Dawn O’Hara Pagan, individually and on behalf of all others similarly situated v. Avantic Medical Lab, Inc.

Opinion

NOT FOR PUBLICATION

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF NEW JERSEY

DAWN O’HARA PAGAN, individually and on behalf of all others similarly situated,

Plaintiff, Case No. 2:25-cv-14907 (BRM) (JSA)

v. OPINION

AVANTIC MEDICAL LAB, INC.,

Defendant.

MARTINOTTI, DISTRICT JUDGE Before the Court is Plaintiff Dawn O’Hara Pagan’s (“Plaintiff”) Motion for Class Certification pursuant to Federal Rule of Civil Procedure (“Rule”) 23 and for Default Judgment as to the issue of liability only pursuant to Rule 55(b) (the “Motion”). (ECF No. 14.) Defendant Avantic Medical Lab, Inc. (“Avantic”) has not appeared in this matter. The Court has jurisdiction under 28 U.S.C. § 1332.1 Having reviewed the submission filed in connection with the Motion and having declined to hold a hearing pursuant to Federal Rule of Civil Procedure 78(b), for the reasons set forth below and for good cause having been shown, Plaintiff’s Motion for Class Certification (ECF No. 14) is GRANTED and Plaintiff’s Motion for Default Judgment (ECF No. 14) is GRANTED IN PART and DENIED IN PART.

1 The Court specifically has jurisdiction over this action under the Class Action Fairness Act, because the amount in controversy exceeds five million dollars, the number of proposed class members is greater than one hundred, and at least one member of the proposed class is a citizen of a state diverse from Avantic. 28 U.S.C. § 1332(d)(2). I. BACKGROUND For the purpose of a class certification motion, the Court must conduct a “rigorous analysis” of the facts, evidence, and arguments submitted. See In re Lamictal Direct Purchaser Antitrust Litig., 957 F.3d 184, 187 (3d Cir. 2020). Upon a motion for default class certification, the Court accepts all of Plaintiff’s well pleaded facts as true, which “extends to specific allegations

relating to the prerequisites for class certification” and then performs the Rule 23 analysis. Lehman v. Calls After Hours, LLC, Civ. A. No. 18-2601, 2019 WL 8405591, at *2 (N.D. Ohio Aug. 16, 2019). The Court may also consider any “document integral to or explicitly relied upon in the complaint.” In re Burlington Coat Factory Sec. Litig., 114 F.3d 1410, 1426 (3d Cir. 1997) (quoting Shaw v. Digit. Equip. Corp., 82 F.3d 1194, 1220 (1st Cir. 1996)). A. Factual Background This action arises out of a cyberattack and data breach, which allegedly targeted Avantic’s IT Network on July 3, 2025 (the “Data Breach”). (ECF No. 1 ¶ 1.) The Data Breach resulted in unauthorized access to the Private Information (“PI”), including the Private Health Information (“PHI”) and Personally Identifiable Information (“PII”)2, of approximately 1,400 individuals

(proposed “Class Members”), including named plaintiff Dawn O’Hara Pagan. (ECF No. 14-1 at 1.) Plaintiff seeks to recover damages on behalf of the Class Members for Avantic’s failure to secure its IT Network. (ECF No. 1 ¶¶ 16–19.)

2 Because the Health Insurance Portability and Accountability Act (“HIPAA”) protects PHI and the Federal Trade Commission (“FTC”) Act empowers the FTC to enforce various forms of PII, the Court will refer to the total private information disclosed in the Data Breach as “PI.” Citizens for Health v. Leavitt, 428 F.3d 167, 173 (3d Cir. 2005) (explaining HIPAA prohibits “‘covered entities’. . . from using or disclosing an individual's ‘protected health information’); F.T.C. v. Wyndham Worldwide Corp., 799 F.3d 236, 248 (3d Cir. 2015) (explaining the various acts of Congress which protect consumers’ personal information, information collected from children, and consumer data, within the FTC’s ambit). Avantic is a full-service clinical laboratory, which provides a wide array of diagnostic testing services. (Id. ¶ 25.) As a clinical laboratory, the proposed Class Members entrusted Avantic with their necessary and highly sensitive PI. (Id. ¶ 26.) Plaintiff alleges Avantic “promise[d] and represent[ed]” to these individuals the PI collected from them would be kept safe and confidential, and the privacy of the information would be maintained. (Id. ¶ 27.) Avantic, however, neither

encrypted the PI nor deleted information when it was no longer needed. (Id. ¶ 35.) Non-party Everest Ransomware Group (“Everest”) is a notorious cybercriminal group, which has been active since December 2020. (Id. ¶ 33.) Everest targets organizations across different industries and regions, which has included a number of high-profile victims such as NASA and the Brazilian Government. (Id. ¶ 33.) On June 10, 2025, Everest added a listing to its leak site, accompanied by a one-week countdown clock and four screenshots containing patient information as proof of its claims of obtaining PI stored in Avantic’s IT Network. (Id. ¶ 30.) On July 3, 2025, Everest leaked thirty-one gigabytes of proposed Class Members’ files, including PI such as names, addresses, telephone numbers, Social Security numbers, medical record numbers,

referring doctors, and their personal health insurance, medical, and financial information. (Id. ¶ 31.) B. Procedural History Plaintiff filed her Class Action Complaint against Avantic on August 26, 2025. (ECF No. 1.) Plaintiff seeks to recover damages on behalf of the 1,400 individuals whose files were leaked in the Data Breach. (Id. ¶¶ 16–19.) Plaintiff asserts four counts in her Complaint: (1) Negligence; (2) Negligence Per Se; (3) Breach of Implied Contract; and (4) Unjust Enrichment. (See id.) Plaintiff served Avantic on September 3, 2025. (ECF No. 5.) Avantic’s deadline to file a responsive pleading was September 24, 2025. (Id.) To date, Avantic has neither filed a responsive pleading nor appeared in this action. (ECF No. 14-1 at 2.) On December 3, 2025, Plaintiff filed a request for entry of default pursuant to Rule 55(a) (ECF No. 10), which the Clerk entered against Avantic (Clerk’s Entry dated December 4, 2025). On December 29, 2025, Plaintiff filed this Motion for Class Certification and Default Judgment on the issue of liability pursuant to Rules 23 and 55(b).3 (ECF No. 14-1.) To date,

Avantic has not opposed the Motion or appeared in this action. II. DEFAULT CLASS CERTIFICATION A. Legal Standard A class action under Rule 23 is “an exception to the usual rule that litigation is conducted by and on behalf of the individual named parties only.” Wal-Mart Stores v. Dukes, 564 U.S. 338, 348 (2011) (citing Califano v. Yamasaki, 442 U.S. 682, 700–01 (1979)). “To invoke this exception, every putative class action must satisfy the requirements of Rule 23(a) and the requirements of either Rule 23(b)(1), (2), or (3).” Marcus v. BMW of N. Am., LLC, 687 F.3d 583, 590 (3d Cir. 2012). A party seeking class certification must first demonstrate the proposed class satisfies the

four requirements of Rule 23(a): (1) the class is so numerous that joinder of all members is impracticable;

(2) there are questions of law or fact common to the class;

(3) the claims or defenses of the representative parties are typical of the claims or defenses of the class; and

(4) the representative parties will fairly and adequately protect the interests of the class.

3 As of the filing of the motion, Avantic had not provided notice to Plaintiff or the proposed Class Members of the Data Breach. (ECF No. 1 ¶ 32.) These four requirements are customarily referred to as: (1) numerosity, (2) commonality, (3) typicality, and (4) adequate representation, respectively. Dukes, 564 U.S. at 349. Under Rule 23(b)(3), a class action may be maintained if “the court finds that the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently

adjudicating the controversy.” These requirements are known as “predominance” and “superiority,” respectively. In re Hydrogen Peroxide Antitrust Litig., 552 F.3d 305, 310 (3d Cir. 2008), as amended (Jan. 16, 2009). The issues pertinent to these findings include: (A) the class members’ interests in individually controlling the prosecution or defense of separate actions;

(B) the extent and nature of any litigation concerning the controversy already begun by or against class members;

(C) the desirability or undesirability of concentrating the litigation of the claims in the particular forum; and

(D) the likely difficulties in managing a class action. Fed. R. Civ. P. 23(b)(3). Superiority “asks the court ‘to balance, in terms of fairness and efficiency, the merits of a class action against those of “alternative available methods” of adjudication.’” In re Prudential Ins. Co. Am. Sales Prac. Litig. Agent Actions, 148 F.3d 283, 316 (3d Cir. 1998) (quoting Georgine v. Amchem Prods., Inc., 83 F.3d 610, 632 (3d Cir. 1996)). “Predominance tests whether proposed classes are sufficiently cohesive to warrant adjudication by representation, a standard far more demanding’ than the commonality requirement of Rule 23(a).” In re Insulin Pricing Litig., Civ. A. No. 17-699, 2024 WL 416500, at *14 (D.N.J. Feb. 5, 2024) (internal quotation marks omitted). The Third Circuit has held for proposed classes under Rule 23(b)(3), there is an “implicit requirement that class members be ascertainable,” meaning a plaintiff’s proposed class must be “currently and readily ascertainable based on objective criteria.” In re Niaspan Antitrust Litig., 67 F.4th 118, 129−30, 133 (3d Cir. 2023) (quoting Hargrove v. Sleepy’s LLC, 974 F.3d 467, 477 (3d Cir. 2020)). “Class ‘certification is proper only if the trial court is satisfied, after a rigorous analysis’ that all of the necessary Rule 23 requirements have been fulfilled.” Ferreras v. Am. Airlines, Inc.,

946 F.3d 178, 183 (3d Cir. 2019) (quoting Wal-Mart Stores, Inc. v. Dukes, 564 U.S. 338, 350–51 (2011)). “The party seeking certification bears the burden of establishing each element of Rule 23 by a preponderance of the evidence.” Marcus, 687 F.3d at 591 (citing In re Hydrogen Peroxide, 552 F.3d at 307). The Third Circuit has set forth “three key aspects of class certification procedure.” In re Hydrogen Peroxide, 552 F.3d at 307. First, the court’s decision to certify a class requires factual determinations in support of each Rule 23 requirement by a preponderance of the evidence, “not merely a ‘threshold showing’ by a party.” Id. “Second, the court must resolve all factual or legal disputes relevant to class certification, even if they overlap with the merits— including disputes touching on elements of the cause of action.” Id. Lastly, “the court’s obligation to consider all relevant evidence and arguments extends to expert testimony, whether offered by a

party seeking class certification or by a party opposing it.” Id. “An overlap between a class certification requirement and the merits of a claim is no reason to decline to resolve relevant disputes when necessary to determine whether a class certification requirement is met.” Id. at 316. To determine whether the Rule 23 class certification requirements are satisfied, the Third Circuit has stated district courts may “delve beyond the pleadings” where appropriate, and their certification analysis may include a “preliminary inquiry into the merits.” Sullivan v. DB Invs., Inc., 667 F.3d 273, 306 (3d Cir. 2011) (quoting Newton v. Merrill Lynch, Pierce, Fenner & Smith, Inc., 259 F.3d 154, 167 (3d Cir. 2001), as amended (Oct. 16, 2001)). However, “plaintiffs need not actually establish the validity of claims at the [class] certification stage.” Sullivan, 667 F.3d at 306. “[T]rial courts ‘must engage in a rigorous analysis and find each of Rule 23[]’s requirements met by a preponderance of the evidence before granting certification[,]” even if this “involves judging credibility, weighing evidence, or deciding issues that overlap with the merits of a plaintiff’s claims.” In re Niaspan, 67 F.4th at 130 (quoting Harnish v. Widener Univ. Sch. of Law, 304 (3d Cir. 2016)).

“[A] clerk’s entry of default does not change the analysis that a district court must undertake in deciding whether to certify a class because any other conclusion might give defendants an incentive to default in situations where class certification seems likely.” Lehman, 2019 WL 8405591, at *1 (citing Leider v. Ralfe, Civ. A. No. 01-3137, 2003 WL 24571746, at *8– 13 (S.D.N.Y. Mar. 4, 2003) R & R adopted in part, 2003 WL 22339305 (S.D.N.Y. Oct. 10, 2003) (conducting class certification analysis following defendant’s default and denying certification for failure to meet requirements of Rule 23)). Certification under Rule 23, however, “remains a procedural requirement for a class to recover damages.” Lehman, 2019 WL 8405591, at *1. Therefore, a court may only certify a class action, after a rigorous analysis, if the court is satisfied

the prerequisites of Rule 23 have been met. Gilchrist v. Bolger, 733 F.2d 1551, 1555 (11th Cir. 1984)). B. Decision Plaintiff proposes a class consisting of “[a]ll individuals whose Private Information was accessed and/or acquired by an unauthorized party in the Data Breach [(the “Proposed Class”)].”4 (ECF No. 1 ¶ 152.) Therefore, the Court must first determine whether Plaintiff has satisfied the

4 “Specifically excluded from the [Proposed Class] are [Avantic], its officers, directors, agents, trustees, parents, children, corporations, trusts, representatives, principals, servants, partners, joint venturers, or entities controlled by [Avantic], and its heirs, successors, assigns, or other persons or entities related to or affiliated with [Avantic] and/or its officers and/or directors, the judge assigned to this action, and any member of the judge’s immediate family.” (ECF No. 1 ¶ 153.) prerequisites for maintaining a class action as set forth in Rule 23(a)—numerosity, commonality, typicality, and adequate representation—and then determines whether she has satisfied the requirements of Rule 23(b)(3). 1. Numerosity With respect to numerosity, a party need not precisely enumerate the class members to

proceed as a class action. In re Lucent Tech. Inc., Sec. Litig., 307 F. Supp. 2d 633, 640 (D.N.J. 2004). “No minimum number of plaintiffs is required to maintain a suit as a class action, but generally if the named plaintiff demonstrates that the potential number of plaintiffs exceeds [forty], the first prong of Rule 23(a) has been met.” Stewart v. Abraham, 275 F.3d 220, 226–27 (3d Cir. 2001). Here, the Proposed Class includes “thousands” of members, which is so numerous the joinder of all potential class members would be impracticable. (ECF No. 1 ¶ 156.) Plaintiff alleges the class consists of “[a]ll individuals whose Private Information was accessed and/or acquired by an unauthorized party in the Data Breach.” (Id. ¶ 152.) Plaintiff estimates the Proposed Class includes approximately 1,400 members.5 (ECF No. 14-1 at 5.) This is greater than the forty class

members, which generally meets the numerosity requirement, and “[n]o minimum number of plaintiffs is required” to meet this prong. Stewart v. Abraham, 275 F.3d 220, 226–27 (3d Cir. 2001). The Court finds litigating this dispute would be impracticable absent class certification. “Impracticability does not mean impossibility, but rather that the difficulty or inconvenience of joining all members of the class calls for class certification.” Weikel v. Tower Semiconductor, Ltd.,

5 Plaintiff’s Complaint alleges there are “thousands” of potential Class Members, (ECF No. 1 ¶ 156), while Plaintiff’s brief in support of this Motion contains the specific figure of “1,400” (ECF No. 14-1 at 5). Because the allegation of the Complaint is sufficient for the analysis for class certification, the Court will use the more specific figure presented in the brief going forward without requiring Plaintiff to amend. 183 F.R.D. 377, 388 (D.N.J. 1998) (internal quotation marks omitted). “There are no specific standards regarding class size and it is not necessary for a plaintiff to allege the exact number of class members to satisfy the numerosity requirement.” In re Centocor, Inc. Sec. Litig. III, Civ. A. No. 98-260, 1999 WL 54530, at *1 (E.D. Pa. Jan. 27, 1999); Zinberg v. Wash. Bancorp, Inc., 138 F.R.D. 397, 405 (D.N.J. 1990).

Therefore, the Court finds the threshold for a presumption of numerosity is met. 2. Commonality Commonality requires “there are questions of law or fact common to the class.” Fed. R. Civ. P. 23(a)(2). The threshold for establishing commonality is straightforward: “[t]he commonality requirement will be satisfied if the named plaintiffs share at least one question of fact or law with the grievances of the prospective class.” In re Schering Plough Corp. ERISA Litig., 589 F.3d 585, 596–97 (3d Cir. 2009) (quoting Baby Neal v. Casey, 43 F.3d 48, 56 (3d Cir. 1994)). Indeed, as the Third Circuit pointed out, “[i]t is well established that only one question of law or fact in common is necessary to satisfy the commonality requirement, despite the use of the plural

‘questions’ in the language of Rule 23(a)(2).” In re Schering Plough, 589 F.3d at 97 n.10. Therefore, there is a low threshold for satisfying this requirement. Newton, 259 F.3d 154 at 183; In re Sch. Asbestos Litig., 789 F.2d 996, 1010 (3d Cir. 1986) (highlighting the threshold of commonality is not high). This requirement does not mandate all putative class members share identical claims, see Hassine v. Jeffes, 846 F.2d 169, 176–77 (3d Cir. 1988), and “factual differences among the claims of the putative class members do not defeat certification,” Baby Neal, 43 F.3d at 56. In this regard, class members can assert a single common complaint even if they have not all suffered actual injury; demonstrating all class members are subject to the same harm will suffice. Hassine, 846 F.2d at 177–78. “Even where individual facts and circumstances do become important to the resolution, class treatment is not precluded.” Baby Neal, 43 F.3d at 57. This case presents numerous questions of law and fact common to all Proposed Class Members, as each member suffered the same potential harm of the leak of their PI, including “name, address, telephone number, Social Security number, medical record number, referring

doctor, [and] health insurance, medical, and financial information” from the Data Breach. (ECF No. 1 ¶ 6.) Insofar as Plaintiff alleges Avantic was negligent, unjustly enriched, or breached implied contracts with its customers, those violations and related remedies would apply to all Proposed Class Members. Therefore, the Court finds the threshold for a presumption of commonality is met. 3. Typicality Rule 23(a)(3) requires the representative’s claim be typical of those of the members of the class. “The concepts of commonality and typicality are broadly defined and tend to merge, because they focus on similar aspects of the alleged claims.” Newton, 259 F.3d at 182. “Both criteria seek

to assure that the action can be practically and efficiently maintained and that the interests of the absentees will be fairly and adequately represented.” Baby Neal, 43 F.3d at 56; see General Tel. Co. of Southwest v. Falcon, 457 U.S. 147, 157 n.13 (1982). Despite their similarity, commonality—like numerosity—evaluates the sufficiency of the class itself, and typicality—like adequacy of representation—evaluates the sufficiency of the named plaintiff. See Hassine, 846 F.2d at 177 n.4; Weiss v. York Hosp., 745 F.2d 786, 810 (3d Cir. 1984). Specifically, Rule 23(a)(3) requires the claims of the representative parties be “typical of the claims of the class.” Typicality acts as a bar to class certification only when “the legal theories of the named plaintiffs potentially conflict with those of the absentees.” Georgine v. Amchem Prods., 83 F.3d 610, 631 (3d Cir. 1996); Newton, 259 F.3d at 183. “If the claims of the named plaintiffs and putative class members involve the same conduct by the defendant, typicality is established regardless of factual differences.” Id. at 183–84. In other words, the typicality requirement is satisfied as long as representatives and the class claims arise from the same event, practice, or course of conduct and are based on the same legal theory. See Brosious v. Children’s

Place Retail Stores, 189 F.R.D. 138, 146 (D.N.J. 1999). Here, typicality is clearly satisfied since Plaintiff’s claims arise from the same course of conduct which gave rise to the claims of all other Proposed Class Members, namely the Data Breach, and are based on the same legal theories. Thus, the typicality requirement of Rule 23(a)(3) is met. 4. Adequacy A class may not be certified unless the representative class members “will fairly and adequately protect the interests of the class.” Fed. R. Civ. P. 23(a)(4). “Rule 23(a)’s adequacy of representation requirement ‘serves to uncover conflicts of interest between named parties and the

class they seek to represent.’” In re Pet Food Prod. Liab. Litig., 629 F.3d 333, 343 (3d Cir. 2010) (quoting Amchem, 521 U.S. at 625). Class representatives “must be part of the class and possess the same interest and suffer the same injury as the class members.” Id. This requirement has traditionally entailed a two-pronged inquiry: first, the named plaintiff’s interests must be sufficiently aligned with the interests of the absentees; and second, the plaintiff’s counsel must be qualified to represent the class. In re Gen. Motors Corp. Pick-Up Truck Fuel Tank Prods. Liab. Litig., 55 F.3d 768, 800 (3d Cir. 1995). A named plaintiff is “adequate” if his interests do not conflict with those of the class. See In re Prudential Ins. Co., 148 F.3d at 312. Pursuant to Rule 23(g), adequacy of class counsel is considered separately from the determination of the adequacy of the class representatives. Both prongs of the adequacy requirement are satisfied here. Plaintiff has no interests antagonistic to those of the Proposed Class Members. (ECF No. 14-1 at 7.) Plaintiff is alleged to have suffered injury in the same manner as other class members as a result of Avantic’s alleged

negligence. (Id.) Plaintiff is therefore an adequate representative of the class. Likewise, the interests of Plaintiff’s counsel, Milberg, PLLC and Kopelowitz, Ostrow, Ferguson, Weiselberg Gilbert are not antagonistic. To assess the adequacy of the proposed class counsel, the court must consider the following: (1) the work counsel has done in identifying or investigating potential claims in the action; (2) counsel’s experience in handling class actions, other complex litigation, and claims of the type asserted in the action; (3) counsel’s knowledge of the applicable law; and (4) the resources counsel will commit to representing the class. See Nafar v. Hollywood Tanning Sys., Inc., Civ. A. No. 06-3826, 2008 WL 3821776, at *7 (D.N.J. Aug. 12, 2008). Plaintiff alleges she “has retained competent counsel who are experienced in consumer and

commercial class action litigation and who will prosecute this action vigorously” (ECF No. 1 ¶ 158), and counsel has timely filed this motion for class certification and default judgment (see ECF No. 14-1). Milberg, PLLC and Kopelowitz, Ostrow, Ferguson, Weiselberg Gilbert are therefore qualified to represent the class. 5. Rule 23(b)(3) Factors: Common Questions Predominate and the Class Is Superior to Other Methods of Adjudication

After meeting the threshold requirements of Rule 23(a), a plaintiff must establish the proposed class meets the requirements of Rule 23(b)(3). To certify a class under Rule 23(b)(3), the Court must find “the questions of law or fact common to class members predominate over any questions affecting only individual members, and that a class action is superior to other available methods for fairly and efficiently adjudicating of the controversy.” Fed. R. Civ. P. 23(b)(3). In this case, both considerations weigh in favor of class certification. a. Predominance First, Plaintiff satisfies the predominance criteria. In determining whether common questions predominate, courts have focused on the claims of liability against defendants. See Smith

v. Suprema Specialties, Inc., Civ. A. No. 02-168, 2007 WL1217980, at * 9 (D.N.J. Apr. 23, 2007) (collecting cases) (“The focus of the predominance inquiry is on liability, not damages.”). “When common questions are a significant aspect of a case and they can be resolved in a single action, class certification is appropriate.” In re Novo Nordisk Sec. Litig., Civ. A. No. 17-209, 2020 WL 502176, at *8 (D.N.J. Jan. 31, 2020). Defendant’s alleged liability arises from a cyberattack by Everest on Avantic resulting in the Data Breach, wherein Everest leaked the PI of Avantic’s patients via the internet. (See generally ECF No. 1.) Therefore, the question of whether Avantic’s conduct in protecting this information was negligent is the central issue in this case and predominates over any individual

issue that theoretically might arise. Here, the existence of common questions and their predominance over individual issues are exemplified by the fact that if every class member were to bring an individual action, each plaintiff would be required to demonstrate the theft and disclosure of their individual information and the damages each plaintiff individually suffered as a result of said leak. The Court finds, therefore, the predominance criteria of Rule 23(b)(3) are met. b. Superiority Next, the superiority requirement “asks the court to balance, in terms of fairness and efficiency, the merits of a class action against those of alternative available methods of adjudication.” In re Prudential Ins. Co., 148 F.3d at 316 (internal quotation marks omitted); accord In re Warfarin Sodium Antitrust Litig., 391 F.3d 516, 533–34 (3d Cir. 2004). Given the alternative available method is 1,400 individual lawsuits litigating almost identical claims, which would be highly inefficient, the Court finds the superiority requirement is met. Finally, there will be no difficulties in managing this class. This Court balances the fairness

and efficiency of certifying a class against other possible methods of adjudication. Absent a class action, the Court would have to try numerous lawsuits for approximately 1,400 plaintiffs, each of whose damages are alleged to exceed $5 million. (ECF No. 1 ¶ 22.) See Good v. Nationwide Credit, Inc., Civ. A. No. 14-4295, 2016 WL 929368, at *8 (E.D. Pa. Mar. 14, 2016); see also Smilow v. Sw. Bell Mobile Sys., Inc., 323 F.3d 32, 41 (1st Cir. 2003) (“The core purpose of Rule 23(b)(3) is to vindicate the claims of . . . groups of people whose individual claims would be too small to warrant litigation.”). Therefore, a class action is the superior method of adjudication and satisfies Rule 23(b)(3). Having weighed all the factors and considered all the requirements of class certification,

the Court finds it is appropriate to certify the class. III. DEFAULT JUDGMENT A. Legal Standard Rule 55(a) allows for the entry of default against a party who “has failed to plead or otherwise defend,” and when said “failure is shown by affidavit or otherwise, the clerk must enter the party’s default.” Fed. R. Civ. P. 55(a). Once the Clerk enters an entry of default, “[Rule] 55(b)(2) authorizes courts to enter a default judgment against a properly served defendant who fails to file a timely responsive pleading.” La. Counseling & Family Servs., Inc. v. Makrygialos, LLC, 543 F. Supp. 2d 359, 364 (D.N.J. 2008) (citing Fed. R. Civ. P. 55(b)(2)). The court, rather than the Clerk, must enter the judgment where the amount is not sum certain or cannot be made certain by computation. Fed. R. Civ. P. 55(b). The Third Circuit generally disfavors default judgments. Budget Blinds, Inc. v. White, 536 F.3d 244, 258 (3d Cir. 2008). While entry of a default judgment is within the district court’s discretion, cases should “be disposed of on the merits whenever practicable.” Hritz v. Woma Corp.,

732 F.2d 1178, 1181 (3d Cir. 1984)); see also Chamberlain v. Giampapa, 210 F.3d 154, 164 (3d Cir. 2000); La. Counseling & Family Servs., 543 F. Supp. 2d at 364. A party is not entitled to the entry of a judgment of default as of right, because the entry of such a judgment is left primarily to the discretion of the district court. See Hritz, 732 F.2d at 1180. Generally, courts treat all pleadings and allegations of a plaintiff as true on a motion for default judgment. See Comdyne I, 908 F.2d at 1149. However, the Court is not required to accept a plaintiff’s conclusions of law and, therefore, “it remains for the [C]ourt to consider whether the unchallenged facts constitute a legitimate cause of action” against the defendants. Directv, Inc. v. Asher, Civ. A. No. 03-1969, 2006 WL 680533, at *1 (D.N.J. Mar. 14, 2006) (quoting Charles A.

Wright, Arthur R. Miller & Mary Kay Kane, 10A Fed. Prac. & Proc. § 2688, at 58–59, 63 (3d ed. 1998)); accord La. Counseling & Family Servs., 543 F. Supp. 2d at 364; Comcast Cable Commc’ns v. Bowers, Civ. A. No. 06-1664, 2007 WL 1557510, at *2 (D.N.J. May 25, 2007). “[A] litigant’s failure to state a claim upon which relief may be granted, e.g., an assertion of a claim over which the court lacks jurisdiction, prevents the presiding court from entering a default judgment.” Animal Sci. Prods., Inc. v. China Nat. Metals & Mins. Imp. & Exp. Corp., 596 F. Supp. 2d 842, 848 (D.N.J. 2008); see Mineo v. McEachern, Civ. A. No. 12-1950, 2014 WL 2197032, at *2 (D.N.J. May 27, 2014) (“A court will deny a default judgment if the complaint fails to state a claim under [Rule] 12(b)(6).) B. Decision Plaintiff’s entire argument on the merits in favor of entering default judgment as to liability is “Plaintiff is entitled to a default judgment on liability. . . [because] Defendant failed to timely answer the Complaint, and the allegations in the complaint are thereby admitted.” (ECF No. 14-1 at 3.) Plaintiff did not address the merits of their causes of action. (See id.) This does not suffice,

as the Court only accepts the facts alleged, not the conclusions of law. Therefore, the Court must now assess whether Plaintiff and the Proposed Class Members (hereinafter, the “Class Members”) are entitled to default judgment for each of the four claims Plaintiff asserts based upon the facts alleged. 1. Negligence Per Se “Under New Jersey law, a claim of negligence per se is supported by the violation of a statute or regulation, but only when that statute or regulation serves to impose direct tort liability on the person who offends it.” In re Allergan Biocell Textured Breast Implant Prods. Liab. Litig., 537 F. Supp. 3d 679, 726 (D.N.J. 2021) (citing Green v. 712 Broadway, LLC, Civ. A. No. 17-991,

2018 WL 2754075, at *6 (D.N.J. June 8, 2018)); accord Sang Geoul Lee v. Won Il Park, 720 F. App’x 663, 666 (3d Cir. 2017)). See also Boria v. Heritage at Alexander Hamilton, Civ. A. No. 23-22914, 2024 WL 3585579, at *2 (D.N.J. July 30, 2024) (“Negligence per se applies where a statute ‘specifically incorporate[s] the non-statutory or common-law standard of negligence.’” (quoting Senisch v. Tractor Supply Co., Civ. A. No. 16-047, 2018 WL 324717, at *11 (D.N.J. Jan. 8, 2018))). However, “because statutes ‘rarely define a standard of conduct in the language of common-law negligence,’ the application of negligence per se is ‘the exceptional situation.’” Boria, 2024 WL 3585579, at *2 (quoting Labega v. Joshi, 270 A.3d 378, 389 (N.J. Super. Ct. App. Div. 2022)). See also Alexander v. Sandoval, 532 U.S. 275, 290–92 (2001) (finding no private right of action implied under federal statutes absent express creation by Congress). Plaintiff’s negligence per se claim is premised on Avantic’s alleged violation of Section 5 of the FTC Act, 15 U.S.C. § 45, which prohibits unfair methods of competition and unfair or deceptive acts or practices, and HIPAA, 42 U.S.C. § 1302(d) et seq., which requires reasonable

safeguards on PHI. (ECF No. 1 ¶¶ 188–201.) Plaintiff does not bring a direct cause of action under the FTC Act or HIPAA; rather, she asserts a negligence per se claim based on violations of the FTC Act and HIPAA. (See id.). Here, Plaintiff’s claim fails under New Jersey Law because neither the FTC Act nor HIPAA “specifically incorporate the non-statutory or common law standard of negligence.” Boria, 2024 WL 3585579, at *2. The FTC Act does not require finding a party failed to exercise reasonable care, which, by its terms, would “constitute[] a finding of negligence.” See id. (quoting Senisch v. Tractor Supply Co., Civ. A. No. 16-047 2018 WL 324717, at *11 (D.N.J. Jan. 8, 2018)); see also L.S. v. Mount Olive Bd. of Educ., 765 F. Supp. 2d 648, 666 (D.N.J. 2011) (dismissing a

negligence per se claim premised upon HIPAA violations). In fact, both statutes explicitly lack a private right of action. Mod. Orthopaedics of New Jersey v. Horizon Healthcare Servs., Inc., Civ. A. No. 21-20174, 2022 WL 3211417, at *4 (D.N.J. Aug. 8, 2022) (holding it is “well-established” in the Third Circuit HIPAA does not provide a private right of action, neither expressly nor by implication); Ponce v. Wilmington Sav. Fund Soc’y, FSB, Civ. A. No. 22-4834, 2023 WL 4197179, at *8 (D.N.J. June 26, 2023) (“[T]here is no private right of action to enforce the FTC Act.”). Therefore, under federal law, there is no private right of action by which a private plaintiff may file suit. See Sandoval, 532 U.S. at 290–92. Under New Jersey law, because the statutes do not impose tort liability, they cannot serve as the basis of a negligence per se claim. In re Allergan, 537 F. Supp. 3d at 726. Accordingly, Plaintiff’s Motion for Default Judgment as to Count II of the Complaint — negligence per se—is denied. 2. Negligence

To establish a claim of negligence under New Jersey law, a plaintiff must demonstrate four elements: (1) a duty of care, (2) the duty has been breached, (3) proximate causation, and (4) actual damages. Townsend v. Pierre, 110 A.3d 52, 61 (N.J. 2015) (citing Polzo v. Cnty. of Essex, 960 A.2d 375, 384 (N.J. 2008)). A “plaintiff bears the burden of establishing those elements ‘by some competent proof.’” Id. (quoting Davis v. Brickman Landscaping, Ltd., 98 A.3d 1173, 1178 (2014)). “Actual damages are those that are real and substantial as opposed to speculative.” Grunwald v. Bronkesh, 621 A.2d 459, 465 (1993). “The damage or harm need not be immediate,” and “[a] plaintiff may recover damages for the prospective consequence of a tortious injury if the ‘prospective consequence may, in reasonable probability, be expected to flow from the past

harm.’” Ayers v. Jackson Tp., 461 A.3d 184, 187 (N.J. Super. Ct. Law. Div. 1983) (quoting Coll v. Sherry, 148 A.2d 481, 486 (N.J. 1959)). “Violating a statute in New Jersey may support an alleged [negligence] claim in three ways: (1) by the statute itself creating civil liability if violated, (2) by constituting negligence per se, or (3) by constituting evidence of negligence.” In re BetMGM Data Breach Litig., Civ. A. No. 22- 7462, 2024 WL 5710661, at *3 (D.N.J. Nov. 20, 2024) (citing Boria, 2024 WL 3585579, at *2 (D.N.J. July 30, 2024)). Under New Jersey law, “[c]ivil liability may be ‘expressly provided’ by a statute or conferred by a court as an ‘implied private right of action.’” Id. (quoting R.J. Gaydos Ins. Agency, Inc. v. Nat’l Consumer Ins. Co., 773 A.3d 1132, 1144 (N.J. 2001)). Blackman v. Northeastern Spine & Sports Medicine, LLC provides guidance. Civ. A. No. 24-7022, 2025 WL 77029, at *6 (D.N.J. Jan. 13, 2025). The court held the named plaintiff sufficiently pled her negligence claim against a healthcare provider which had been the target of a data breach. Id. The court held violations of the FTC Act and HIPAA could serve as evidence of negligence, particularly as to the existence of a duty. Id. The court further held the injury of class

members monitoring their financial and personal records in the wake of the data breach satisfied Article III standing and sufficiently pled the damages element of the negligence claim. Id. Here, Plaintiff alleges Avantic owed a duty of care to safeguard her PI, including PII and PHI, and failed to do so, resulting in a foreseeable data breach, which was the but-for and proximate cause of her damages. (ECF No. 1 ¶¶ 165–67.) She alleges Avantic owed her a duty both under the FTC Act and HIPAA6 and independently to “exercise reasonable care in obtaining, retaining, securing, safeguarding, deleting, and protecting the [PI] in its possession from being compromised, lost, stolen, accessed, and misused by unauthorized persons.” (Id. ¶¶ 86–91.) Plaintiff further alleges Avantic “failed to implement industry-standard cybersecurity measures,”

such as “installing appropriate malware detection software; monitoring and limiting the network ports; protecting web browsers and email management systems; setting up network systems such as firewalls, switches and routers; monitoring and protection of physical security systems; protection against any possible communication system; training staff regarding critical points.” (Id. ¶¶ 83–84.) She alleges Avantic knew or should have known of the risk of a data breach due to the frequent targeting of the healthcare industry by cyber attackers. (Id. ¶¶ 47–48.) Plaintiff then alleges her data was breached and published online due to these failures, and she has been injured

6 Plaintiff’s allegations of violations of the FTC Act and HIPAA do not constitute negligence per se, but are evidence of the duty owed to her and the other Class Members. by the publication of her personal information in the form of the cost of monitoring for credit and identity theft. (Id. ¶¶ 131–36.) Accepting each of these factual allegations as true, Plaintiff and the Class Members satisfy the factual basis for each element of a claim for negligence and are entitled to default judgment on the negligence claim. Accordingly, Plaintiff’s Motion for Default Judgment as to Count I—

negligence—of the Complaint is granted7. 3. Breach of Implied Contract The elements of a claim for breach of implied contract are the same as for express contracts under New Jersey law. In re U.S. Vision Data Breach Litig., 732 F. Supp. 3d 369, 377 (D.N.J. 2024). “To prove the existence of an implied contract, [a] [p]laintiff[] must demonstrate ‘mutual assent, consideration, legality of object, and capacity of the parties.’” Id. (quoting Duffy v. Charles Schwab & Co., Inc., 123 F. Supp. 2d 802, 818 (D.N.J. 2000)). However, “[t]he difference . . . between an implied and an express contract is that proof of an implied contract is inferred from the conduct of the parties rather than any verbal or written expression.” Id. “Mutual assent is an

essential element of an implied contract claim.” In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., Civ. A. No. 19-2904, 2021 WL 5937742, at *19 (D.N.J. Dec. 16, 2021). “In the data breach context, ‘the fact that a defendant required plaintiffs to provide personal information does not alone support the inference that the parties agreed for the defendant to secure this information.’” In re. Am. Financial Resources, Inc. Data Breach Litig., Civ. A. No. 22-1757, 2023 WL 3963804, at *8 (D.N.J. Mar. 29, 2023) (quoting In re Am. Med. Collection Agency, 2021 WL 5937742, at *19). Plaintiff must also allege “some other conduct by the Defendant from which

7 The disposition refers only to the issue of liability, as that is the issue upon which Plaintiff moved for Default Judgment. (ECF No. 14-1 at 3.) mutual assent for [Defendant] safeguard[ing] Plaintiff’s PI[] arose.” Id. Courts in this district, and others, allow breach of implied contract claims to proceed at a motion to dismiss stage8 if a plaintiff can plead that a defendant, “through privacy policies, codes of conduct, company security practices, and other conduct, implicitly promised to safeguard the plaintiffs’ personal information.” Id. at *20 (internal quotation marks omitted).

In Blackman v. Northeastern Spine & Sports Medicine, LLC, the court found the named plaintiff had failed to sufficiently plead breach of an implied contract because she had failed to allege mutual assent from the defendant healthcare company for specifically safeguarding her personal information beyond what was already required by statute. Blackman, 2025 WL 77029, at *6. Mere allegations of “promises and representations that the private information collected from them as a condition of obtaining medical services . . . would be kept safe [and] confidential” were not enough to sustain a claim for breach of an implied contract. See id. (“It is apparent from the Complaint that [the] [p]laintiff paid [the] [d]efendants to perform medical services and she provided her PI[] as a pre-requisite to receiving Defendant’s services.”); see In re Am. Med.

Collection Agency, 2021 WL 5937742, at *19–20 (distinguishing cases where an implied contract was found due to privacy policies, codes of conduct, or statements on a defendant’s website from cases where the plaintiff could not allege the defendant made any specific promises beyond its obligations under applicable law). See also In re BetMGM Data Breach Litig., 2024 WL 5710661, at *5 (recommending dismissal of a breach of implied contract claim against a company which had been the subject of a data breach for failure to allege mutual assent to safeguarding personal

8 The Court acknowledges the Motion requests default judgment and is not a motion to dismiss, however, “a litigant’s failure to state a claim upon which relief may be granted . . . prevents the presiding court from entering a default judgment.” Animal Sci. Prods., Inc., 596 F. Supp. at 848. information beyond its legal obligations); In re U.S. Vision Data Breach Litig., 732 F. Supp. 3d at 378 (dismissing a breach of implied contract claim for failure to allege all elements). Plaintiff does not allege Avantic “made any implicit promise to protect [PI] from third- party hackers or provide notice of a data breach beyond its obligations under applicable law” beyond a vague and insufficient reference to “promises and representations.” In re Am. Med.

Collection Agency, 2021 WL 5937742, at *20; (See also ECF No. 1 ¶ 27 (alleging “promises and representations”)). This is the same bare allegation the court found to be insufficient in Blackman. See Blackman, 2025 WL 77029, at *7. Further, a statement of “intent to follow federal law do[es] not support an independent cause of action for breach of implied contract.” In re Am. Med. Collection Agency, 2021 WL 5937742, at *20. In fact, like in Blackman and In re Am. Med. Collection Agency, Plaintiff specifically alleges Avantic “accepted possession of Plaintiff and Class Members’ Private Information for the purpose of providing medical services to Plaintiff and Class Members.” (ECF No. 1 ¶ 205.) Plaintiff does not identify any policies, codes of conduct, or statements by Avantic that would constitute promises beyond what Avantic was already required to do under applicable law.9 (See generally ECF No. 1.)

Accordingly, Plaintiff’s Motion for Default Judgment as to Count III—breach of implied contract—of the Complaint is denied. 4. Unjust Enrichment To establish an unjust enrichment claim, a plaintiff must show the “defendant received a benefit and that retention of that benefit without payment would be unjust.” VRG Corp. v. GKN

9 Plaintiff asserts “at all relevant times [Avantic] promulgated, adopted, and implemented written privacy policies whereby it expressly promised Plaintiff and Class Members that it would only disclose [PI] under certain circumstances, none of which relates to the Data Breach.” (ECF No. 1 ¶ 210.) Without any allegations of the wording of the policies, the Court cannot find a factual basis for the legal conclusion that any potential policy created a promise beyond applicable law. Realty Corp., 641 A.2d 519, 526 (N.J. 1994). “Retention is unjust when the plaintiff expects payment for the service or the defendant retains a benefit at the expense of the plaintiff.” Maersk Line v. TJM Int’l Ltd. Liab. Co., 427 F. Supp. 3d 528, 535 (D.N.J. 2019); see also Red Hawk Fire & Sec., LLC v. Siemens Indus. Inc., 449 F. Supp. 3d 449, 464 (D.N.J. 2020) (“The doctrine of unjust enrichment rests on the equitable principle that a person shall not be allowed to enrich

himself at the expense of another.” (internal quotation marks omitted)). Moreover, “a claim for unjust enrichment requires a direct relationship between the parties.” Hammer v. Vital Pharms., Inc., Civ. A. No. 11-4124, 2012 WL 1018842, at *10 (D.N.J. Mar. 26, 2012); see also Bedi v. BMW of N. Am., LLC, Civ. A. No. 15-1898, 2016 WL 324950, at *5 (D.N.J. Jan. 27, 2016). Courts have recognized personal information can constitute value in order to establish a claim for unjust enrichment. See In re Am. Med. Collection Agency, 2021 WL 5937742, at *18; In re U.S. Vision., 732 F. Supp. 3d 369 at 379–80. Courts in this district, however, have declined to allow such a claim to proceed in a complaint premised on a data breach against a healthcare company when there are no facts alleged asserting the defendant company received any additional value from the

PI it used to provide medical services or commoditized PI it obtained. Id. Plaintiff attempts to construe the general payments by Plaintiff and Class Members to Avantic with conferring additional benefit upon Avantic. (See ECF No. 1 ¶¶ 224–26.) Plaintiff alleges the unjust enrichment is the portion of payment received indirectly from Plaintiff and Class Members. (Id. ¶ 227.) Setting aside that an unjust enrichment claim requires a direct relationship10 between the parties, see Robinson, 2024 WL 1598416, at *3 (dismissing an unjust enrichment

10 It is unclear from the face of the Complaint exactly what relationship or relationships Plaintiff intended to allege. Plaintiff alleges the premise of damages based upon both “those cybersecurity costs [which] were passed on to Plaintiff and Class Members in the form of elevated prices charged by Defendant for its services” (ECF No. 1 ¶ 224), and “the amounts of payment received indirectly” (id. 1 ¶ 227). claim in a data breach case when “no facts in the Complaint allege a direct relationship between [the] [p]laintiff and [the] [d]efendants”), there are no facts alleged in the Complaint evidencing payment for the safeguarding of personal information beyond Avantic’s independent statutory obligations. (See generally ECF No. 1.) Like in In re American Medical Collection Agency, PI furnished for the purpose of medical services does not automatically transform into a unjustly

conferred benefit because of a data breach. See In re Am. Med. Collection Agency, 2021 WL 5937742, at *18. Accordingly, Plaintiff’s Motion for Default Judgment as to Count IV—unjust enrichment—of the Complaint is denied. IV. CONCLUSION For the reasons set forth above, Plaintiff’s Motion for Class Certification (ECF No. 14) is GRANTED, Plaintiff’s proposed class of approximately 1,400 Avantic patients whose files were leaked in the Data Breach is CERTIFIED, and Plaintiff’s Motion for Default Judgment as to the issue of liability is GRANTED IN PART as to Count I of the Complaint and DENIED IN PART

as to the other causes of action. An appropriate order follows.

/s/ Brian R. Martinotti HON. BRIAN R. MARTINOTTI UNITED STATES DISTRICT JUDGE Dated: July 29, 2026