In re GREDE HOLDINGS LLC DATA BREACH LITIGATION

• Court: District Court, E.D. Michigan
• Decided: February 12, 2026
• Docket: 2:25-cv-10831
• Status: Unknown

Opinion

UNITED STATES DISTRICT COURT EASTERN DISTRICT OF MICHIGAN SOUTHERN DIVISION

In re GREDE HOLDINGS LLC DATA Case No. 25-cv-10831 BREACH LITIGATION Honorable Robert J. White

OPINION AND ORDER GRANTING DEFENDANT’S MOTION TO DISMISS THE CONSOLIDATED CLASS ACTION COMPLAINT

I. Introduction Russell Higgins and Calvin McCorvey commenced this putative diversity class action against their former employer, Grede Holdings, LLC, after unknown third parties hacked the company’s network servers and obtained their personal identifying information. Before the Court is Grede’s motion to dismiss the consolidated class action complaint. (ECF No. 18). Higgins and McCorvey (the “plaintiffs”) responded in opposition. (ECF No. 19). Grede filed a reply. (ECF No. 20). The Court held a hearing on the motion on February 10, 2026. For the following reasons, the motion is granted. II. Background A. Factual History

Grede is a “component parts manufacturer” located in Southfield, Michigan. (ECF No. 16, PageID.171-72, ¶5; see also PageID.182, ¶ 38). Plaintiffs are former Grede employees. (Id., PageID.176, 179, ¶¶ 18, 28). They provided their personal

identifying information to Grede “as a condition of and in exchange for [their] employment.” (Id., PageID.176, 179, ¶¶ 18, 29). Sometime between January 27 through 28, 2025, hackers infiltrated Grede’s internal network server and retrieved plaintiffs’ personal identifying information.

(Id., PageID.170-71, ¶ 2). Plaintiffs believe that the accessed information includes “full names, dates of birth, Social Security numbers, driver’s license or state identification numbers, medical information, health insurance information, and other

sensitive data.” (Id., PageID.171, ¶ 2). On February 25, 2025, a ransomware group known as Cactus confirmed that they obtained personal identifying information from the data breach, which they have since “released on the dark web.” (Id., PageID.171, ¶ 3). Plaintiffs blame Grede

for the data breach insofar as the company failed to adequately protect their personal identifying information. (Id., PageID.172-74, ¶¶ 7-12). They seek money damages and prospective injunctive relief. (Id., PageID.176, ¶ 16; see also PageID.253-54). B. Procedural History Higgins filed this lawsuit against Grede as a putative class action. (ECF No. 1). The Court consolidated the litigation with McCorvey’s lawsuit and directed

plaintiffs to file a consolidated class action complaint. (ECF No. 14, PageID.165, ¶ 6). The consolidated pleading alleges causes of action (on behalf of plaintiffs and the putative class) for negligence, negligence per se, breach of implied contract,

unjust enrichment, breach of fiduciary duty, and injunctive and declaratory relief. (ECF No. 16, PageID.232-53, ¶¶ 181-264). Grede now moves to dismiss the consolidated class action complaint in its entirety. (ECF No. 18). III. Legal Standards

When reviewing a motion to dismiss the complaint for failing to state a claim, the Court must “construe the complaint in the light most favorable to the plaintiff and accept all factual allegations as true.” Daunt v. Benson, 999 F.3d 299, 308 (6th

Cir. 2021) (cleaned up); see also Fed. R. Civ. P. 12(b)(6). “The factual allegations in the complaint need to be sufficient to give notice to the defendant as to what claims are alleged, and the plaintiff must plead sufficient factual matter to render the legal claim plausible.” Fritz v. Charter Twp. of Comstock, 592 F.3d 718, 722 (6th

Cir. 2010) (quotation omitted). In diversity class action cases, like this one, federal courts “apply the substantive law of the forum state.” Savedoff v. Access Group, Inc., 524 F.3d 754, 762 (6th Cir. 2008). The Court will, therefore, apply Michigan law to decide whether the asserted claims are plausible.

IV. Analysis A. Negligence and Negligence Per se (Count I) To state a Michigan claim for negligence, the operative complaint must

plausibly allege that “(1) the defendant owed the plaintiff a legal duty, (2) the defendant breached the legal duty, (3) the plaintiff suffered damages, and (4) the defendant’s breach was a proximate cause of the plaintiff’s damages.” Hill v. Sears, Roebuck & Co., 492 Mich. 651, 660 (2012).

Assuming plaintiffs can show that Grede breached a legal duty owed to them – i.e., the first two negligence elements – their claim still falters on damages and causation.

1. Damages “[I]n Michigan, the injury complained of in a negligence action must be an actual, present injury.” Doe v. Henry Ford Health Sys., 308 Mich. App. 592, 600 (2014) (citation omitted). “It is a present injury, not fear of an injury in the future,

that gives rise to a cause of action under negligence theory.” Henry v. Dow Chem. Co., 473 Mich. 63, 73 (2005) (emphasis in original). The consolidated class action complaint alleges that plaintiffs:

sustained actual injuries and damages, including, without limitation, (a) actual misuse of their Private Information in the forms of identity theft and fraud; (b) theft of their Private Information by the ransomware group, Cactus; (c) publication of their Private Information on the dark web; (d) the certainly materialized risk and imminent threat of identity theft; (e) financial costs incurred mitigating the materialized risk and imminent threat of identity theft; (f) loss of time and loss of productivity incurred mitigating the materialized risk and imminent threat of identity theft; (g) financial costs incurred due to actual identity theft; (h) loss of time incurred due to actual identity theft; (i) deprivation of value of their Private Information; (j) loss of privacy; (k) emotional distress including anxiety and stress in with dealing with the Data Breach; and (l) the continued risk to their sensitive Private Information, which remains in Defendant’s possession and subject to further breaches, so long as Defendant fails to undertake adequate measures to protect the Plaintiffs’ and Class Members’ data it collects and maintains.

(ECF No. 16, PageID.210, ¶ 121; see also PageID.237-38, ¶ 204). Insofar as plaintiffs allege to have suffered injuries associated with the “risk” or “imminent threat” of future harm, those damages are not cognizable under Michigan law because they “are wholly derivative of a possible, future injury rather than an actual, present injury.” Henry, 473 Mich. at 78 (emphasis in original); see also Doe, 308 Mich. App. at 601. Nor can state negligence law remedy the asserted injuries that appear to be “actual” and “present.” For instance, Michigan does not recognize plaintiffs’ current “loss of privacy” or the “publication” of their personal identifying information alone as forms of compensable injury. See Nyman v. Thomson Reuters Holdings, Inc., 329 Mich. App. 539, 553 (2019) (rejecting the theory that “the release of information itself” or the “the invasion of privacy in and of itself damaged the plaintiff and the other patients whose information had been disclosed” in a data breach). The same

goes for the other “actual” and “present” harms alleged in the consolidated class action complaint. See Rakyta v. Munson Healthcare, No. 354831, 2021 Mich. App. LEXIS 5905, at *13-14 (Mich. Ct. App. Oct. 14, 2021) (holding that “the

unauthorized viewing of confidential information does not by itself reduce the value of the information.”); see id. at *14 (rejecting the argument that “allegations of damages arising from emotional distress or anxiety about a potential future injury were sufficient to save a claim from summary disposition.”).

What is more, the consolidated class action complaint contains no allegations that plaintiffs themselves are victims of identity theft or fraud; that they incurred “financial costs . . . due to actual identity theft”; or that they incurred any “loss of

time . . . due to actual identity theft.” (ECF No. 16, PageID.210, ¶ 121; see also PageID.237-38, ¶ 204). Higgins, at most, maintains that “a fraudulent charge was made to [his] bank account” on February 27, 2025 – nearly a month after the alleged data breach. (Id., PageID.177, ¶ 22). And McCorvey claims that he “experienced a

sharp uptick in suspicious spam calls and texts using his Private Information compromised in the Data Breach.” (Id., PageID.181, ¶ 37). But neither incident raises a plausible inference that they are victims of “actual identity theft or fraud.”

(Id., PageID.210, ¶ 121; see also PageID.237-38, ¶ 204). So, taken together, none of the averments in the consolidated class action complaint plausibly establish that plaintiffs suffered “actual” and “present” injuries.

See Polkowski, 2025 U.S. Dist. LEXIS 217278, at *23 (holding that the “disclosure of stolen information alone is not a present injury if no actual identity theft resulted from the disclosure.”).

2. Causation Lack of causation presents another hurdle. Both factual and proximate causation are necessary to prevail in a Michigan negligence action. See Craig v. Oakwood Hosp., 471 Mich. 67, 86-87 (2004). Factual causation requires a “showing

that ‘but for’ the defendant’s actions, the plaintiff’s injury would not have occurred.” Ray v. Swager, 501 Mich. 52, 63 (2017) (quotation omitted). Proximate causation “involves examining the foreseeability of consequences, and whether a defendant

should be held legally responsible for such consequences.” Id. (quotation omitted). Courts “must find that the defendant’s negligence was a cause in fact of the plaintiff’s injuries before it can hold that the defendant’s negligence was the proximate or legal cause of those injuries.” Craig, 471 Mich. at 87.

Plaintiffs cannot satisfy the factual causation prong. Even if the Court presumed that the fraudulent bank charge and the unsolicited spam communications qualify as “actual” and “present” injuries, the consolidated class action complaint

omits any plausible allegations that “but for” the data breach those injuries “would not have occurred.” Ray, 501 Mich. at 63; see also Tumminello v. Father Ryan High Sch., Inc., 678 F. App’x 281, 288 (6th Cir. 2017) (affirming dismissal of a state law

negligence claim where the complaint contained insufficient allegations to plausibly establish causation). And the alleged temporal proximity between the data breach, the fraudulent bank charge, and the unsolicited spam communications is insufficient

to plausibly establish a causal link. See Lund v. Travelers Indem. Co. of Am., No. 330212, 2016 Mich. App. LEXIS 2427, at *18 (Mich. Ct. App. Dec. 29, 2016) (“Showing only a temporal relationship is generally insufficient to create a fact issue on a necessary causal link between a plaintiff’s accidental injury and subsequent

complaints and treatments.”); see also Craig, 471 Mich. at 93 (“It is axiomatic in logic and in science that correlation is not causation.”). Because the consolidated class action complaint lacks sufficient allegations of

“actual” and “present” damages, as well as factual causation, plaintiffs cannot “nudge” their negligence claim “across the line from conceivable to plausible.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007) (cleaned up). 3. Negligence Per Se

Turning to plaintiffs’ negligence per se theory, it is well-established that Michigan law “does not subscribe to [that] doctrine” as an independent tort. Candelaria v. B.C. Gen. Contrs., Inc., 236 Mich. App. 67, 82 (1999); see also Abnet

v. Coca-Cola Co., 786 F. Supp. 2d 1341, 1345 (W.D. Mich. 2011). The Michigan Supreme Court instead views the “violation of a statute by plaintiff or defendant” as establishing “a prima facie case from which a jury may draw an inference of

negligence.” Zeni v. Anderson, 397 Mich. 117, 122 (1976); see also Klanseck v. Anderson Sales & Serv., Inc., 426 Mich. 78, 86 (1986) (“The fact that a person has violated a safety statute may be admitted as evidence bearing on the question of

negligence . . . evidence of violation of a penal statute creates a rebuttable presumption of negligence.”). At any rate, as already discussed above, the consolidated class action complaint falls short of plausibly demonstrating that (1) plaintiffs suffered “actual”

and “present” injuries, or (2) that the data breach factually caused these supposed injuries. So, for all these reasons, the negligence per se claim fails as a matter of law.

B. Breach of Implied Contract (Count II) Under Michigan law, the breach of an implied contract comprises the same elements as the breach of an express contract. See Borg-Warner Acceptance Corp. v. Dep’t of State, 169 Mich. App. 587, 590 (1988), rev’d on other grounds, 433 Mich.

16 (1989). The non-breaching party must plausibly show (1) the existence of a contract, (2) the other party breached the contract, and (3) the party asserting the breach of contract suffered damages because of the breach. Miller-Davis Co. v.

Ahrens Const., Inc. (On Remand), 296 Mich. App. 56, 71 (2012). An implied contract must satisfy the following elements: (1) the presence of parties competent to contract; (2) a proper subject matter; (3) consideration; (4) mutuality of

agreement; and (5) mutuality of obligation. Calhoun Co. v. Blue Cross & Blue Shield of Mich., 297 Mich. App. 1, 13 (2012). Even assuming the existence of a mutuality of agreement between the parties

– i.e., that plaintiffs provided their personal identifying information to Grede “in exchange for employment and an implied assurance that the [personal identifying information] would be sufficiently protected” – plaintiffs cannot point to an independent source of consideration for this promise beyond their “express

employment relationship.” Polkowski v. Jack. Doheny Co., Inc., No. 25-10516, 2025 U.S. Dist. LEXIS 217278, at *28 (E.D. Mich. Nov. 4, 2025); see also Belle Isle Grill Corp. v. City of Detroit, 256 Mich. App. 463, 478 (2003) (stating that “a contract

will be implied only if there is no express contract covering the same subject matter.”). Because Plaintiffs’ “provision of [personal identifying information] was merely incidental to their employment” it “cannot serve as consideration for a

separate agreement to safeguard that data.” Polkowski, 2025 U.S. Dist. LEXIS 217278, at *28. For this reason, plaintiffs fail to state a plausible claim for relief under an implied contractual theory. C. Unjust Enrichment (Count III) A Michigan unjust enrichment claim requires the plaintiff to plausibly

demonstrate “(1) the receipt of a benefit by defendant from plaintiff, and (2) an inequity resulting to plaintiff because of the retention of the benefit by defendant.” Deschane v. Klug, 344 Mich. App. 744, 753 (2022) (quotation omitted). “Not all

enrichment is unjust in nature.” Karaus v. Bank of N.Y. Mellon, 300 Mich. App. 9, 23 (2012). The “key to determining whether enrichment is unjust is determining whether a party unjustly received and retained an independent benefit.” Id.; see also Landstar Express Am., Inc. v. Nexteer Auto. Corp., 319 Mich. App. 192, 205 (2017).

In the employment setting, the benefit received must be independent from the consideration underlying an existing employer-employee relationship. The benefit received cannot be “incidental to the parties’ employment relationship.” Polkowski,

2025 U.S. Dist. LEXIS 217278, at *30; see also Meisner Law Group P.C. v. Weston Downs Condo. Ass’n., 321 Mich. App. 702, 726 (2017) (“For . . . unjust enrichment to apply, there must not be an express contract between the parties covering the same subject matter.”).

Here, the consolidated class action complaint does not assert that plaintiffs provided their personal identifying information to Grede as a benefit independent and apart from the consideration already supporting their employment relationship.

Instead, any benefit Grede may have “received from maintaining or using” plaintiffs’ personal identifying information “was merely incidental to the parties’ employment relationship.” Id.; see also Johnson v. Nice Pak Prods., 736 F. Supp. 3d 639, 652

(S.D. Ind. 2024) (dismissing Indiana law unjust enrichment claim because the plaintiffs failed to allege in a data breach case that “Defendants benefited from the PII information other than as incidental to benefitting from Plaintiffs’ compensated

labor.”); McLaughlin v. Taylor Univ., No. 23-00527, 2024 U.S. Dist. LEXIS 172249, at *27 (N.D. Ind. Sep. 23, 2024) (same). Absent this showing – that the personal identifying information plausibly conferred an independent benefit on Grede – the unjust enrichment claim cannot

succeed and must be dismissed. D. Breach of Fiduciary Duty (Count IV) To successfully plead a breach of fiduciary duty under Michigan law, the

plaintiff must plausibly establish (1) the existence of a fiduciary duty, (2) a breach of that duty, and (3) damages caused by the breach of duty. Highfield Beach v. Sanderson, 331 Mich. App. 636, 666 (2020). “[A] fiduciary relationship arises from the reposing of faith, confidence, and trust and the reliance of one on the judgment

and advice of another.” Teadt v. St. John’s Evangelical Church, 237 Mich. App. 567, 580-581 (1999). “A person in a fiduciary relation to another is under a duty to act for the benefit of the other with regard to matters within the scope of the relation.”

Id. at 581. An employer-employee relationship will not typically “give rise to a fiduciary relationship unless the employee is a high-level employee, or a specific agency

relationship exists.” Brooks Williamson & Assocs. v. Braun, No. 357170, 2022 Mich. App. LEXIS 2698, at *16 (Mich. Ct. App. May 12, 2022) (quotation omitted); see also Bradley v. Gleason Works, 175 Mich. App. 459, 463 (1989) (noting a lack of

Michigan authority for the principle “that an employer-employee relationship is fiduciary in nature”). “High-level employees include those such as corporate officers and members of corporate boards of directors.”1 Brooks Williamson, 2022 Mich. App. LEXIS 2698, at *16 (citation omitted).

Because plaintiffs do not claim to have acted as “high-level” Grede employees, or that they ever maintained a special agency relationship with the company, they fail to plausibly establish that Grede owed them a fiduciary duty

under Michigan law. And without this showing, the breach of fiduciary claim cannot withstand Rule 12(b)(6) dismissal.

1 Even in this circumstance, the fiduciary obligation usually runs from the high-level employee to the company – not the other way around. See, e.g., Prod. Finishing Corp. v. Shields, 158 Mich. App. 479, 485 (1987) (stating that “[a] corporate officer or director is under a fiduciary obligation not to divert a corporate business opportunity for his own personal gain.”); see also Angstrom Aluminum Castings, LLC v. Reed, No. 358611, 2023 Mich. App. LEXIS 1171, at *6 (Mich. Ct. App. Feb. 16, 2023) (same). E. Injunctive and Declaratory Relief (Count V) Lastly, the injunctive and declaratory relief claims are both implausible.

Plaintiffs cannot obtain injunctive relief because (1) it is not an independent cause of action, and (2) plaintiffs cannot prevail on any of their underlying substantive claims. See Terlecki v. Stewart, 278 Mich. App. 644, 663 (2008) (noting that “an

injunction is an equitable remedy, not an independent cause of action.”); Kircher v. City of Ypsilanti, 269 Mich. App. 224, 232 (2005) (holding that the plaintiff was entitled to injunctive relief only insofar as a substantive claim remained actionable). Nor can they obtain a declaratory judgment for largely the same reasons. See

Taxpayers Allied for Constitutional Taxation v. Wayne Co., 450 Mich. 119, 128, (1995) (holding that a declaratory judgment must be founded upon some entitlement to substantive relief). Any injunctive or declaratory remedy is, therefore,

unavailable. F. Amendment Federal Rule of Civil Procedure 15(a)(2) provides that leave to amend a pleading should be freely given “when justice so requires.” That means “the district

court must be able to determine whether ‘justice so requires,’ and in order to do this, the court must have before it the substance of the proposed amendment.” Roskam Baking Co., Inc. v. Lanham Machinery Co., Inc., 288 F.3d 895, 906 (6th Cir. 2002)

(citation omitted). “[A] bare request in an opposition to a motion to dismiss – without any indication of the particular grounds on which amendment is sought – does not constitute a motion within the contemplation of Rule 15(a).” Beydoun v.

Sessions, 871 F.3d 459, 469 (6th Cir. 2017) (quotation omitted); see also Fed. R. Civ. P. 7(b)(1) (“A request for a court order must be made by motion.”). Plaintiffs’ request for leave to amend the complaint fits this description

exactly. Their counsel only first suggested at the February 10 hearing that plaintiffs would be able to amend the complaint to cure the asserted defects. But plaintiffs did not file a proper motion for leave to amend. Nor did they propose how they intend to correct the pleading deficiencies identified in the complaint. See Beydoun, 871

F.3d at 470 (affirming denial of oral motion for leave to amend the complaint); see also Johnson v. FCA US LLC, 555 F. Supp. 3d 488, 509-10 (E.D. Mich. 2021) (denying oral motion for leave to amend the complaint).

Because plaintiffs “submitted none of th[e] facts to aid the court in deciding whether justice require[s] the court to grant leave to amend,” their request for leave to amend must be denied. Roskam Baking, 288 F.3d at 906. Accordingly,

IT IS ORDERED that Grede’s motion to dismiss the consolidated class action complaint (ECF No. 18) is granted. Dated: February 12, 2026 s/ Robert J. White Robert J. White United States District Judge