Charles Fuller, Octavia Adams, John Shelton, and Elizabeth Ocejo, individually and on behalf of all others similarly situated individuals v. Sefas Innovation, Inc.

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF MASSACHUSETTS

CIVIL ACTION NO. 26-12030-RGS

CHARLES FULLER, OCTAVIA ADAMS, JOHN SHELTON, and ELIZABETH OCEJO, individually and on behalf of all others similarly situated individuals

v.

SEFAS INNOVATION, INC.

MEMORANDUM AND ORDER ON DEFENDANT’S MOTION TO DISMISS

September 3, 2026

STEARNS, D.J. Plaintiffs Charles Fuller, Octavia Adams, John Shelton, and Elizabeth Ocejo filed this putative class action against defendant Sefas Innovation, Inc., for alleged injuries arising out of a data breach that compromised the personally identifiable information (PII) of millions of customers of Frost Bank and Citizens Bank. The Amended Complaint asserts claims for negligence (Count I), breach of third-party beneficiary contract (Count III), unjust enrichment (Count IV), and declaratory judgment/injunctive relief (Count V).1 Sefas moves to dismiss the claims for lack of standing or,

1 The Amended Complaint also includes a claim for negligence per se (Count II). Because plaintiffs have agreed to voluntarily dismiss this count, alternatively, for failure to state a claim upon which relief can be granted. It also moves to strike the class allegations. For the reasons below, the court

will allow in part and deny in part Sefas’s motions. BACKGROUND Accepting all well-pleaded and relevant facts as true (as the court must), the facts are as follows. Sefas is a global software firm that collects

and stores substantial amounts of PII on behalf of enterprise clients, including, as relevant here, Frost Bank and Citizens Bank. In December of 2025, hackers from the Russian cybercriminal syndicate “Everest” breached

Sefas’s servers, gaining access to the PII of millions of Frost Bank and Citizen Bank customers. Over the next four months, the hackers intermittently downloaded files containing customers’ names, addresses, Social Security numbers, and financial account information. Sefas did not discover the

breach until April 16, 2026. Less than a month later, the files were uploaded to the dark web. Since then, they have been viewed by tens of thousands of

the court allows this portion of the motion without further analysis. (The dismissal will be with prejudice, as Massachusetts does not recognize the asserted cause of action.) unknown actors, at least some of whom presumably have malevolent intentions.2

The named plaintiffs are customers of Frost Bank and Citizens Bank who had PII stored by Sefas that was compromised by the breach. After learning of the breach, plaintiffs claim to have suffered anxiety, stress, fear, and frustration; spent extensive time and effort monitoring their accounts;

and suffered diminution in the value of their PII. Plaintiff Fuller further alleges actual misuse of his PII, including “fraudulent charges in his Citizens bank accounts and other unauthorized activity involving his Social Security

number, which has prevented him from opening a new account with other financial institutions.” Am. Compl. [Dkt # 14] ¶ 122. DISCUSSION I. Standing

Article III of the Constitution “limits the judicial power of the federal courts to actual cases and controversies.” Katz v. Pershing, LLC, 672 F.3d 64, 71 (1st Cir. 2012), citing U.S. Const. art. III. § 2, cl. 1. “‘One element of the case-or-controversy requirement’ is that plaintiffs ‘must establish that

they have standing to sue.’” Clapper v. Amnesty Int’l USA, 568 U.S. 398, 408

2 At the time of filing, the Citizens Bank files alone had been viewed 35,692 times. (2013), quoting Raines v. Byrd, 521 U.S. 811, 818 (1997). To establish Article III standing, plaintiffs must satisfy three familiar requirements: “(i) that

[they] ha[ve] suffered or likely will suffer an injury in fact, (ii) that the injury likely was caused or will be caused by the defendant, and (iii) that the injury likely would be redressed by the requested judicial relief.” FDA v. All. for Hippocratic Med., 602 U.S. 367, 380 (2024).

a. Injury in Fact Sefas does not dispute that Fuller, who alleges actual misuse of his PII, has sufficiently satisfied the injury in fact requirement. Because neither

Adams, Shelton, nor Ocejo allege actual misuse of their PII, however, Sefas contends that they have not satisfied the injury in fact requirement. To determine “when the risk of future misuse of PII following a data breach is imminent and substantial,” such that it constitutes an injury in fact

for standing purposes, courts consider: (1) whether the plaintiffs’ data has been exposed as the result of a targeted attempt to obtain that data; (2) whether any portion of the dataset has already been misused, even if the plaintiffs themselves have not yet experienced identity theft or fraud; and (3) whether the type of data that has been exposed is sensitive such that there is a high risk of identity theft or fraud.

Webb v. Injured Workers Pharm., LLC, 72 F.4th 365, 375 (1st Cir. 2023), quoting McMorris v. Carlos Lopez & Assocs., LLC, 995 F.3d 295, 303 (2d Cir. 2021). Here, all three factors favor a finding that plaintiffs have suffered an injury in fact. The court can reasonably infer from the allegations in the Amended Complaint that the attack was targeted, Fuller has plausibly

alleged that his data has already been misused, and the data – which includes Social Security and financial account numbers – is sensitive such that there is a high risk of its being used for identity theft or fraud. To the extent Sefas argues that Adams, Shelton, and Ocejo must

separately identify a concrete harm resulting from the risk of future misuse to pursue damages, the court finds that burden satisfied here. The Amended Complaint alleges that Adams, Shelton, and Ocejo have spent – and will

continue to spend – considerable “time and effort monitoring [their] accounts to protect [themselves] from identity theft.” Am. Compl. ¶¶ 138, 153, 165. Although Sefas characterizes this harm as self-imposed, the First Circuit has found similar allegations sufficient to establish a concrete injury

where the threat of misuse is otherwise imminent and substantial. See Webb, 72 F.4th at 376-377. b. Traceability Sefas next challenges traceability, arguing that plaintiffs – including

Fuller – have not sufficiently linked the risk of misuse to its data leak. The court is not persuaded. All four named plaintiffs allege that their monitoring efforts began in direct response to the Sefas attack. See Santos-Pagan v. Bayamon Med. Ctr., 178 F.4th 66, 71-72 (1st Cir. 2026) (“[A]n injury in fact is ‘fairly traceable’ to the defendant’s conduct if there is ‘a causal connection

between the injury and the conduct complained of.’”), quoting Conservation L. Found., Inc. v. Acad. Express, LLC, 129 F.4th 78, 90 (1st Cir. 2025). Fuller, moreover, alleges that the fraudulent charges in his Citizens Bank account – the specific account associated with PII stored by Sefas – and

misuse of his Social Security number only began after the hackers uploaded the files they obtained from Sefas. Given the close temporal proximity of events (the next most recent data incident involving Fuller, in contrast,

occurred five years earlier, in 2021, see Lisiewski Decl. [Dkt # 18-1] ¶ 6) and the actual misuse of an account associated with Sefas, plaintiffs have satisfied their burden as to traceability. II. Failure to State a Claim

“To survive a motion to dismiss, a complaint must contain sufficient factual matter, accepted as true, to ‘state a claim to relief that is plausible on its face.’” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009), quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007). Two basic principles guide the

court’s analysis. “First, the tenet that a court must accept as true all of the allegations contained in a complaint is inapplicable to legal conclusions.” Iqbal, 556 U.S. at 678. “Second, only a complaint that states a plausible claim for relief survives a motion to dismiss.” Id. at 679. A claim is facially plausible if its factual content “allows the court to draw the reasonable

inference that the defendant is liable for the misconduct alleged.” Id. at 678. a. Negligence “The elements of a negligence claim are that ‘the defendant owed the plaintiff a duty of reasonable care, that the defendant breached this duty, that

damage resulted, and that there was a causal relation between the breach of the duty and the damage.’” Correa v. Schoeck, 479 Mass. 686, 693 (2018), quoting Jupin v. Kask, 447 Mass. 141, 146 (2006). Sefas challenges whether

plaintiffs have satisfied their pleading burden as to any of these elements. Sefas first argues that, because its contracts were with Citizens Bank and Frost Bank and not plaintiffs, it did not owe plaintiffs any independent duty of care. At least some courts, however, have concluded that a party

storing an individual’s PII has an inherent duty of care to safeguard that information. See Portier v. NEO Tech. Sols., 2019 WL 7946103, at *11 (D. Mass. Dec. 31, 2019), report and recommendation adopted, 2020 WL 877035 (D. Mass. Jan. 30, 2020); Webb v. Injured Workers Pharmacy, LLC

(Webb II), 2023 WL 5938606, at *2 (D. Mass. Sept. 12, 2023). Given this precedent, the court declines to dismiss for failure to plead duty at this stage. Sefas next contends that, even if a duty exists, the Amended Complaint fails to plausibly plead breach of that duty. But the Amended Complaint is

replete with examples of reasonable safety measures which Sefas allegedly could and should have employed to safeguard PII. See, e.g., Am. Compl. ¶¶ 51-54. Sefas does not engage with these allegations or explain why they do not suffice to plausibly establish a failure “to implement proper safeguards

to protect against a data breach.” Webb II, 2023 WL 5938606, at *2. As to damages and causation, Sefas makes the same arguments previously raised with respect to standing. The court rejects those arguments

here for the same reasons discussed above. Finally, Sefas asserts that any negligence claim is barred by the economic loss doctrine, which requires a tangible physical injury to person or property. But as this session previously noted in similar circumstances,

at least some “cases have held that the ‘personal injury’ [requirement] can be satisfied by a claim of emotional distress.” Webb II, 2023 WL 5938606, at *3, quoting McCormick v. Lischynsky, 2019 WL 3429242, at *5 (D. Mass. July 30, 2019). The court finds plaintiffs’ allegations of emotional distress

sufficiently specific and tangible (at least at this stage in proceedings) to satisfy the personal injury requirement. b. Breach of Third-Party Beneficiary Contract To state a claim for breach of a third-party beneficiary contract, “a plaintiff must show that the defendant and the lessor intended to give her the

benefit of the promised performance.” Anderson v. Fox Hill Vill. Homeowners Corp., 424 Mass. 365, 366 (1997). “A party is an intended beneficiary where ‘the circumstances indicate that the promisee intends to give the beneficiary the benefit of the promised performance.’” Spinner v.

Nutt, 417 Mass. 549, 555 (1994), quoting Rae v. Air-Speed, Inc., 386 Mass. 187, 194 (1982). Although the court agrees with Sefas that the allegations of

intentionality are conclusory, without access to the relevant contracts, it is not clear what additional information plaintiffs could include to support the claim. Because the court can otherwise reasonably infer the existence of some intended benefit to plaintiffs from the nature of the underlying

contracts (which concerned the storage and protection of customers’ PII), it denies the motion to dismiss the third-party beneficiary claim. c. Unjust Enrichment “Unjust enrichment is defined as ‘retention of money or property of

another against the fundamental principles of justice or equity and good conscience.’” Santagate v. Tower, 64 Mass. App. Ct. 324, 329 (2005), quoting Taylor Woodrow Blitman Constr. Corp. v. Southfield Gardens Co., 534 F. Supp. 340, 347 (D. Mass. 1982). “To state a claim, a plaintiff ‘must show (1) a benefit conferred upon defendant by plaintiff, (2) an appreciation

or knowledge by defendant of the benefit, and (3) that acceptance or retention of the benefit under the circumstances would be inequitable without payment for its value.’” Doe v. Tenet Healthcare Corp., 731 F. Supp. 3d 142, 150-151 (D. Mass. 2024), quoting Infinity Fluids Corp. v. Gen.

Dynamics Land Sys., Inc., 210 F. Supp. 3d 294, 309 (D. Mass. 2016). The Amended Complaint fails to plausibly allege that plaintiffs conferred any benefit on Sefas. Sefas instead indisputably obtained

plaintiffs’ PII from Frost Bank and Citizens Bank. The court accordingly allows the portion of the motion directed to Count IV. d. Declaratory Judgment or Injunctive Relief The court declines to opine on the propriety of declaratory or injunctive

relief at this stage in the proceedings. It needs the benefit of further development of the factual record before it may make an informed decision as to whether declaratory relief is duplicative or there is a risk of future harm sufficient to support the imposition of an injunction.

III. Motion to Strike Sefas asks the court to strike the class allegations from the Amended Complaint. But striking class allegations is a disfavored remedy and should only be employed when “it is obvious from the pleadings that the proceeding cannot possibly move forward on a classwide basis.” Manning v. Bos. Med.

Ctr. Corp., 725 F.3d 34, 59 (1st Cir. 2013). Because the court is not convinced from the face of Amended Complaint that the action could not proceed on a classwide basis, the motion is denied. ORDER

For the foregoing reasons, Sefas’s motion to dismiss is ALLOWED IN PART and DENIED IN PART. Counts II and IV are dismissed. The remaining claims will proceed to discovery.

SO ORDERED. /s/ Richard G. Stearns UNITED STATES DISTRICT JUDGE