IN THE UNITED STATES DISTRICT COURT FOR THE WESTERN DISTRICT OF NORTH CAROLINA CHARLOTTE DIVISION CIVIL ACTION NO. 3:20-CV-00690-FDW-DSC ETHAN DARNELL,
Plaintiff,
v. ORDER
WYNDHAM CAPITAL MORTGAGE, INC.,
Defendant.
THIS MATTER is before the Court on Defendant Wyndham Capital Mortgage’s Motion to Dismiss. (Doc. No. 12). The motion has been fully briefed by the parties and is now ripe for review. For the reasons stated herein, the Court GRANTS Defendant’s Motion to Dismiss. I. BACKGROUND Plaintiff filed his Class Action Complaint against Defendant Wyndham Capital Mortgage on December 10, 2020. (Doc. No. 1). He asserts multiple causes of action against Defendant for Defendant’s alleged failure to secure Plaintiff’s, and others’, personally identifying information (“PII”). Id. The following allegations are taken as true for purposes of this Order and are set forth as described in the Complaint. Defendant Wyndham is a nationwide mortgage provider incorporated in North Carolina. (Doc. No. 1). Defendant uses “‘advanced technology’ for its strictly online loan processes in an effort to streamline” the mortgage loan process. Id. at p. 1. Plaintiff is a Florida citizen and allegedly applied for and received a home loan from Defendant in January of 2020. Id. He subsequently refinanced his loan with Defendant in July of 2020, and shortly thereafter Defendant allegedly “sold” Plaintiff’s mortgage loan to another company. Id. at p. 3. Sometime after Plaintiff’s loan with Defendant was sold, Defendant sent multiple “Notice of Data Incident” messages to “numerous states’ Attorneys General.” Id. at p. 5. The first Notice was sent on or around October 16, 2020: This correspondence is to notify you of [a] potential security issue caused by a recent single occurrence of user error. On September 18, 2020, an email containing personal information was sent in error to an email account not belonging to [Wyndham]. [Wyndham] has no evidence that this email was opened or that the information has been used. Upon identifying the incident, [Wyndham] immediately took action to address the problem, including an attempted recall of the email and attempted communications to the mailbox owner and service provider to have the email deleted. [Wyndham] has put additional protections in place to keep this from happening again, has provided additional training to employees, and continues to strengthen system controls and monitoring.
Id. A second Notice was sent to various Attorneys General roughly one week later, on or around October 23, 2020: This correspondence is to notify you of [a] potential security issue caused by a phishing scam. [Wyndham] discovered that an employee was the victim of a phishing scam which allowed access to the employee’s email account for a limited period of time. Upon discovery, [Wyndham] took immediate action; [Wyndham] blocked the unauthorized access, changed passwords and launched an investigation. In response to this incident, [Wyndham] has put additional protections in place to keep this from happening again, has provided additional training to employees, and continues to strengthen system controls and monitoring. Id. Plaintiff alleges he received a similar Notice of Data Breach on or around October 16, 2020.1 Id. at p. 3. In the Notice sent on October 16, 2020, Defendant explained that it would offer “affected individuals one year of credit monitoring” and recommended that all those potentially impacted closely monitor their financial accounts for “suspicious activity.” Id. at pp. 6-7. Plaintiff alleges that, once he was made aware of the data breach, he began to monitor his financial accounts
1 Plaintiff has not provided a verified copy of the Notice he allegedly received, and the Court accordingly relies on only the allegations contained in the Complaint. It is unclear from the Complaint whether the Notice sent to Plaintiff was in reference to the breach flowing from the accidental email or in reference to the breach flowing from the phishing scam. and has spent “additional time routinely reviewing his credit monitoring service results and reports,” which is time he could spend on other leisure or professional activities. Id. at p. 7. He alleges he has been suffering from “great anxiety” as a result of the data breach and specifically alleges the following injuries: “(a) damages to and diminution in the value of his PII—a form of intangible property that the Plaintiff entrusted to [Defendant] as a condition of his employment;
(b) loss of his privacy; and (c) imminent and impending injury arising from the increased risk of fraud and identity theft.”2 Id. at pp. 7-8. As recourse for his alleged injuries,3 Plaintiff seeks to hold Defendant liable for (1) negligence; (2) violating Florida’s Unfair and Deceptive Trade Practices Act; (3) unjust enrichment; (4) breach of implied contract; (5) breach of confidence; and (6), seeks a declaratory judgment that Defendant’s data security protocols are insufficient as a matter of law. (Doc. No. 1). Defendant has moved to dismiss both for lack of standing and for failure to state a claim.4 II. LEGAL STANDARD a. Subject Matter Jurisdiction
Rule 12(b)(1) provides for dismissal of claims against all defendants where the Court lacks jurisdiction over the subject matter of the lawsuit. Lack of subject matter jurisdiction may be raised at any time either by a litigant or the court. Mansfield, C. & L.M. Ry. Co. v. Swan, 111 U.S. 379, 382 (1884). The Federal Rules of Civil Procedure provide that “If the court determines
2 Plaintiff references his “employment” with Defendant. The Court assumes this was written in error as there are no other allegations about Plaintiff’s employment with Defendant elsewhere in the Complaint. 3 Plaintiff alleges injuries on behalf of himself and the alleged class members. However, for purposes of this Order, the Court’s legal analysis is based only on the named Plaintiff’s alleged injuries. See Beck v. McDonald, 848 F.3d 262, 269 (4th Cir. 2017) (“In a class action, we analyze standing based on the allegations of personal injury made by the named plaintiffs.” (citation omitted)). 4 For the reasons stated herein, the Court declines to address Defendant’s argument that Plaintiff has failed to state a claim. at any time that it lacks subject-matter jurisdiction, the court must dismiss the action.” Fed. R. Civ. P. 12(h)(3) (emphasis added). Subject matter jurisdiction may be challenged in one of two ways: either facially or factually. See Kerns v. United States, 585 F.3d 187, 192 (4th Cir. 2009). On the one hand, a facial challenge occurs when a defendant asserts that “a complaint simply fails to allege facts upon which
subject matter jurisdiction can be based” and requires a court to accept as true the factual allegations in the complaint. Id. (quotation omitted). On the other hand, a factual challenge occurs when a defendant “argues that the jurisdictional allegations in the complaint [are] not true,” and allows a court to conduct a hearing and disregard the allegations in the complaint if appropriate. Beck v. McDonald, 848 F.3d 262, 270 (4th Cir. 2017) (quotation and citation omitted). Regardless of whether challenged facially or factually, when a court considers subject matter jurisdiction, the burden of proof is on the plaintiff. Adams v. Bain, 697 F.2d 1213, 1219 (4th Cir. 1982). In Richmond, Fredericksburg & Potomac R.R. Co. V. United States, 945 F.2d 765 (4th Cir. 1991) (Ervin, C.J.), the Court of Appeals for the Fourth Circuit held as follows:
In determining whether jurisdiction exists, the district court is to regard the pleadings' allegations as mere evidence on the issue[] and may consider evidence outside the pleadings without converting the proceeding to one for summary judgment. The district court should apply the standard applicable to a motion for summary judgment, under which the nonmoving party must set forth specific facts beyond the pleadings to show that a genuine issue of material fact exists. The moving party should prevail only if the material jurisdictional facts are not in dispute and the moving party is entitled to prevail as a matter of law. A district court order dismissing a case on the grounds that the undisputed facts establish a lack of subject matter jurisdiction is a legal determination subject to de novo appellate review. Id. at 768-69 (citations omitted). III. STANDING When standing is challenged facially, the court must “accept as true all material allegations of the complaint and construe the complaint in favor of the complaining party.” Deal v. Mercer Cty. Bd. of Educ., 911 F.3d 183, 187 (4th Cir. 2018) (citing S. Walk at Broadlands Homeowner’s Ass’n, Inc. v. OpenBand at Broadlands, LLC, 713 F.3d 175, 181-82 (4th Cir. 2013)). Article III standing requires a plaintiff to demonstrate “(1) that he or she suffered an injury in fact that is concrete, particularized, and actual or imminent; (2) that the injury was caused by the defendant, and (3) that the injury would likely be redressed by the requested judicial relief.” Thole v. U.S.
Bank N.A., — U.S. —, 140 S. Ct. 1618, 1618, 207 L. Ed 2d 85 (2020). Defendant takes issue only with the first standing requirement—injury in fact—and the Court accordingly directs its analysis. The Fourth Circuit has recently addressed the injury in fact requirement in the data breach context in Beck v. McDonald, 848 F.3d 262 (4th Cir. 2017) and in Hutton v. Nat. Bd. of Examiners in Optometry, Inc., 892 F.3d 613 (4th Cir. 2018). When read together, both cases hold that, in the Fourth Circuit, a plaintiff has suffered a legally cognizable injury from a data breach in which PII may have been compromised when there is either “actual injury of identity theft; or . . . a threatened injury based on substantial risk of future identity theft that is sufficiently imminent.” In re Marriot Int’l, Inc., Customer Data Sec. Breach Litig., No. 19-md-2879, 2020 WL 6290670, at *4 (D. Md.
Oct. 27, 2020) (citing Hutton, 892, F.3d 613, 622); Beck, 848 F.3d at 275-76. In Beck, the Fourth Circuit reviewed a consolidated appeal brought by veterans who, after receiving medical care at a Veterans Affairs Medical Center (“VA Center”), were made aware of a data breach in which their personal information was compromised. Beck, 848 F.3d at 266. The data breach occurred when a laptop with the “unencrypted personal information” of thousands of patients was “misplaced or stolen” from the VA Center. Id. at 267. The plaintiffs alleged they were injured and sought to establish standing based on the “increased risk of future identity theft and the cost of measures to protect against it.” Id. at 267. The district court held that the plaintiffs “failed to establish a non-speculative, imminent injury-in-fact for purposes of Article III standing.”5 Id. The Fourth Circuit affirmed, finding that neither alleged injury—the increased risk of future identity theft nor the costs of protecting against future identity theft—was sufficiently imminent to satisfy Article III’s requirement that a threatened injury be “certainly imminent” to
constitute injury-in-fact. See id. at 270-73 (discussing and applying Clapper v. Amnesty Int’l USA, 568 U.S. 398 (2013)). With respect to the first alleged injury, increased risk of future identity theft, the Fourth Circuit reasoned in part that because the plaintiffs failed to allege the laptop was stolen “with the intent to steal [plaintiffs’] private information,” the possibility of future identity theft was too attenuated to confer Article III standing. See Beck, 848 F.3d at 274-75. The possibility of future identity theft was too attenuated because the court had to assume that the thief targeted the stolen items for the personal information they contained. And . . . [that] the thieves must then select, from thousands of others, the personal information of the named plaintiffs and attempt to successfully use that information to steal their identities. This “attenuated chain” cannot confer standing.
Id. at 275. With respect to the second alleged injury, the cost of measures taken to prevent future identity theft, the Fourth Circuit found that “self-imposed harms cannot confer standing.” Id. at 277 (quoting Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 694 (7th Cir. 2015) (“Mitigation expenses do not qualify as actual injuries when the harm is not imminent.”)). Accordingly, under Beck, allegations of a data breach causing a future threat of identity theft, without more, cannot confer standing without factual allegations plausibly suggesting “that the threatened harm of future identity theft [is] ‘certainly impending.’” Beck, 848 F.3d at 275. Otherwise, an alleged injury of future identity theft is too attenuated to be sufficiently imminent.
5 Two of the plaintiffs appealed the district court’s grant of summary judgment in favor of the defendant because the plaintiffs did not have Article III standing. Beck, 848 F.3d at 267. The other plaintiffs appealed the district court’s dismissal of the complaint for lack of Article III standing. Id. at 269. In Hutton, the Fourth Circuit reviewed a consolidated appeal brought by a group of optometrists who realized their personal information was stolen from databases maintained by the National Board of Examiners in Optometry (“NBEO”) after the optometrists noticed that credit cards were fraudulently opened in their names.6 Hutton, 892 F.3d at 616. The named plaintiffs alleged the same injuries as in Beck: increased risk of future identity theft and the cost of
monitoring for such theft. See Hutton, 892 F.3d at 619. The district court relied on Beck and dismissed the complaint for lack of standing, in part because the plaintiffs had failed to sufficiently allege threat of imminent injury.7 Id. The Fourth Circuit reversed the district court’s dismissal. Id. at 616. The court reaffirmed the basic rule set forth in Beck: that the “mere compromise of personal information, without more, fails to satisfy the injury-in-fact element in the absence of an identity theft.” Hutton, 892 F.3d at 621 (quoting Beck, 848 F.3d at 274-75). However, the court explained that the plaintiffs in the present case had suffered actual harm when credit cards were fraudulently opened in their name. Hutton, 892 F.3d at 622. There was “no need to speculate on whether substantial harm will befall
the [p]laintiffs.” Id. Accordingly, under Hutton, a data breach may confer standing when a plaintiff alleges “that [his or her] data has been stolen, accessed, and used in a fraudulent manner.” Id. Here, Plaintiff has alleged actual injury in the form of “(a) damages to and diminution in the value of his PII; (b) loss of his privacy; and (c) imminent and impending injury arising from the increased risk of fraud and identity theft.” (Doc. No. 1, pp. 7-8). Defendant argues that none
6 The optometrists who had credit cards fraudulently opened in their names realized the common thread among them was that they had all, at some point, shared their personally identifying information with the NBEO. Hutton, 892 F.3d at 617. 7 The district court also determined the plaintiffs’ alleged injuries failed the causation requirement of standing. Hutton, 892 F.3d at 619. of the alleged injuries are sufficient to confer Article III standing; each alleged injury will be addressed in turn. a. Damages to and Diminution in Value of PII Plaintiff first alleges injury in the form of “damages to and diminution in the value of his PII” as a result of having his “PII exposed.” (Doc. No. 1, p. 7). It is not clear from the Complaint
exactly how the exposure of Plaintiff’s PII has damaged or diminished its value, but the Court assumes that, because PII is of “high value to criminals,” Plaintiff is prevented from realizing the full extent of his PII’s value if it has been potentially exposed to cyber criminals. See id. at pp. 8- 11. “The Fourth Circuit has not [explicitly] decided whether the loss of property value in [PII] constitutes a cognizable injury in data breach cases.” In re Marriott Int’l, Inc. Customer Data Sec. Breach Litig., 440 F. Supp. 3d 447, 460 (D. Md. 2020). However, both Beck and Hutton foreclose the possibility that the exposure of PII, without more, is sufficient to confer Article III standing. See Kimbriel v. ABB, Inc., No. 5-19-cv-215-BO, 2019 WL 4861168, at *3 (E.D.N.C. Oct. 1, 2019)
(citing Hutton, 892 F.3d at 621 (“[Beck] emphasized that a mere compromise of personal information, without more, fails to satisfy the injury-in-fact element in the absence of identity theft.”)). Here, the allegations as set forth in the Complaint do not sufficiently allege the “something more” required to satisfy the standards as outlined in Beck and reaffirmed in Hutton. And while the Court declines to speculate on the kinds of factual allegations that could serve as “more,” Plaintiff does not allege anything more than the “mere compromise” of his PII, which is clearly insufficient under Beck and Hutton. The Court’s conclusion is further supported by the cases referenced by Plaintiff in his Opposition Motion, all of which involved the actual misuse of PII or allegations of something more than the mere exposure of PII. See In re Marriot International, Inc. 440 F. Supp. 3d at 460- 62 (“Plaintiffs allege that they suffered lower credit scores as a result of the data breach and that fraudulent accounts and tax returns were filed in their names.”); see also In re Yahoo! Inc. Customer Data Sec. Breach Litig., No. 16-MD-02752-LHK, 2017 WL 3727318, at *14 (N.D. Cal. Aug. 30, 2017) (finding that the plaintiffs plausibly alleged injury in the form of diminution in
value of PII when it was alleged that the PII was actually used by hackers); In re Experian Data Breach Litig., No. SACV 15-1592 AG, 2016 WL 7973595, at *5 (C.D. Cal. Dec. 29, 2016) (finding that the plaintiffs sufficiently alleged damages when they alleged they had received “text messages from an apparent hacker” traced to the data breach at issue). Accordingly, the allegations of injury in the form of damage to and diminution in the value of Plaintiff’s PII are not sufficient to constitute injury-in-fact. b. Loss of Privacy Plaintiff also alleges injury in the form of loss of privacy from the exposure of his PII. (Doc. No. 1, p. 7). However, the factual allegations related to this asserted injury suffer from the
same deficiencies described above. Plaintiff alleges nothing more than the “mere compromise” of his PII and a resulting loss of privacy, which is too abstract of an injury to satisfy standing requirements. See Khan v. Child.’s Nat’l Health Sys., 188 F. Supp. 3d 524, 533 (D. Md. 2016) (holding that an injury described as a “data breach [that] caused a loss of privacy” was not a “‘concrete and particularized injury’” (quoting In re Zappos.com, Inc., 108 F. Supp. 3d 949, 962 n.5 (D. Nev. 2015))); see also O’Shea v. Littleton, 414 U.S. 488, 494, 94 S. Ct. 669, 675, 38 L. Ed 2d 674 (1974) (“Abstract injury is not enough.”). The Court has been unable to find any law holding otherwise in the data breach context, and Plaintiff has not provided any. The Complaint accordingly fails to sufficiently allege that Plaintiff’s loss of privacy constitutes an injury-in-fact. c. Increased Risk of Fraud and Identity Theft and Mitigating Measures Finally, Plaintiff asserts he has been injured because the exposure of his PII has left him with the “imminent and impending [risk] of fraud and identity theft.” (Doc. No. 1, p. 7). In addition to the continuing risk of harm from identity theft, Plaintiff also claims he has spent “time routinely reviewing his credit monitoring service results and reports. Id. Ultimately, Plaintiff’s third alleged
injury has two prongs: (1) the injury resulting from being at increased risk of identity theft and (2) the injury resulting from the time spent on mitigative measures to protect against the increased risk of identity theft. In light of Beck and Hutton, it is clear that Plaintiff has not suffered an injury-in-fact for either the increased risk of future identity theft or the cost of mitigative measures, at least to the extent the injury is premised on the accidental data breach. With respect to the accidental breach, Plaintiff has neither alleged actual misuse of his PII, nor has he alleged his PII was intentionally targeted. Accordingly, to the extent any injury or allegation is based on the accidental data breach, Plaintiff has not sufficiently alleged injury-in-fact.
However, the question of whether Plaintiff has alleged injury-in-fact flowing from the alleged phishing scam requires a more nuanced analysis because, as Plaintiff argues in his Opposition Motion, all “phishing attempts” are “attacks by a thief with nefarious intentions.” (Doc. No. 13, p. 6). In highlighting this argument, Plaintiff agrees with the holding in Beck and argues he has satisfied its standard by pointing out that he has alleged “his . . . PII was intentionally targeted.” (Doc. No. 13, pp. 5-6). First, the Court notes that the Complaint does not contain allegations that Plaintiff’s PII was intentionally targeted in the alleged phishing scam.8 See (Doc. No. 1). In his Opposition Motion, Plaintiff appears to ask this Court to instead assume that his PII was intentionally targeted simply because Defendant’s employee was the victim of a phishing scam. See (Doc. No. 13). The Court agrees that most, if not all, phishing attempts are intended to achieve “nefarious” ends—but
to assume the specific phishing attempt here was intended to target Plaintiff’s PII is to engage in the same attenuated chain of possibilities explicitly rejected by the 4th Circuit in Beck. To illustrate this attenuated chain of possibilities based on the factual allegations in the Complaint, which are taken as true, the Court must assume the following: (1) the phishing attempt intentionally targeted the PII belonging to Defendant’s clients rather than other information potentially stored on Defendant’s servers; (2) the reactionary steps taken by Defendant in an effort to protect against the phishing attempt failed, and clients’ PII was taken by hackers;9 (3) Plaintiff’s PII was among the PII taken by the hackers; and (4), hackers have attempted or will attempt to use Plaintiff’s, as opposed to anyone else’s, PII to steal his identity.10 This chain of assumptions tracks
almost exactly with the attenuated chain explicitly rejected in Beck, except the one here has the additional assumption that Defendant’s actions taken in response to the phishing attempt failed to stop the attack before any PII was taken. Thus, the Court struggles to see how the allegations in the Complaint are sufficient to satisfy the injury-in-fact requirement.
8 The Complaint’s allegations regarding the theft of Plaintiff’s PII amount to conclusory statements, which need not be taken as true. See Beck, 848 F.3d at 270 (“We do not, however, apply the same presumption of truth to ‘conclusory statements’ and ‘legal conclusions’ contained in [the] complaint.”). 9 The Complaint makes clear that Defendants “took immediate action” upon learning about the phishing attempt and “blocked the unauthorized access, changed passwords and launched an investigation.” (Doc. No. 1, p. 6). 10 Although Plaintiff need not have suffered any actual identity theft to have sufficiently alleged injury-in-fact, there must be some factual allegation suggesting that hackers will use Plaintiff’s PII to commit fraud. Second, even Plaintiff's own Complaint belies the notion that he is at imminent and/or substantial risk of harm. To be sure, Plaintiff repeatedly asserts—in conclusory fashion—that he has been placed at “imminent, immediate, and continuing increased risk of harm” because of the data breaches. See (Doc. No. 1, pp. 7, 13). However, his Complaint also explains that he is at risk of injury “for years to come” and that “the fraudulent activity resulting from the Data breaches may not come to light for years.” Id. at pp. 8, 1. If what Plaintiff alleges is true, and fraudulent activity may not occur for years, it is impossible for him to be at imminent risk of harm. Ultimately, what Plaintiff has alleged here amounts to nothing more than the “mere compromise” of personal information, notwithstanding the allegations that Plaintiff's PI was exposed after a phishing attack. See Kimbriel, 2019 WL 4861168, at *3 (holding that plaintiffs’ alleged injury of increased risk of future identity theft was too speculative and could not confer standing because the only facts alleged were “credit inquiries” tied to a phishing attack). And, as explained in detail above, supra Section II.a, Plaintiff has not alleged anything more than the “mere compromise” of his PII. Accordingly, Plaintiff has not sufficiently alleged injury-in-fact as required for Article III standing. Because the standing issue is dispositive, the Court declines to address Defendant’s argument that Plaintiff has failed to state a claim. IV. CONCLUSION IT IS THEREFORE ORDERED Defendant’s Motion to Dismiss (Doc. No. 12) is GRANTED and Plaintiffs Complaint is DISMISSED WITHOUT PREJUDICE. The Court respectfully directs the Clerk of Court to CLOSE this case.
24, 2021 IT IS SO ORDERED.
Frank D. Whitney United States District Judge * ey