Clifton Wilkins, et al. v. English Construction Company, Inc.

• Court: District Court, W.D. Virginia
• Decided: March 9, 2026
• Docket: 6:24-cv-00059
• Status: Unknown

Opinion

CLERKS OFFICE U.S. DIST. COURT AT LYNCHBURG, VA UNITED STATES DISTRICT COURT rhED WESTERN DISTRICT OF VIRGINIA 3/9/2026 LYNCHBURG DIVISION Oye AMENEATLE DEPUTY CLERK CLIFTON WILKINS, ET AL., Plaintiffs, CASE NO. 6:24-CV-00059 v. ENGLISH CONSTRUCTION COMPANY, MEMORANDUM OPINION INC., Defendant. JUDGE NORMAN K. Moon

The facts of this case are straightforward. English Construction Company (“English”) collected its employees’ personally identifiable information (“PII”), its computer system was hacked by cyber-criminals, and its employees’ PII was stolen. See Dkt. 4. Based on that data breach, 6,700 current and former employees (“Plaintiffs”) are suing English, alleging four state law claims: negligence, negligence per se, breach of implied contract, and breach of bailment. /d. Even though Plaintiffs’ claims arise under Virginia law and the parties are non-diverse, Plaintiffs filed their case in this Court relying on the Class Action Fairness Act (“CAFA”), which confers Jurisdiction on federal courts when: (1) the putative class has more than 100 members; (2) the amount-in-controversy exceeds $5,000,000, and (3) there is minimal diversity. See 28 U.S.C. § 1332(d)(2), (5)(B). English moves to dismiss Plaintiffs’ claims, arguing: (1) they lack Article III standing; (2) the Court should decline jurisdiction under CAFA’s discretionary home-state exception; and (3) Virginia law does not recognize Plaintiffs’ privacy-related claims. Dkt. 10. Although the Court has subject matter jurisdiction, it will nonetheless decline to hear this case based on CAFA’s discretionary home-state exception. Accordingly, English’s motion will be granted.

I. LEGAL STANDARDS

A. Fed. R. Civ. P. 12(b)(1)

A Rule 12(b)(1) motion tests a district court’s subject matter jurisdiction. Where, as here, a defendant argues that a plaintiff fails to allege facts upon which subject matter jurisdiction can be based, the facts alleged in the complaint are assumed to be true, as is the case with a Rule 12(b)(6) motion. See Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982). The plaintiff, as the party invoking the court’s jurisdiction, bears the burden of establishing it. Id. B. Fed. R. Civ. P. 12(b)(6)

A Rule 12(b)(6) motion tests the complaint’s legal sufficiency. To survive a motion to dismiss, the complaint’s “[f]actual allegations must be enough to raise a right to relief above the speculative level,” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 555 (2007); however, all allegations in the complaint are taken as true and all reasonable inferences must be drawn in plaintiff’s favor. See King v. Rubenstein, 825 F.3d 206, 212 (4th Cir. 2016). Although the complaint “does not need detailed factual allegations, a plaintiff’s obligation to provide the ‘grounds’ of his entitle[ment] to relief requires more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555. A court need not “accept the legal conclusions drawn from the facts” or “accept as true unwarranted inferences, unreasonable conclusions, or arguments.” Simmons v. United Mortg. & Loan Inv., LLC, 634 F.3d 754, 768 (4th Cir. 2011. This is not to say Rule 12(b)(6) requires “heightened fact pleading of specifics,” instead the plaintiff must plead “only enough facts to state a claim to relief that is plausible on its face.” Twombly, 550 U.S. at 570; see also Ashcroft v. Iqbal, 556 U.S. 662, 679 (2009) (“[O]nly a complaint that states a plausible claim for relief survives a motion to dismiss.”). II. ANALYSIS

A. Article III Standing1

As a threshold matter, the Court must assess its own subject matter jurisdiction before turning to English’s other arguments. See Reddy v. Buttar, 38 F.4th 393, 399 (4th Cir. 2022) (before deciding the merits of a particular argument, the court must confirm it has “the power to make the determination.”). If Plaintiffs lack standing, as English argues, the case goes no further. A federal court may only resolve “a real controversy with real impact on real persons.” TransUnion LLC v. Ramirez, 594 U.S. 413, 424 (2021) (citation omitted). For there to be a “case” or “controversy,” as required by Article III, a plaintiff must have a “personal stake” in the case— i.e., standing. See Raines v. Byrd, 521 U.S. 811, 819 (1997). To establish standing, Plaintiffs must show that: “(i) [they] suffered an injury in fact that is concrete, particularized, and actual or imminent; (ii) the injury was likely caused by the defendant; and (iii) the injury would likely be redressed by judicial relief.” TransUnion, 594 U.S. at 424 (citing Lujan v. Defenders of Wildlife, 504 U.S. 555, 560–561 (1992)). Here, English challenges whether its current and former employees have alleged an injury-in-fact sufficient to satisfy Article III. Dkt. 10. Specifically, English argues that no Plaintiff has alleged that their PII has been misused, and therefore, their fears about future financial harm are purely hypothetical. Id. An injury in fact “must be both concrete and particularized.” Penegar v. Liberty Mut. Ins. Co., 115 F.4th 294, 299 (4th Cir. 2024) (citation omitted). An injury is particularized so long as it “affect[s] ‘the plaintiff in a personal and individual way.’” Id. (citing FDA v. Alliance for Hippocratic Med., 602 U.S. 367, 381, (2024)). There is no doubt that the cyber-theft of Plaintiffs’

1 The Court must assess its own subject matter jurisdiction before turning to English’s other arguments. See Reddy v. Buttar, 38 F.4th 393, 399 (4th Cir. 2022) (before deciding the merits of a particular argument, the court must confirm it has “the power to make the determination.”). Social Security numbers, driver’s license numbers, birthdates, and addresses have personally effected Plaintiffs. Therefore, their alleged injuries are particularized; the question is whether they are sufficiently concrete. An injury is only concrete if it is “real and not abstract.” Id. To guard against suits based on abstract harms, injuries must be “actual or imminent, not conjectural or hypothetical.” Spokeo,

Inc. v. Robins, 578 U.S. 330, 339 (2016). In other words, an intangible, future injury must be “palpable.” Beck v. McDonald, 848 F.3d 262, 271 (4th Cir. 2017). Here, Plaintiffs assert seven types of injuries that they believe are sufficiently concrete: (1) the invasion of their privacy, Dkt. 4 ¶¶ 60, 84, 123, 141-150; (2) loss of time monitoring their financials and mitigating harm, id. ¶¶ 66–71; (3) the expense of future credit monitoring, id. ¶¶ 72–74; (4) the diminution in value of their PII, id. ¶¶ 34–38; (5) increased risk of identity theft, id. ¶¶ 61–65; (6) the future risk of another breach at English Construction, id. ¶¶ 60, 123; and

(7) emotional distress, id. ¶¶ 80, 90, 122. English disagrees. Dkt. 10. In another recent data breach case, the Fourth Circuit addressed similar standing issues. See Holmes v. Elephant Ins. Co., 156 F.4th 413, 428–34 (4th Cir. 2025). In Holmes, the Fourth Circuit held that a plaintiff cannot establish an injury-in-fact by alleging: (1) loss of time monitoring financials; (2) additional expenses for credit monitoring; (3) increased risks of identity theft; (4) risk of another security breach by the same defendant; or (5) emotional distress. See Holmes v. Elephant Ins. Co., 156 F.4th 413, 428–34 (4th Cir. 2025). This unquestionably dispenses with the notion that Plaintiffs’ second, third, fifth, six and seventh asserted injuries are constitutionally cognizable. Regarding the fourth harm set forth in the Amended Complaint—i.e., diminution in value of their PII—Plaintiffs have not alleged that they could or would sell their Social Security numbers, drivers’ license numbers, dates of birth, or addresses, Dkt. 4 ¶1, for money. Moreover, much of

that information is only valuable to criminals. Presumably, Plaintiffs would not sell their own Social Security numbers to cybercriminals who, in turn, would use that information to cause Plaintiffs’ financial harm. Therefore, it is entirely unclear how Plaintiffs’ Social Security and driver’s license numbers have legitimate monetary value that could be diminished by public disclosure.2 See Podroykin v. Am. Armed Forces Mut. Aid Ass’n, 634 F. Supp. 3d 265, 272 (E.D. Va. 2022) (“many courts have ‘routinely rejected the proposition that an individual’s personal identifying information has an independent monetary value.’”) (citations omitted). Because Plaintiffs have not alleged that they would have or could have sold the PII that was stolen from English’s computers, their diminution in value argument has no legs.

That leaves Plaintiffs’ first alleged harm—the loss of their privacy—as the only potential injury-in-fact. Holmes directly resolved the question of whether the public disclosure of private information qualifies as a constitutional injury. The Fourth Circuit held that plaintiffs suffer an injury-in-fact when their “driver’s license numbers [are] listed on the dark web against their

2 Plaintiffs allege that: “the data marketplace is so sophisticated that individuals can actually sell their non-public information directly to a data broker who in turn aggregates the information and provides it to marketers or app developers.” Dkt. 4 ¶ 36. This general allegation that “non- public information” has legitimate, monetary value is not the same as specifically alleging a Social Security number has legitimate, monetary value. The Court assumes that “non-public information” like an individual’s age, browsing history, or purchasing history may have legitimate value. Dkt. 4 ¶ 37. But this is not a case about the unwanted disclosure of browsing history, it is a case where Plaintiffs’ Social Security and driver’s license numbers were stolen by hackers. justifiable wishes.” Holmes, 156 F.4th at 428. Here, Plaintiffs allege their PII is currently on the dark web, Dkt. 4 ¶¶ 79, 89, and that “their PII was not known to the public prior to the Data Breach.” Id. ¶ 141. Based on Holmes, which is binding and apposite, those allegations are sufficient to establish: (1) an injury-in-fact; (2) that was caused by the data breach; and (3) can be redressed by a judgment compensating Plaintiffs for the unwanted disclosure of their sensitive

information.3 Accordingly, Plaintiffs have standing to assert privacy-related harms. B. CAFA’s Home-State Exception4

Because Plaintiffs have standing, the Court must turn to English’s other arguments. This “merits” analysis begins and ends with the application of CAFA’s home-state exception. “Congress enacted CAFA in 2005 to expand subject matter jurisdiction in the federal courts over ‘interstate’ class actions ‘of national importance.’” Skyline Tower Painting, Inc. v. Goldberg, 148 F.4th 209, 220 (4th Cir. 2025) (citations omitted). Congress sought to remedy perceived abuse of the class action mechanism in state courts. See Corber v. Xanodyne Pharm., Inc., 771 F.3d 1218,

3 Plaintiffs acknowledge the rapidity with which most sensitive data is becoming “public.” Dkt. 4 ¶ 28 (“In 2021, a record 1,862 data breaches occurred, resulting in approximately 293,927,708 sensitive records being exposed, a 68% increase from 2020.”). Although not relevant at this stage, if this case proceeded, Plaintiffs may find it difficult to prove that English was the first to expose their private data when Plaintiffs have undoubtedly shopped at major retailers that has been hacked; banked with banks that have been hacked; been a patient at a hospital system that has been hacked; or received credit from a credit card company that has been hacked. In other words, proving (as opposed to alleging) causation may be problematic given the ubiquity of data breaches in the modern era.

4 CAFA’s mandatory and discretionary exceptions apply equally to cases removed from state court and those originally filed in federal court. See Ellis v. Montgomery Cnty., 267 F. Supp. 3d 510, 515 (E.D. Pa. 2017) (collecting cases). “If Congress had intended the exceptions to apply only to cases removed from state court, it could have expressly created such a limitation. It did not. The statute contains no reference to ‘State court,’ ‘remand,’ ‘removal,’ or any other basis for limiting the scope of the exceptions to removal cases.” Id. Relatedly, if CAFA’s exceptions only applied in removal cases, Congress would not have felt the need to repeat the exceptions in 28 U.S.C. § 1332(d) (the statute limiting CAFA jurisdiction) and 28 U.S.C. § 1453(d) (the statute limiting the types of class actions that can be removed). 1222 (9th Cir. 2014) (“Congress enacted CAFA in 2005 to ‘curb perceived abuses of the class action device which, in the view of CAFA’s proponents, had often been used to litigate multistate or even national class actions in state courts.’”). To accomplish this, CAFA extended federal jurisdiction to class actions where there are at least 100 members, $5,000,000 in damages, and minimal diversity. Id. (citing 28 U.S.C. § 1332(d)(2), (5)(B)). However, like most legal rules,

CAFA’s grant of jurisdiction has exceptions. See Bridewell-Sledge v. Blue Cross of Cal., 798 F.3d 923, 928 (9th Cir. 2015) (“Congress provided exceptions to CAFA jurisdiction, however, to allow truly intrastate class actions to be heard in state court.”). For example, CAFA does not apply to class actions involving securities or the internal affairs or governance of a corporation. 28 U.S.C. § 1332(d)(9)(A)–(C). CAFA also contains two mandatory exceptions where federal courts must decline jurisdiction known as the “local controversy exception,” see 28 U.S.C. § 1332(d)(4)(A), and the “home state exception,” see § 1332(d)(4)(B).5 And finally, CAFA contains a discretionary exception, which is also known as the home state exception. See 28 U.S.C. § 1332(d)(3); see also Adams v. W. Marine Prods., Inc., 958

F.3d 1216, 1221 (9th Cir. 2020) (“Somewhat perplexingly, both the mandatory and discretionary

5 Under § 1332(d)(4)(A) a district court must decline jurisdiction over a class action where: (1) greater than two-thirds of the members of the proposed plaintiff class in the aggregate are citizens of the state in which the action was filed, (2) at least one defendant from whom significant relief is sought and whose alleged conduct forms a significant basis for the claims asserted is a citizen of the state in which the action was originally filed, (3) where the principal injuries from the alleged conduct were incurred in the state in which the action was originally filed, and (4) during the three years preceding the filing of the class action, no other class action has been filed asserting the same or similar factual allegations against any of the defendants. E.g., Isaacs v. Charlotte-Mecklenburg Hosp. Auth., 2025 WL 486678, at *2 (W.D.N.C. Feb. 13, 2025). Under § 1332(d)(4)(B) a district court must decline jurisdiction over a class action where two-thirds or more of the members of the proposed plaintiff class in the aggregate and the primary defendants are citizens of the state in which the action was originally filed. Id. home state exceptions are often referred to by the same name.”). The purpose of the exceptions is to allow “truly intrastate class actions to be heard in state court.” Adams, 958 F.3d at 1220. Here, English only invokes CAFA’s discretionary home state exception. Dkt. 10 at 16–20. Under CAFA’s discretionary exception a “district court may, in the interests of justice and looking at the totality of the circumstances, decline to exercise jurisdiction . . . over a class action in which

greater than one-third but less than two-thirds of the members of all proposed plaintiff classes in the aggregate and the primary defendants are citizens of the State in which the action was originally filed.” 28 U.S.C. § 1332(d)(3). If the party invoking the exception satisfies the citizenship requirement,6 the Court must then consider the following factors in deciding whether to decline CAFA jurisdiction: A. whether the claims asserted involve matters of national or interstate interest;

B. whether the claims asserted will be governed by laws of the State in which the action was originally filed or by the laws of other States;

C. whether the class action has been pleaded in a manner that seeks to avoid Federal jurisdiction;

D. whether the action was brought in a forum with a distinct nexus with the class members, the alleged harm, or the defendants;

E. whether the number of citizens of the State in which the action was originally filed in all proposed plaintiff classes in the aggregate is substantially larger than the number of citizens from any other State, and the citizenship of the other members of the proposed class is dispersed among a substantial number of States; and

F. whether, during the 3-year period preceding the filing of that class action, 1 or more other class actions asserting the same or similar claims on behalf of the same or other persons have been filed.

6 The party invoking the exception bears the burden of establishing it. See Dominion Energy, Inc. v. City of Warren Police & Fire Ret. Sys., 928 F.3d 325, 336 (4th Cir. 2019); see also Skyline Tower, 148 F.4th at 223 (the party invoking a CAFA exception must “show that [it] applies by a preponderance of the evidence.). The moving party faces an uphill battle because “CAFA’s grant of federal [] jurisdiction [must be construed] broadly” and the exceptions must be applied narrowly. Id. Id. These six factors are “designed to help assess whether the claims at issue are indeed local in nature.” S. Rep. No. 109-14, at 28 (2005). To invoke the discretionary exception, English must begin by providing “some facts in evidence . . . regarding class members’ citizenship.” Brinkley v. Monterey Fin. Servs., Inc., 873 F.3d 1118, 1121 (9th Cir. 2017); see also Skyline Tower, 148 F.4th at 225. Citizenship is determined based on the date the Complaint is filed. See 28 U.S.C. § 1332(d)(7). In the Fourth Circuit, “residency suffices to create a rebuttable presumption of citizenship,” for the purposes of establishing a CAFA exception. Skyline Tower, 148 F.4th at 226. English has come forward with evidence that 3,700 out of 6,704 Plaintiffs—or 55% of the proposed class—had Virginia mailing

addresses according to its records.7 Dkt. 11-2 ¶ 4. Plaintiffs made no attempt to rebut English’s evidence that 55% of the class resides in Virginia; rather, they argue that “residency alone is not sufficient to establish citizenship,” and that English must prove where Plaintiffs are domiciled. Dkt. 22 at 13. But Skyline Tower, which was decided six months after Plaintiffs filed their response, addressed and rejected this exact argument. 148 F.4th at 226. Therefore, the Court is left with an unrebutted presumption that 55% of the proposed class members reside in Virginia.

7 Plaintiffs also argue that mailing addresses are not a direct proxy for place of residence. Dkt. 22 at 13. While it is true that mailing addresses are insufficient to establish citizenship for the purpose of diversity jurisdiction, the Fourth Circuit relaxed the “citizenship” requirement for invoking CAFA’s exceptions. “Addresses can serve as evidence of residence, and residence in turn as evidence of domicile.” Adams v. W. Marine Prods., Inc., 2019 WL 4942054, at *1 (N.D. Cal. Oct. 7, 2019). If Plaintiffs’ mailing addresses were different than their residences and their residences were different from their domiciles, Plaintiffs—who are in control of that evidence— should have come forward with conflicting evidence to rebut the presumption that English established. But they did not. Because English satisfied the first step of invoking CAFA’s discretionary home state exception, and the Court must turn to the six factors outlined in 28 U.S.C. § 1332(d)(3). These factors weigh in favor of applying the discretionary exception. First, Plaintiffs allege common law negligence, negligence per se, breach of implied contract, and breach of bailment claims. These claims are based on a Virginia corporation’s failure

to protect its employees’ private data from a cyber-theft that targeted its computer systems in Roanoke, Virginia. Dkt. 4 ¶¶ 4–8, 15, 20–26. They do not involve matters of national or interstate interest.8 Therefore, the first factor weighs in favor of declining jurisdiction. Second, Plaintiffs concede that their common claims are brought only under Virginia law. E.g., Dkt. 22 at 17 (“Under these facts, that is all that is needed to plead duty and breach under Virginia law.”). This is particularly important given that Virginia law is unsettled on whether the types of privacy-related claims brought by Plaintiffs are viable.9 Given the intrastate nature of Plaintiffs’ claims, it will be better for a Virginia state court to chart this new territory. Thus, the second factor also weighs in favor of declining jurisdiction.

8 E.g., Toll v. Fla. Power & Light Co., 701 F. Supp. 3d 1286, 1297 (S.D. Fla. 2023) (“common law nuisance claims that do not involve matters of national or interstate interest.”); Gaska v. DARCARS of R.R. Ave., Inc., 673 F. Supp. 3d 157, 170 (D. Conn. 2023) (“The enforcement of state law against a citizen of the same state is usually not of national importance or interest.”); Commisso v. PricewaterhouseCoopers LLP, 2012 WL 3070217, at *5 (S.D.N.Y. 2012) (“readily apparent” that complaint alleging violations of state law on behalf of people who worked for company in the same state, when company was citizen of same state, raised “issues ... local in nature”).

9 See Holmes v. Elephant Ins. Co., 156 F.4th 413, 423 (4th Cir. 2025) (“Elephant argues that public disclosure of private information cannot serve as a TransUnion analogue because it ‘is not recognized under Virginia common law.’ True, at least since 1977.”); see also In re Cap. One Consumer Data Sec. Breach Litig., 488 F. Supp. 3d 374, 398–99 (E.D. Va. 2020); Deutsche Bank Nat’l Tr. Co. as Tr. for Home Equity Mortg. Loan Asset-Backed Tr. Series Inabs 2006-A v. Buck, 2019 WL 1440280, at *6 (E.D. Va. Mar. 29, 2019); Parker v. Carilion Clinic, 296 Va. 319, 347 (2018); WJLA-TV v. Levin, 264 Va. 140, 564 S.E.2d 383, 394 n.5 (2002). Third, this class action was not pleaded to avoid federal jurisdiction. To the contrary, Plaintiffs specifically invoked federal jurisdiction under CAFA. Dkt. 4 ¶17. Because the third factor was designed to punish Plaintiffs who artfully pled their cases to avoid federal jurisdiction and because Plaintiffs did not artfully plead their case, the third factor is either neutral or weighs in favor of retaining jurisdiction.

Fourth, Virginia has a distinct nexus to this case. At least 55% of the class members presumably reside in Virginia and all the class members were voluntarily employed by a Virginia corporation. English, which is organized in Virginia and has its principal place of business in Roanoke, had its computer systems hacked. Therefore, his data breach, which is the basis of Plaintiffs’ claims, occurred in Virginia. Under these facts, the fourth factor weighs in favor of declining CAFA jurisdiction. Fifth, there are more members of the proposed class from Virginia than any other state and the remaining members are dispersed across thirty-six other states. Dkt. 11-2 ¶5. Admittedly, there are numerous members from North Carolina—2,307 in total. But those North Carolina Plaintiffs

are not seeking relief under North Carolina law; but instead, apparently concede that Virginia law applies to their injuries. E.g., Dkt. 22 at 18 (“[Plaintiffs] have established damages under Virginia law.”) (emphasis added). This case does not involve the type of interstate issues Congress envisioned being in federal court. Therefore, the fifth factor weighs slightly in favor of declining jurisdiction. Sixth, there is no indication that another class action involving this data breach has been filed within the past three years. Consequently, the sixth factor is a non-issue. After weighing the six factors, the Court concludes that this dispute is predominantly local in nature and would be better placed in state court. Other courts have reached similar conclusions regarding the application of CAFA’s discretionary exception. E.g., Rosario v. PIH Health, Inc, 2026 WL 371404, at *1 (9th Cir. Feb. 10, 2026); Adams, 958 F.3d 1216, 1224 (9th Cir. 2020) (same); Preston v. Tenet Healthsystem Mem’! Med. Ctr. Inc., 485 F.3d 804, 823 (Sth Cir. 2007) (same); Bryant v. Geico Cas. Co., 2023 WL 8437228, at *6 (D. Md. Dec. 5, 2023) (remanding class action to state court based, in part, on CAFA’s discretionary home-state exception); Gaska, 673 F. Supp. 3d at 173; Toll, 701 F. Supp. 3d at 1297. I. CONCLUSION Because approximately 55% of the Plaintiffs are Virginians, English is a Virginia company, the harms arose in Virginia, and Plaintiffs rely exclusively on Virginia law, this is a localized action that Congress did not intend to be in federal court. Accordingly, the Court will decline CAFA jurisdiction over this local dispute that implicates unsettled state law issues. A separate order will enter dismissing this action without prejudice.

Entered this 9th day of March, 2026. wee (arttan A fen’ _