Christina Collins, individually and on behalf of all others similarly situated v. Eckerd Youth Alternatives

Opinion

UMNIIDTEDDL ES TDAISTTERS IDCITS TORFI FCLTO CROIDUART TAMPA DIVISION

CHRISTINA COLLINS, individually and on behalf of all others similarly situated,

Plaintiff,

v. CASE NO. 8:26-cv-00044-SDM-AAS

ECKERD YOUTH ALTERNATIVES,

Defendant

___________________________________/

ORDER

Christina Collins, the putative representative of a class, sues (Doc. 20) Eckerd Youth Alternatives and alleges negligence, negligence per se, breach of implied contract, unjust enrichment, and breach of confidence. The defendant moves to dismiss (Doc. 29), and the plaintiff responds (Doc. 31). BACKGROUND The defendant "is a national non-profit dedicated to . . . workforce de- velopment, child and family services, and Job Corps education and training." (Doc. 20 n.2 at 2) On November 11, 2024, the defendant discovered that, be- tween November 3 and November 11, 2024, an unauthorized third party had accessed the defendant's data. (Doc. 20 ¶¶ 2, 5–6) On November 17, 2025, the defendant determined that the breach potentially compromised clients' personal information — first and last names, addresses, dates of birth, Social Security numbers, driver's license numbers, tax-identification numbers, and medical information.1 (Doc. 20 ¶¶ 6–7 and n. 3 at 2) On December 17, 2025 — 401 days after detecting the breach and thirty days after determining that the

breach compromised clients' information — the defendant filed a "Data Breach Notice" with the Maine Attorney General, notified the affected per- sons, and offered "complimentary credit monitoring services through Experian IdentityWorks . . . for 12 months as a precaution." (Doc. 20 ¶ 8; Doc. 20-1) On December 29, 2025, Collins, who had provided personal infor-

mation to the defendant, discovered four unauthorized transactions totaling $114 on a bank statement and, shortly thereafter, an attempted $500 charge on another account (Doc. 20 ¶¶ 136, 138). That same month, the IRS mailed Col- lins a past-due invoice for $4,000 in taxes on property falsely titled in Collins' name and suspended Collins' Social Security payments, deducting $200 from a

check otherwise due in full. (Doc. 20 ¶¶ 139, 141–142) In February 2026, Col- lins learned that an unknown person had applied for a $20,000 loan in Collins' name. (Doc. 20 ¶ 143)

1 Data Breach Notices, OFFICE OF THE MAINE ATTORNEY GENERAL, Eckerd Youth Alternatives (https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2- 8792-a1252b4f8318/3feda70c-fe80-491e-accf-4857d5d95918.html). DISCUSSION Negligence, Negligence Per Se, and Breach of Implied Contract For one or more reasons stated in the complaint and in the plaintiff’s re-

sponse to the motion to dismiss, the plaintiff states a claim for negligence and for breach of implied contract.2 For one or more reasons stated in the motion to dismiss and as conceded in the response, the plaintiff fails to state a claim for negligence per se. (Doc. 31 at 13) Unjust Enrichment

Under Florida law, "a claim for unjust enrichment requires that: (1) the plaintiff has conferred a benefit on the defendant; (2) the defendant has knowledge of the benefit; (3) the defendant has accepted or retained the benefit conferred; and (4) the circumstances are such that it would be inequitable for the defendant to retain the benefit without paying fair value for it." In re

Brinker Data Incident Litig., 2020 WL 691848, at *10 (M.D. Fla. Jan. 27, 2020) (citing Della Ratta v. Della Ratta, 927 So. 2d 1055, 1059 (Fla. 4th DCA 2006)). The plaintiff alleges that the class members "conferred a benefit upon De- fendant by providing Defendant with their Private Information," that the class members "understood that part of the benefit Defendant derived from the Pri-

vate Information would be applied to data security efforts," and that some of

2 As to the claims of negligence and breach of implied contract, the defendant dis- putes the element of causation only, which the complaint plausibly alleges. the "payments" the class members "made to Defendant would be applied to the costs of maintaining adequate security measures." (Doc. 20 ¶¶ 201–202) The plaintiff identifies no authority holding the routine provision of personal information to confer a benefit. And the unjust-enrichment count contains the

complaint's only allegation that the class members paid the defendant — a "national non-profit." To the extent the alleged "payments" consist of money, such an "unadorned conclusory allegation" cannot survive a motion to dis- miss. Allgood v. PaperlessPay Corp., 2022 WL 846070, at *10 (M.D. Fla. Mar. 22, 2022) (citing Vibo Corp. v. US Flue-Cured Tobacco Growers, Inc., 762 F. Appx.

703, 705–06 (11th Cir. 2019)). Breach of Confidence Breach of confidence is "the unconsented, unprivileged disclosure to a third party of nonpublic information that the defendant has learned within a confi- dential relationship." Muransky v. Godiva Chocolatier, Inc., 979 F.3d 917, 931–32

(11th Cir. 2020) (en banc) (citing Alan B. Vickery, “Breach of Confidence: An Emerging Tort,” 82 Colum. L. Rev. 1426, 1455 (1982)). Black's Law Dictionary defines "disclosure" as "[t]he act or process of making known something that was previously unknown[.]" Disclosure, Black’s Law Dictionary (11th ed. 2019);

see also Allgood, 2022 WL 846070, at *12 (adopting the Black's Law definition of "disclosure" in a breach-of-confidence claim). As in Allgood, the plaintiff offers "no allegations suggesting that [the defend- ant] did any act to disclose or make known" the personal information; rather, that information "was allegedly stolen by an unauthorized third-party." Be- cause the complaint alleges no disclosure by the defendant, the breach-of-con- fidence claim fails. Allgood, 2022 WL 846070, at *12; see also In re Brinker, 2020 WL 691848, at *22 ("Even assuming, arguendo, that [the defendant's] inade- quate security facilitated the theft, such a claim would lie in negligence not breach of confidence."). CONCLUSION The motion to dismiss is GRANTED-IN-PART AND DENIED-IN- PART. The claims for negligence per se, unjust enrichment, and breach of con- fidence are DISMISSED WITHOUT PREJUDICE. No later than JULY 30, 2026, the plaintiff must amend the complaint. ORDERED in Tampa, Florida, on July 9, 2026. Asdornnsgig STEVEN D. MERRYDAY UNITED STATES DISTRICT JUDGE

-5-