertson v. Exxon Mobil Corp., 814 F.3d 236, 240 (5th Cir. 2015)).
Plaintiff asserts that this court has subject matter jurisdiction over his putative class action under CAFA, 28 U.S.C. § 1332(d), because “[t]he amount in controversy exceeds $5 million, exclusive of interest and costs” and there are at least 100 potential class members with minimal diversity. Doc. 1, ¶ 20. His only present injury appears to be the emotional harm he has allegedly suffered as a result of the data breach. He admits that
defendant has provided 24 months of credit monitoring, which is still ongoing. He also requests, however, “not less than ten years of credit monitoring services” for himself and the class as well as equitable relief requiring better data protection measures from defendant. Id. at ¶ 115. In reliance on a recent decision from the Eastern District of Louisiana, defendant maintains that the jurisdictional amount is not satisfied because plaintiff has not yet
sustained any financial losses as a result of the data breach. Bednyak v. Financial Risk Mitigation, Inc., 739 F.Supp.3d 353, 362 n. 5 (E.D. La. 2024). Plaintiff’s risk of future injury is an issue of standing, which the court will explore below. As to the jurisdictional amount, other courts have considered the cost of future credit monitoring in determining whether a data breach class action can meet CAFA’s $5 million jurisdictional threshold. See, e.g., Morales v. Conifer Revenue Cycle Solutions, LLC, 2023 WL 5236729, at *3–*4
(C.D. Cal. Aug. 15, 2023); Caudle v. Towers, Perrin, Forster & Crosby, Inc., 580 F.Supp.2d 273, 276–77 (S.D.N.Y. 2008). Plaintiff provides no valuation of the costs of his demands, but a court recently found that the cost of credit monitoring for the from TransUnion is $29.95 per month. Morales, 2023 WL 5236729, at *3. This equals $3,594.00 for the requested ten years of credit monitoring from just one service for each member of the
prospective class. Plaintiff alleges that 6,210 individuals were affected by the data breach. Doc. 1, ¶ 99. Ten years of credit monitoring from TransUnion for all of these individuals will cost at least $22,318,740.00. Accordingly, the amount in controversy requirement is satisfied without the court even attempting to value the other requests for relief. 2. Standing
For a case or controversy to exist under Article III of the Constitution, the plaintiff must have standing to sue. TransUnion LLC v. Ramirez, 594 U.S. 413, 423 (2021). Standing requires an injury that is “concrete, particularized, and actual or imminent; fairly traceable to the challenged action; and redressable by a favorable ruling.” Clapper v. Amnesty Intern. USA, 568 U.S. 398, 409 (2013) (internal quotations omitted). “If the plaintiff does not claim to have suffered an injury that the defendant caused and the court can remedy, there is no
case or controversy for the federal court to resolve.” TransUnion, 594 U.S. at 423. With more frequent data breach claims, a circuit split has arisen over whether the mere exposure of PII to unauthorized actors, without misuse or risk of misuse, constitutes an injury. The Eleventh and Fourth Circuits typically require the misuse of PII before recognizing an injury on a claim arising from a data breach.1 See Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883, 889 (11th Cir. 2023), cert. denied sub nom. Brinker Int’l, Inc. v.
Steinmetz, 144 S.Ct. 1457 (2024); O’Leary v. TrustedID, Inc., 60 F.4th 240, 244 (4th Cir. 2023). The Second Circuit, on the other hand, holds that the mere exposure of “private PII” (such as a Social Security number) inflicts an injury in fact based on the costs a plaintiff must then incur mitigating the risk of identity theft and fraud. Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276, 285–86 (2nd Cir. 2023). Additionally, the First
and Third Circuits found standing in data breach cases where the allegations established an imminent and substantial risk that the plaintiff’s PII would be misused. Webb v. Injured Workers Pharmacy, LLC, 72 F.4th 365, 370 (1st Cir. 2023); Clemens v. ExecuPharm Inc., 48 F.4th 146, 157–58 (3d Cir. 2022). The Fifth Circuit has only briefly considered the issue in an unpublished case,
finding that the mere risk of future fraud after a data breach was too speculative too support
1 For the Eleventh Circuit, “misuse” is broad enough to encompass plausible allegations that the plaintiff’s credit card and personal information was posted for sale on the “dark web.” Green-Cooper, 73 F.4th at 889–90. standing.2 See Ellis v. Cargill Meat Solutions, 2024 WL 4692024, at *3 (5th Cir. 2024). But some courts within this circuit have nonetheless followed Webb and Clemens, holding that
a plaintiff may establish standing based on the emotional injury he receives and mitigation measures he undertakes after the exposure of his PII places him at a substantial risk of fraud. See Smith v. Am. Pain and Wellness, PLLC, 747 F.Supp.3d 989, 1002 (E.D. Tex. 2024); Hays v. Frost & Sullivan, Inc., 2024 WL 4052741, at *5–*7 (W.D. Tex. Aug. 16, 2024), report and recommendation adopted, 2024 WL 4047166 (W.D. Tex. Sep. 4, 2024); In re ESO Solutions, Inc. Breach Litig., 2024 WL 4456703, at *5–*6 (W.D. Tex. Jul. 30,
2024); cf. Bednyak, 739 F.Supp.3d at 368–69 (rejecting data breach plaintiff’s claimed injuries because “there is no reason to believe based on the allegations in the complaint, that any of those thus-far non-materialized potential harms are either imminent or certainly impending.”). These courts build on Fifth Circuit precedent. In Perez v. McCreary, Veselka, Bragg
& Allen, P.C., 45 F.4th 816 (5th Cir. 2022), the court considered causes of action arising from a law firm sending debt collection letters without disclosing that the limitations on the debt had run. Plaintiff argued, in relevant part, that the letter she received “subjected her to a material risk of financial harm,” namely the risk that she might pay her time-barred debts, “and that that exposure qualifies as a concrete injury.” 45 F.4th at 824. The panel
rejected this argument, holding that “if a risk hasn’t materialized, [then] the plaintiff hasn’t
2 Defendant argues that Ellis “is now binding precedent,” doc. 15, p. 2, but the case was not designated for publication. Under Fifth Circuit Rule 47.5.4, “[u]npublished opinions issued on or after January 1, 1996, are not precedent, except under the doctrine of res judicata, collateral estoppel or law of the case (or similarly to show double jeopardy, notice, sanctionable conduct, entitlement to attorney’s fees, or the like).” yet been injured.” Id. It allowed, however, that a plaintiff could “sue for damages if the risk materializes or causes a separate injury-in-fact, such as emotional distress.” Id. at 822. Just
so here. Plaintiffs in this suit and the others cited from around the circuit are suing to recover based on the real costs they have incurred to mitigate against a materialized risk and for the emotional injury they suffered as a result. Above all, however, the court bears in mind that the risk must be “substantial.” The Third Circuit has adopted useful guideposts in making the determination, drawing on a framework developed by the Second Circuit in another data breach case. See Clemens, 48
F.4th at 156–57 (citing McMorris v. Carlos Lopez & Assocs., 995 F.3d 295 (2d Cir. 2021)). To this end, the court should consider (1) whether the plaintiff’s data was exposed due to a targeted attempt or an inadvertent disclosure; (2) whether any portion of the data set has already been misused, even if plaintiff has not yet experienced identity theft or fraud; and (3) whether the type of data exposed is sensitive in nature, such as names and Social
Security numbers (as opposed to solely account numbers or banking information), creating a high risk of identity theft or fraud. Id. Plaintiff alleges that the PII held by defendant, and presumably accessed through the data breach, included names and Social Security numbers of defendant’s employees as well as financial account information and contact information of its customers. Doc. 1,
¶¶ 24–25. He further alleges, citing defendant’s Notice Letter, that a “network disruption” occurred on August 21, 2024, which defendant investigated. Id. at ¶ 29. As a result of this investigation, defendant determined “that certain files may have been accessed and/or acquired without authorization” and upon review of these files, “learned that some of your personal information was contained within the potentially affected data[.]” Id. Beyond that, there is little information on the nature of the attack or the degree to which PII was actually
accessed or misused. But the court’s obligation at this time is to accept the well-pleaded allegations and construe them in a light most favorable to plaintiff. The allegations plausibly demonstrate a data breach satisfying the first and third McMorris factors, and the second may yet be satisfied after discovery. Accordingly, plaintiff has demonstrated standing and the Motion to Dismiss for Lack of Jurisdiction will be denied.
3. Negligence Defendant next argues that plaintiff fails to state a claim for negligence under Louisiana law because his damages are speculative. Louisiana courts determine liability for negligence based on duty-risk analysis. Long v. State ex rel. Dept. of Transp. and Dev., 916 So.2d 87, 101 (La. 2005). Through this test the plaintiff must show all of the following: (1) the defendant had a duty to conform his conduct to a specific standard (the duty element); (2) the defendant's conduct failed to conform to the appropriate standard (the breach element); (3) the defendant's substandard conduct was a cause in fact of the plaintiff's injuries (the cause-in-fact element); (4) the defendant's substandard conduct was a legal cause of the plaintiff's injuries (the scope of liability or scope of protection element); and (5) the actual damages (the damages element).
Audler v. CBC Innovis, Inc., 519 F.3d 239, 249 (5th Cir. 2008) (citing Lemann v. Essen Lane Daiquiris, Inc., 923 So.2d 627, 633 (La. 2006)). “Under Louisiana law, damages must be proved with legal certainty” and “[s]peculative damages may not be recovered.” Pinero v. Jackson Hewitt Tax Service Inc., 594 F.Supp.2d 710, 715 (E.D. La. 2009) (citing FDIC v. Barton, 233 F.3d 859, 864–65 (5th Cir. 2000)). Thus, “[a] number of courts have held that the allegation of increased risk of identity theft, without more, does not amount to actual damage.” Id. (collecting cases). But here plaintiff has alleged more: namely, the present emotional distress he experiences due to a substantial risk of identity theft and the
costs he will incur, both monetary and in terms of lost time, to mitigate this risk. To the extent these injuries can be proven, they are compensable. See, e.g., Spencer v. Valero Refining Meraux, LLC, 356 So.3d 936, 948–49 (La. 2023) (discussing standards applicable to emotional distress claims); Attias v. CareFirst, Inc., 865 F.3d 620, 629 (D.C. Cir. 2017) (costs of responding to data breach were redressable “when combined with a risk of future harm that is substantial enough to qualify as an injury in fact.”). Plaintiff therefore satisfies
the actual damages element of his negligence claim and there is no basis for dismissal. 4. Breach of implied contract Defendant also requests that the court dismiss plaintiff’s claim for breach of implied contract, arguing that (1) there was no agreement between the parties regarding the safety of plaintiff’s data and (2) even if such an agreement existed, plaintiff fails to demonstrate
that defendant’s alleged breach resulted in any damages. The second argument was addressed above and the court adopts the same conclusion here. As for the first, a contract may be express or implied in fact under Louisiana law. Jones v. Adm’rs of Tulane Educ. Fund, 51 F.4th 101, 113 (5th Cir. 2022). An implied in fact contract is “one which rests upon consent implied from facts and circumstances
showing mutual intention to contract.” Id. (citing Morphy, Makofsky & Masson, Inc. v. Canal Place 2000, 538 So.2d 569, 573 (La. 1989)). Such contracts are no different in effect from express, written agreements. Miazza v. Bd. of Supervisors of La. State Univ. and Ag. Mech. College, 394 So.3d 874, 880 (La. Ct. App. 1st Cir. 2024). Plaintiff alleges that, when he and class members provided private information to defendant “in exchange for employment and/or services, they entered implied contracts
with Defendant under which Defendant agreed to reasonably protect such information.” Doc. 1, ¶ 122. In contrast to Hays, 2024 WL 4052741 at * 9, where plaintiff also alleged the existence of other documents describing the employer’s policies of data retention and protection, plaintiff in this matter does not point to any particular documents supporting his belief that the personal information provided to his employer would be protected. But “it is difficult to imagine how, in our day and age of data and identity theft, the mandatory
receipt of Social Security numbers or other sensitive personal information would not imply the recipient’s assent to protect the information sufficiently.” McFarlane v. Altice, USA, Inc., 524 F.Supp.3d 264, 282 (S.D.N.Y. 2021) (quoting Castillo v. Seagate Tech., LLC, 2016 WL 9280242, at *9 (N.D. Cal. Sep. 14, 2016)). So too for the financial account and contact information that defendant “collects and stores . . . from customers[.]” Doc. 1, ¶
25. Accordingly, plaintiff has provided sufficient allegations to support a claim for implied breach of contract. 5. Unjust enrichment Defendant next moves to dismiss plaintiff's claim for unjust enrichment on several grounds, including that the claim is a remedy of last resort and precluded by plaintiff's
pleading of other causes of action. See La. Civ. Code art. 2298 (the remedy of unjust enrichment is subsidiary “and shall not be available if the law provides another remedy for the impoverishment or declares a contrary rule.”). It is the existence of another cause of action—rather than its likelihood of success or failure—that defines the availability of the remedy. Garber v. Badon & Ranier, 981 So.2d 92, 100 (La. Ct. App. 3d Cir. 2008). In other words, “[t]he mere fact that a plaintiff does not successfully pursue another remedy
does not give the plaintiff a right to recover under a theory of unjust enrichment.” Pine Grove Elec. Supply Co., Inc. v. Cat Key Constr., Inc., 88 So.3d 1097, 1101 (La. Ct. App. 5th Cir. 2012). Plaintiff does not address this argument. The fact that he maintains breach of contract and negligence claims against defendant, however, precludes him from pursuing a remedy through unjust enrichment. E.g., Zaveri v. Condor Petrol. Corp., 27 F.Supp.3d 695, 701 (W.D. La. 2014); Jacques v. Baker Hughes, 2021 WL 1271027, at *7
(W.D. La. Apr. 6, 2021) (citing Walters v. MedSouth Record Mgmt., LLC, 38 So.3d 245, 246 (La. 2010)). The motion will therefore be granted as to this claim. 6. Declaratory and injunctive relief Finally, defendant moves to dismiss plaintiff’s requests for declaratory and injunctive relief because these “are remedies and not independent causes of action,” which
are only available when supported by a valid claim. As described above, however, plaintiff’s allegations support valid claims for relief. The motion will thus be denied in this respect. Il. CONCLUSION For the reasons stated above, the Motion to Dismiss for Lack of Jurisdiction [doc. 8] will be DENIED and the Motion to Dismiss for Failure to State a Claim [id.] will be GRANTED as to the unjust enrichment claim and DENIED in all other respects. Plaintiff’s claim for unjust enrichment will therefore be DISMISSED WITH PREJUDICE. THUS DONE AND SIGNED in Chambers on the 8th day of April, 2025.
UNITED STATES DISTRICT JUDGE
Page 13 of 13