Daniel Wisowaty v. Lavelle Industries, Inc.

Opinion

COURT OF APPEALS DECISION NOTICE DATED AND FILED This opinion is subject to further editing. If published, the official version will appear in the bound volume of the Official Reports.

September 2, 2026 A party may file with the Supreme Court a Samuel A. Christensen petition to review an adverse decision by the Clerk of Court of Appeals Court of Appeals. See WIS. STAT. § 808.10 and RULE 809.62.

Appeal No. 2025AP794 Cir. Ct. No. 2024CV1516

STATE OF WISCONSIN IN COURT OF APPEALS DISTRICT II

DANIEL WISOWATY,

PLAINTIFF-APPELLANT,

V.

LAVELLE INDUSTRIES, INC.,

DEFENDANT-RESPONDENT.

APPEAL from an order of the circuit court for Waukesha County:

PAUL BUGENHAGEN, JR., Judge. Reversed and cause remanded for further proceedings.

Before Lazar, P.J., Gundrum, and Grogan, JJ.

Per curiam opinions may not be cited in any court of this state as precedent

or authority, except for the limited purposes specified in WIS. STAT. RULE 809.23(3).

¶1 PER CURIAM. Daniel Wisowaty appeals from an order dismissing his class action complaint against Lavelle Industries, Inc. (Lavelle). Wisowaty had alleged various claims against Lavelle based on a data breach of personal information from Lavelle’s computer systems. The circuit court dismissed Wisowaty’s complaint for lack of standing. For the reasons that follow, we reverse the court’s order and remand the matter for further proceedings consistent with this opinion.

¶2 Lavelle is a rubber and plastics manufacturer located in the City of Burlington. Wisowaty is a former employee. As a condition of employment, Wisowaty provided Lavelle with certain personal information, including his name, social security number, date of birth, driver’s license, banking information, and medical information. Lavelle stored this and other employees’ personal information in its computer systems.

¶3 On March 17, 2024, Lavelle was alerted to suspicious activity in its computer systems. Following an internal investigation, Lavelle determined that between March 10, 2024, and March 17, 2024, an unknown actor gained access to its computer systems, and information stored within those systems may have been accessed or taken. A cybercrime group known as LockBit 3.0 subsequently claimed responsibility for the incident.

¶4 On August 22, 2024, Lavelle sent correspondence to current and former employees, informing them of the data breach and advising them on the steps they could take to protect themselves against identity theft and fraud. By then, Wisowaty had already received notifications from a bank regarding two $800

3

transactions that he did not recognize or authorize.1 He had also recently experienced a significant increase in spam texts.

¶5 On September 12, 2024, Wisowaty filed a class action complaint against Lavelle for its handling of his and other employees’ personal information, asserting claims of negligence, breach of implied contract, unjust enrichment, invasion of privacy, breach of fiduciary duty, and violations of WIS. STAT. § 146.82 (2023-24),2 the statute governing confidentiality of patient health care records. Lavelle moved to dismiss the complaint for lack of standing. After a hearing on the matter, the circuit court granted Lavelle’s motion. This appeal follows.

¶6 “‘Standing’ is a concept that restricts access to judicial remedies to those who have suffered some injury because of something that someone has either done or not done.” Munger v. Seehafer, 2016 WI App 89, ¶48, 372 Wis. 2d 749, 890 N.W.2d 22. Whether a party has standing is a question of law that we review de novo. See Friends of Black River Forest v. Kohler Co., 2022 WI 52, ¶10, 402 Wis. 2d 587, 977 N.W.2d 342.

¶7 When reviewing a motion to dismiss a complaint for lack of standing, we liberally construe the pleadings and accept as true “‘[a]ll facts pleaded and all reasonable inferences from those facts.’” Reetz v. Advocate Aurora Health, Inc., 2022 WI App 59, ¶6, 405 Wis. 2d 298, 983 N.W.2d 669

1 Both notifications occurred after the data breach. Although Wisowaty was not a customer of the bank in question, he contacted it anyway to ensure that transactions were not processed in his name.

2 All references to the Wisconsin Statutes are to the 2023-24 version.

4

(quoting Scott v. Savers Prop. & Cas. Ins. Co., 2003 WI 60, ¶5, 262 Wis. 2d 127, 663 N.W.2d 715; alteration in original). Likewise, we liberally construe the law of standing itself. Friends of Black River Forest, 402 Wis. 2d 587, ¶19.

¶8 Here, the circuit court was not persuaded that Wisowaty had established standing to bring his complaint. The court acknowledged that the data breach was “unsettling,” but said that “it’s only a possibility that this information was actually released. … Who knows if [LockBit 3.0] disclosed anything out on the internet.” The court similarly downplayed the connection between the data breach and suspicious bank notifications/increase in spam texts that Wisowaty experienced afterward, describing it as “speculative” and “not traceable back to Lavelle.” Thus, the court was not convinced that Wisowaty had suffered an injury as a result of Lavelle’s conduct.

¶9 Contrary to the circuit court’s assertion, there was an indication that Wisowaty’s personal information had been actually released on the internet. Indeed, Wisowaty’s complaint specifically alleges that on April 3, 2024, just weeks after the incident, “LockBit 3.0 released all stolen information obtained from the Breach on a data leak page.” Accepting this allegation as true, we are satisfied that Wisowaty suffered an injury to establish standing. See TransUnion LLC v. Ramirez, 594 U.S. 413, 425 (2021) (disclosure of private information is a harm traditionally recognized as providing a basis for a lawsuit).3 That injury can be traced to Lavelle’s handling of Wisowaty’s personal information.

3 This court considers federal case law as persuasive authority regarding questions of standing. Reetz v. Advocate Aurora Health, Inc., 2022 WI App 59, ¶8 n.1, 405 Wis. 2d 298, 983 N.W.2d 669.

5

¶10 Additionally, we note that Lavelle has not offered any alternative explanation for why Wisowaty received suspicious bank notifications and an increase in spam texts in the months following the data breach.4 The timing of the events is certainly suggestive of a link, which would further support a determination of standing. See Reetz, 405 Wis. 2d 298, ¶8 (time spent dealing with fraud attempts is sufficient to establish standing in a data breach identity theft case). Causation may be difficult for Wisowaty to prove; however, that is an issue to be resolved at trial or summary judgment—not at this stage of the proceedings. See id., ¶9.

¶11 For these reasons, we reverse the circuit court’s order and remand the matter for further proceedings consistent with this opinion.5

By the Court.—Order reversed and cause remanded for further proceedings.

This opinion will not be published. See WIS. STAT.

RULE 809.23(1)(b)5.

4 Criminals could have used Wisowaty’s name, social security number, date of birth, and driver’s license to open a new bank account in his name. Likewise, they could have discovered Wisowaty’s telephone number in his banking or medical information and used it for spam messages.

5 After briefing was completed, Wisowaty filed a motion to supplement the record, which was really a citation of supplemental authority. We grant that motion.