In re Young Consulting Data Breach Litigation

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ATLANTA DIVISION IN RE YOUNG CONSULTING DATA CIVIL ACTION FILE NO. BREACH LITIGATION 1:24-CV-3938-TWT ALL CASES

OPINION AND ORDER This is a class action data breach action. It is before the Court on Defendant California Physicians’ Service d/b/a Blue Shield of California’s (“Blue Shield”) Motion to Dismiss [Doc. 43] and Defendant Young Consulting, LLC’s d/b/a Connexure’s (“Young Consulting”) Motion to Dismiss [Doc. 45]. For the reasons set forth below, the Court GRANTS in part and DENIES in part

Defendant Blue Shield’s Motion to Dismiss [Doc. 43] and GRANTS in part and DENIES in part Defendant Young Consulting’s Motion to Dismiss [Doc. 45]. I. Background This case arises from a data breach involving Defendants California Physicians’ Service’s d/b/a Blue Shield of California and Young Consulting, LLC d/b/a Connexure. Blue Shield is a health insurance company that “provides coverage to approximately 4.5 million individuals.” (Consol. Am.

Class Action Compl. (“CAC”) ¶ 20 [Doc. 31].) Through its coverage, it collects the personally identifiable information (“PII”) and protected health information (“PHI”) of its “members, patients, customers, business partners, and employees.” ( ¶¶ 21, 26.) Young Consulting is a company that provides “software solutions” to health insurance companies, including Blue Shield. ( ¶ 19.) In providing its services, Young Consulting accessed and maintained the PII and PHI collected by Blue Shield and other health insurance companies.

( ¶ 36, 21.) In April 2024, “an unauthorized actor” accessed Young Consulting’s network and stole the PII and PHI of at least 1,071,336 individuals, including information associated with Blue Shield. ( ¶¶ 46–47, 54, 60.) About four months later, Young Consulting and Blue Shield notified the affected individuals and the public about the data breach. ( ¶¶ 44–45.) The “Notice

Letter” states that the stolen data may have included names, Social Security numbers, dates of birth, and “insurance policy/claim information.” Young Consulting, LLC, (“Notice Letter”) (last visited July 3, 2026), https://youngconsulting.com/notice/youngconsulting-notice.html. 1 According to the Complaint, the data likely also includes sensitive medical information such as an individual’s diagnoses, treatments, physicians, and medications.

( CAC ¶ 54.) The prominent ransomware group BlackSuit later claimed

1 Courts ordinarily cannot consider documents outside the pleadings on a motion to dismiss. Fed. R. Civ. P. 12(d). However, the Eleventh Circuit has held that courts may do so if the document is “(1) central to the plaintiff's claims; and (2) undisputed, meaning that its authenticity is not challenged.” , 107 F.4th 1292, 1300 (11th Cir. 2024). Here, the Notice Letter is obviously central to the Plaintiffs’ claims, and none of the parties dispute its authenticity. 2 responsibility for the breach and published the stolen data on the “dark web” for download. ( ¶¶ 48–53, 68.) As of the date of the Complaint’s filing, the data remained available for download, along with a “directory listing each

stolen file by name.” ( ¶ 53.) The Plaintiffs allege that this cyberattack was a foreseeable result of Young Consulting’s failure to implement appropriate safeguards and Blue Shield’s failure to vet and monitor Young Consulting. ( ¶¶ 42–43, 65–67, 73.) The alleged injuries are numerous, including identity theft and fraud, out-of-pocket expenses for fraud monitoring and prevention tools, and the

“[c]ontinued and imminent risk of future fraud and identity theft.” ( ¶ 115.) The Plaintiffs further allege that Young Consulting’s “delayed and incomplete” Notice Letter hindered their ability to respond quickly and proactively to the breach. ( ¶ 122.) The Plaintiffs assert a total of fifteen claims. They assert eight claims against Defendant Young Consulting: negligence (Count I), negligence per se (Count II), breach of fiduciary duty (Count VI), breach of third-party

beneficiary contract (Count X), declaratory and injunctive relief (Count XI), and three state law claims under California law (Counts XII–XIV). And they assert eleven claims against Blue Shield: negligence (Count III), negligence per se (Count IV), unjust enrichment (Count V), breach of fiduciary duty (Count VII), invasion of privacy in violation of the California Constitution

3 (Count VIII), breach of implied contract (Count IX), declaratory and injunctive relief (Count XI), and four claims under California law (Counts XII–XV). II. Legal Standard

A complaint should be dismissed under Rule 12(b)(1) only where the court lacks jurisdiction over the subject matter of the dispute. Fed. R. Civ. P. 12(b)(1). Attacks on subject matter jurisdiction come in two forms: “facial attacks” and “factual attacks.” , 104 F.3d 1256, 1260 (11th Cir. 1997). Facial attacks on the complaint “require the court merely to look and see if the plaintiff has sufficiently alleged

a basis of subject matter jurisdiction, and the allegations in his complaint are taken as true for the purposes of the motion.” at 1261 (citation modified). On a facial attack, therefore, a plaintiff is afforded safeguards similar to those provided in opposing a Rule 12(b)(6) motion. , 645 F.2d 404, 412 (5th Cir. May 1981).2 “Factual attacks, on the other hand, challenge the existence of subject matter jurisdiction in fact, irrespective of the pleadings, and matters outside the pleadings, such as testimony and affidavits, are

considered.” , 104 F.3d at 1261 (citation modified). On a factual attack, “no presumptive truthfulness attaches to plaintiff’s allegations, and the existence of disputed material facts will not preclude the trial court from

2 The Eleventh Circuit has adopted as binding precedent all decisions of the Fifth Circuit issued prior to the close of business on September 30, 1981. , 661 F.2d 1206, 1207 (11th Cir. 1981). 4 evaluating for itself the merits of jurisdictional claims.” , 175 F.3d 957, 960–61 (11th Cir. 1999) (quotation marks and citation omitted). A complaint should be dismissed under Rule 12(b)(6) only where it

appears that the facts alleged fail to state a “plausible” claim for relief. , 556 U.S. 662, 678 (2009); Fed. R. Civ. P. 12(b)(6). A complaint may survive a motion to dismiss for failure to state a claim, however, even if it is “improbable” that a plaintiff would be able to prove those facts and even if the possibility of recovery is extremely “remote and unlikely.” , 550 U.S. 544, 556 (2007). In ruling on a motion to dismiss, the court

must accept the facts pleaded in the complaint as true and construe them in the light most favorable to the plaintiff. , 711 F.2d 989, 994–95 (11th Cir. 1983); , 40 F.3d 247, 251 (7th Cir. 1994) (noting that, at the pleading stage, the plaintiff “receives the benefit of imagination”). Generally, notice pleading is all that is required for a valid complaint. , 753 F.2d 974, 975

(11th Cir. 1985). Under notice pleading, the plaintiff need only give the defendant fair notice of the plaintiff’s claim and the grounds upon which it rests. , 551 U.S. 89, 93 (2007) (citing , 550 U.S. at 555).

5 III. Discussion A. Article III Standing Standing is a “threshold jurisdictional question” that the Court must

address before all other questions. , 494 F.3d 1356, 1359 (11th Cir. 2007) (citations omitted). Article III extends the judicial power of federal courts only to “cases” and “controversies” between parties. , 578 U.S. 330, 337 (2016) (quoting U.S. Const. art. III, §§ 1–2). To ensure that federal courts adjudicate only “cases” and “controversies,” the Plaintiffs must establish (1) an

injury in fact, (2) causation, and (3) redressability. , 693 F.3d 1317, 1323 (11th Cir. 2012) (quoting , 528 U.S. 167, 180–81 (2000)). A suit may proceed as long as at least one named plaintiff possesses standing as to each claim advanced. , 999 F.3d 1247, 1261 (11th Cir. 2021) (citing , 941 F.3d 1116, 1124–25 (11th Cir. 2019)). In its briefing, Defendant Young Consulting

challenges the injury-in-fact and causation elements. Defendant Blue Shield does not challenge the Plaintiffs’ standing. 1. Injury in Fact An injury in fact is “(a) concrete and particularized and (b) actual or imminent, not conjectural or hypothetical.” , 693 F.3d at 1323

6 (quoting , 528 U.S. at 180–81). For plaintiffs seeking injunctive relief, a “material risk of future harm” qualifies as a concrete injury. However, for those seeking monetary relief, the “mere risk of future harm, without more,”

does not qualify as a concrete injury. , 73 F.4th 883, 889 (11th Cir. 2023) (citing , 594 U.S. 413, 2210 (2021)). Plaintiffs seeking monetary relief must allege either (1) “tangible harms, like physical or monetary harms” or (2) “intangible harms, like injuries with a close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts.” at 889. Here, the

Plaintiffs seek both injunctive and monetary relief. Young Consulting denies the existence of an injury in fact, arguing that there are no allegations of actual misuse of information or identity fraud nor is there a substantial risk that either will occur in the future. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 13 [Doc. 45-1].) The company notes that, as of December 2025, nineteen months had passed since the data breach without incident. ( )

The Plaintiffs satisfy the injury-in-fact requirement. No “actual” identity theft or fraud is required to establish a concrete injury. As the Eleventh Circuit stated, “a plaintiff whose personal information is subject to a data breach can establish a concrete injury for purposes of Article III standing if, as a result of the breach, he experiences ‘misuse’ of his data in some way.”

7 , 73 F.4th at 889 (quoting , 986 F.3d 1332, 1343 (11th Cir. 2021)); at 890 n.9 (recognizing data misuse as an intangible harm sufficient to confer Article III standing, and

reading as consistent with ’s common law analog test despite being issued before ). The misuse of a plaintiff’s personal information includes instances in which cybercriminals “expose[ ]” the data “for theft and sale on the dark web.” In those instances, the misuse “establishes both a present injury—. . . personal information floating around on the dark web—and a substantial risk of future injury—future misuse of

personal information associated with the hacked [information].” at 890. Here, the Complaint alleges this exact kind of misuse. It alleges that the BlackSuit hackers “made the stolen data available for download on the dark web, exposing Plaintiffs’ and Class Members’ information to malicious actors worldwide.” (CAC ¶ 52.) Indeed, the Complaint alleges that three Named Plaintiffs received alerts that their sensitive data had been uploaded to the dark web. ( ¶ 133, 159, 168.) The Complaint further alleges that “the stolen

data is still available for download” on the dark web, ( ¶ 53), and of a kind that is “particularly valuable to thieves” seeking to commit “medical fraud, identity theft, tax fraud, credit and bank fraud, and more,” ( ¶ 96). The sensitive data allegedly includes the Plaintiffs’ “names, Social Security numbers, dates of birth, and insurance claims information.” ( ¶ 3.) Accepting

8 these allegations as true, the Court finds that this alleged misuse of data constitutes both an actual injury and a substantial risk of future injury. , 73 F.4th at 890. That three of the Named Plaintiffs received

dark web alerts supports—rather than hurts—the Plaintiffs’ theory of standing, as it increases the risk that the data of other Plaintiffs will be on the dark web. , 749 F. Supp. 3d 1240, 1258 (S.D. Fla. 2024) (citing , 603 F. Supp. 3d 1183, 1202 (S.D. Fla. 2022)). For purposes of proving a concrete injury, the Complaint need not contain

further details on exactly who uploaded the data to the dark web or when, as Young Consulting suggests. Lastly, to the extent Young Consulting challenges the Plaintiffs’ statutory standing on the same grounds addressed above, (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 13–14), the Court finds the Plaintiffs possess statutory standing. The Court addresses the standing arguments specific to the California Unfair Competition Law below.

2. Causation To satisfy the causation element, the Plaintiffs must show that their alleged injuries are “fairly traceable” to Defendant Young Consulting’s conduct. , 693 F.3d at 1323 (quoting , 528 U.S. at 180–81). According to Young Consulting, the alleged injuries are not fairly traceable

9 because the Plaintiffs provide “no explanation” as to how they determined Young Consulting’s actions caused their injuries and cannot establish who may have uploaded the Plaintiffs’ PII to the dark web or when. ( Br. in Supp. of

Def. Young Consulting’s Mot. to Dismiss, at 11–12.) The Court finds the Plaintiffs’ alleged injuries fairly traceable to Defendant Young Consulting’s conduct. The Plaintiffs allege that Young Consulting failed to “implement reasonable and appropriate administrative, technical, and physical safeguards to protect the sensitive data it received and maintained.” (CAC ¶ 42.) The Complaint lists a variety of security precautions

recommended by relevant government agencies that could hinder a cyberattack like that launched by BlackSuit, then alleges on information and belief that Young Consulting “failed to implement some or all of these well-established security controls.” ( ¶¶ 71–73.) While the Plaintiffs do not specify which security precautions Young Consulting failed to take or how the hackers were able to infiltrate Young Consulting’s systems, allegations of such are not required at this time. Indeed, it is likely the answers to these questions

can only be found through discovery. Lastly, the Court finds unpersuasive Young Consulting’s suggestion that another data breach or incident may be the reason why the Plaintiffs’ PII is on the dark web. For standing purposes, it is sufficient that the Complaint points to a web post by BlackSuit claiming responsibility for the cyberattack and claiming to have uploaded the sensitive

10 data to the dark web. ( ¶¶ 48–50.) And this is to say nothing of the fact that at least one Plaintiff—Plaintiff Emily Desley-Bloom—received an alert that her name and Social Security number were uploaded to the dark web due to

this specific data breach. ( ¶ 133.) B. Choice of Law Before proceeding to the merits of the common law claims, the Court addresses choice of law. Georgia’s choice-of-law rules determine the applicable state law. , 763 F.3d 1265, 1270 (11th Cir. 2014) (citations omitted). In Georgia, courts traditionally apply the law of

the state where the tort was committed for tort claims ( ) and the law of the state where a contract was made for contract and quasi-contract claims ( ). , 532 B.R. 859, 865 (N.D. Ga. 2015) (citations omitted). However, one odd exception to these rules is that “Georgia courts do not apply other states’ common law” and instead “apply only the statutory law of other states.” , 823 Fed. App’x 815, 822 (11th Cir. 2020) (citing

, 713 F.2d 1500, 1503 (11th Cir. 1983)). In other words, even if or would traditionally require the application of another state’s laws, Georgia courts do not apply the substantive law of that state unless codified in statute. The Georgia Supreme Court re-affirmed this common law exception most recently in

11 , 300 Ga. 722, 728–35 (2017) (“[A] Georgia court will defer to another state’s statutes, as well as its judicial decisions authoritatively interpreting those statutes, in determining the law of that state. . . . In the

absence of a statute, however, . . . a Georgia court will apply the common law as expounded by the courts of Georgia.”). Now, the Court will review the parties’ positions on choice of law. The Defendants apply Georgia law to all common law claims for the purposes of the present motions. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 5 n.3 [Doc. 43-1] (noting that it does so “without conceding that Georgia law applies

to Plaintiffs or the entire putative class); Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 17–25 (applying Georgia law without expressly addressing choice of law).) By contrast, the Plaintiffs appear to apply Georgia law to all tort claims but take a different approach for the contract and quasi contract claims. For unjust enrichment, the Plaintiffs point out that California law may govern the claim and conflict with Georgia law on the subject. (Pls.’ Joint Resp. Br. to Defs.’ Mots. to Dismiss, at 28 [Doc. 51].) For

the third-party breach of contract claim (Count X), they argue it would be premature to determine which state’s laws apply because the contracts, including their choice-of-law provisions, have not yet been entered into the record. ( at 29–30.) For the breach of implied contract claim (Count IX), the Plaintiffs do not expressly address choice of law or raise any conflict-of-law

12 issues between the laws of Georgia, California, or other states. ( at 32– 33.) The Court will apply Georgia law to all common law claims at this time

pursuant to the foreign law exception.3 , 713 F.2d at 1503; , 2022 WL 409484, at *4 (N.D. Ga. Feb. 10, 2022) (quoting , 300 Ga. at 729–33); , 861 Fed. App’x 270, 277–78 (citations omitted)). No party has directed the Court to any relevant state statute regarding the common law claims, and the Court will not seek out statutory bases for each of

the common law claims, though some may exist. , 362 F. Supp. 3d 1295, 1312 (N.D. Ga. 2019) (applying Georgia law to all common law claims because the plaintiffs “identif[ied] no foreign statutes that govern their common law claims”); , 215 F.R.D. 660, 679 (N.D. Ga. 2003) (applying Georgia law where “the parties have not directed the Court’s attention to statutes of foreign states”).

3 Because of the historical nature of Georgia’s unique exception, there is some confusion over whether it “applies to common law claims that arise in states, or only those where ‘the other state was one of, or formed from the territory of one of, the original 13 colonies that inherited the common law of England.” , 764 F. Supp. 3d 1233, 1257–58 (N.D. Ga. 2024) (citing , 300 Ga. at 731 n.5). Following in ’s footsteps, the Court applies the exception to all states in the present litigation. at 1258 (applying the exception to all state subclasses because the Georgia Supreme Court had applied the exception to Florida on at least one occasion). 13 C. Negligence (Counts I, III) To survive a motion to dismiss their negligence claim, the Plaintiffs must allege a legal duty, a breach of that duty, causation, and damages.

, 289 Ga. 565, 566 (2011) (citing , 278 Ga. 747, 751 (2004)). The Defendants dispute three of these elements, with both Defendants challenging causation, Blue Shield challenging duty, and Young Consulting challenging damages. The Court denies the Defendants’ Motion to Dismiss as to the negligence claims (Counts I, III) for the reasons set forth below.

1. Young Consulting (Count I) Young Consulting takes the following positions. As to causation, Young Consulting argues that the Plaintiffs’ “conclusory and unsupported” allegations about its actions establish no more than the “mere possibility” that Young Consulting caused the data breach. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 18–19.) As to damages, Young Consulting argues that no Plaintiff suffered “actual identity theft” nor verified whether

his or her data was posted on the dark web. ( at 19.) According to Young

The Georgia Supreme Court and Eleventh Circuit have declined to expressly address this question. , 300 Ga. at 731 n.5 (declining to address the question after finding it sufficient that “Alabama was formed predominantly from the territory of Georgia”); , 823 Fed. App’x at 823 n.3 (declining to address the question as the argument was raised for the first time in reply). 14 Consulting, only Plaintiffs Desley-Bloom, Murillo, and Wasserman allege that their data be on the dark web, but none allege where it was posted, when, or by whom. ( )

The Court holds that the Complaint plausibly pleads causation and damages as to Young Consulting. The Plaintiffs allege that Young Consulting “fail[ed] to use reasonable measures to protect Private Information and fail[ed] to comply with applicable industry standards” designed to thwart “foreseeable security threats such as ransomware attacks.” (CAC ¶ 217; ¶ 224 (alleging eight ways Young Consulting breached its duties to secure the

Plaintiffs’ sensitive data).) These allegations are sufficient at the pleading stage to establish causation. Courts recognize that plaintiffs often cannot explain a company’s particular securities practices without the benefit of discovery, given that the information is often within the company’s exclusive control. , 69 F.4th 1213, 1220–21 (11th Cir. 2023); , 2025 WL 1643485, at *3 (N.D. Ga. June 9, 2025); , 864 F. Supp. 2d 1302,

1311 (S.D. Fla. 2011) (quoting , 604 F.3d 110, 120 (2d Cir. 2010)) (“Pleading on information [and] belief is still permissible where . . . the facts are ‘peculiarly within the possession and control of the defendant.’”).

15 As to damages, the Plaintiffs’ allegations satisfy the plausibility standard. As a result of the data breach, the Plaintiffs allege that they have suffered or will imminently suffer damages such as “out-of-pocket expenses

associated with the prevention, detection, and recovery from identity theft, fraud, and/or unauthorized use of their Private Information”; “time, effort, and expense associated with placing fraud alerts or freezes on credit reports”; “anxiety, emotional distress, [and] loss of privacy”; “the present value of ongoing credit monitoring and identity defense services”; and “the loss of the benefit of the bargain for the failure of Defendant Young Consulting to securely

store and maintain their Private Information.” (CAC ¶ 228.) The Complaint alleges that the ransomware group that targeted Young Consulting uploaded the Plaintiffs’ PII and PHI to the dark web and thus exposed the Plaintiffs to these harms. ( ¶ 52.) Contrary to Young Consulting’s position, the Complaint need not plead more, such as alleging that each individual Plaintiff verified that his or data was uploaded, the specific domain to which it was uploaded, or the specific date of publishing. As discussed above, the fact that

three of the Plaintiffs received dark web alerts makes it more plausible (not less likely) that other Plaintiffs’ data was uploaded to the dark web and exposed the Plaintiffs to these harms.

16 2. Blue Shield (Count III) Blue Shield argues it owed the Plaintiffs no duty to safeguard their data because it had no special relationship to the Plaintiffs requiring such and could

not otherwise foresee the risk of a cyberattack on Young Consulting. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 9–11.) It additionally argues that the Complaint lacks “concrete allegations” on how the company caused the Plaintiffs’ injuries, ( at 7), and points out that Blue Shield cannot be the proximate cause of those injuries because it neither launched nor suffered the cyberattack, ( at 8).

a. Duty The Court begins with the law on duty. In Georgia, one does not owe “a general legal duty to all the world not to subject others to an unreasonable risk of harm.” , 313 Ga. 533, 544 (2022) (citations omitted). This is because one has “no duty to rescue another from a situation of peril which the former has not caused.” , 302 Ga. App. 260, 263 (2010) (quoting , 270 Ga. 770,

773 (1999)). In other words, one has no “duty to control the conduct of a potential tortfeasor[ ] so as to prevent that person from harming a third person.” , 263 Ga. 26, 28 n.3 (1993) (quoting , 185 Ga. App. 798, 801 (1988)), , 317 Ga. 703 (2023). But a duty of care may arise

17 where “(a) a special relation exists between the actor and the third person which imposes a duty upon the actor to control the tortfeasor’s conduct, or (b) a special relation exists between the actor and the tortfeasor which gives to the

third person a right to protection.” (quoting , 185 Ga. App. at 801); , 356 Ga. App. 706, 710 (2020) (quoting , 263 Ga. App. 139, 142 (2003)). Georgia courts have recognized special relationships between landlords and tenants, employers and employees, common carriers and passengers, doctors and patients, and more. , 69 F.4th at 1219. The duty, however, is “generally limited to reasonably

foreseeable risks of harm.” , 313 Ga. at 537 n.3; , 300 Ga. 327, 330 (2016) (explaining that “public policy” considerations may further curb the “bounds of duty,” even if the risk of harm is foreseeable). Courts in this circuit have applied these principles in the data breach context. In , the Eleventh Circuit held that the defendant had a duty to protect its employees’ PII from a cyberattack due to the special relationship

between employers and their employees and the reasonably foreseeable risk of a cyberattack under the circumstances. , 69 F.4th at 1220–21. Relying on , both the Georgia Court of Appeals and this Court have similarly held that a defendant healthcare company owed a duty to its employees to protect their PII from the reasonably foreseeable risk of a cyberattack.

18 , 377 Ga. App. 177, 181 (2025); , 2025 WL 1643485, at *3–4 (finding that ll, 305 Ga. 812 (2019), was not so broad as to “altogether reject the existence of a

duty to safeguard personal information”). Another court in this district found that the reasonably foreseeable risk of a cyberattack was sufficient to impose a duty on the defendant to protect the plaintiffs’ PII. , 563 F. Supp. 3d 1360, 1366–71 (N.D. Ga. 2021). The court there did not mention the phrase “special relationship,” at 1371 n.4, but it noted “common sense” dictates that, “when patients and employees are

required to turn over PII and PHI as a condition of medical care and employment, the entity receiving that information has some baseline obligation to adopt reasonable precautions to guard against known or reasonably foreseeable threats to the security of that information,” at 1370. Here, the Court concludes that Blue Shield owed a duty to the Plaintiffs to protect their PII and PHI from the reasonably foreseeably risk of a cyberattack. First, a special relationship between health insurance providers

and their members exists and supports the existence of a duty to safeguard members’ data. Several factors are relevant. The Plaintiffs are or were customers (or “members”) of Blue Shield, (CAC ¶¶ 6–12), who were required to provide their PII and PHI as a condition of receiving healthcare services, ( ¶¶ 21–22). They are also wholly dependent on Blue Shield’s decisions

19 regarding where and how to protect the data, including the company’s choice of vendor for maintaining the data. ( ¶¶ 252.) This dependent relationship means that Blue Shield controls the risk of a cyberattack, as it controls the

“virtual premises” subject to a third-party’s attack. , 2019 WL 13041330, at *5 (M.D. Fla. Oct. 1, 2019) (applying analogous Florida law). Moreover, the type of information shared is highly sensitive rather than ordinary, including not only PII that a government agency or employer might collect but also PHI that a doctor might collect. Second, the alleged cyberattack was a reasonably foreseeable risk.

According to the Complaint, “[t]he healthcare industry has become a primary target for cybercriminals due to a combination of high-value data and outdated infrastructure,” (CAC ¶ 65), prompting federal agencies to issue repeated warnings to healthcare entities about the threat, ( ¶ 63, 70). The Complaint pleads a slew of additional statistics regarding the high number of data breaches in the healthcare industry, further putting healthcare entities like Blue Shield and Young Consulting on notice. ( ¶¶ 66–67.) This Court

follows others that have found these kinds of (or lesser) allegations sufficient to plausibly plead a reasonably foreseeable risk of harm. , , 563 F. Supp. 3d at 1369; , 377 Ga. App. at 181–82; , 69 F.4th at 1220– 21 (inferring that “a company of [the defendant’s] size and sophistication— especially one maintaining such an extensive database of prior employees’

20 PII—could have foreseen being the target of a cyberattack,” even without allegations as to how “well-known” or “common” the cyberattacks were in the defendant’s industry). Together, the special relationship and foreseeable risk

of harm give rise to a legal duty. b. Causation Having found the existence of a duty, the Court next considers the Defendants’ proximate cause arguments. The Court finds in favor of the Plaintiffs as to proximate cause. Georgia law provides that a defendant is liable for “[a]l of the natural and probable consequences” of its negligent conduct,

“unless there is a sufficient and independent intervening cause.” , 932 S.E.2d 74, 104 (2026). But the intervening cause rule “does not insulate the defendant ‘if the defendant had reasonable grounds for apprehending that such wrongful act would be committed.’” , 300 Ga. 840, 841 (2017) (quoting , 275 Ga. 683, 686 (2002)). As discussed above, the Plaintiffs plausibly allege that Blue Shield should have anticipated a cyberattack on it

and/or its vendors, as discussed above. ( CAC ¶¶ 63–70.) For this reason, Blue Shield cannot escape liability by merely pointing to the “intervening” actions of other actors or by claiming that the Plaintiffs’ allegations lack sufficient specificity.

21 D. Negligence per Se (Counts II, IV) In Georgia, negligence per se arises when a statute establishes a legal duty and a defendant breaches that legal duty. , 349 Ga. App.

381, 385 (2019) (citing , 251 Ga. App. 699, 702 (2001)); O.C.G.A. § 51-1-6. A plaintiff satisfies these elements if he or she can show “a statute is violated, the person injured by the violation is within the class of persons the statute was intended to protect, and the harm complained of was the harm the statute was intended to guard against.” , 300 Ga. 840, 845 (2017)

(quoting , 282 Ga. 197, 200 (2007)). A plaintiff may maintain a negligence per se action for violations of both statutes and regulations. , 251 Ga. App. at 702. The Plaintiffs assert a negligence per se claim against Young Consulting (Count II) and Blue Shield (Count IV) based on violations of the Health Insurance Portability and Accountability Act (“HIPAA”) and the Federal Trade Commission Act (“FTCA”). Specifically, they claim that the Defendants

violated (1) HIPAA regulations, pursuant to 42 U.S.C. § 1320d , regarding the protection of PHI, (CAC ¶ 240, 290), and (2) Section 5 of the FTCA, 15 U.S.C. § 45, regarding the protection of confidential consumer information, ( ¶¶ 232, 282).

22 The Defendants argue that neither HIPAA nor the FTCA can support the negligence per se claim. As to HIPAA, the Defendants argue that the statute does not create a private right of action to enforce its regulations and

thus cannot support a negligence per se claim. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 11; Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 20.) As to the FTCA, the Defendants take different approaches. Blue Shield asserts that no private right of action exists here either and further claims that the Plaintiffs are “not within the class of persons the FTCA was designed to protect” because they are “employees whose employers obtained

certain insurance coverage from Blue Shield” and not Blue Shield’s “consumers.” (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 12.) Young Consulting concedes that courts in this district have allowed negligence per se actions to proceed under Section 5 of the FTCA but argues that the Plaintiffs’ allegations nonetheless fail to allege sufficient facts to establish a statutory violation.4 (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 20.) The Court rejects each of these arguments for the reasons set forth below and

denies the Defendants’ Motions to Dismiss the negligence per se claim.

4 Young Consulting also seeks dismissal of this claim because the Plaintiffs “fail[ed] to allege a concrete injury.” (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 21.) But the Court rejects this argument for the same reasons discussed previously. 23 1. Intended Protections The Court first dispenses with the Defendants’ arguments that the Plaintiffs are not “consumers” under the FTCA and thus not within the class

of persons the FTCA intends to protect. In relevant part, the FTCA protects “consumers” from “unfair . . . practices in or affecting commerce.” 15 U.S.C. § 45(a)(1); , 405 U.S. 233, 244 (1972) (“Congress, through [section] 5, charged the FTC with protecting consumers as well as competitors.”). The FTCA does not define “consumer,” but the Court is satisfied that the Plaintiffs qualify as such because they paid for Blue Shield’s

health insurance services and became Blue Shield’s health insurance members. (CAC ¶¶ 124, 132, 140, 148, 156, 165, 174.) The Court is not persuaded that the Plaintiffs are stripped of their consumer status because they paid their insurance premiums through an employer-sponsored plan rather than directly to Blue Shield. Blue Shield’s case law is inapposite; courts dismissed the negligence per se claims in those cases because the plaintiffs were employees who did not purchase any goods or

services—whether directly or indirectly—from the defendants. , 2025 WL 552676, at *5 (N.D. Ga. Feb. 19, 2025); , 2025 WL 1643485, at *5.

24 2. Private Right of Action The Court rejects the Defendants’ private right of action arguments. A statute can support a negligence per se claim, even if the statute lacks a private

right of action. , 293 Ga. 162, 164 (2013). The relevant question is whether the statute supporting the negligence per se claim can supply “a legal duty with some ascertainable standard of conduct,” not necessarily whether the statute has a private right of action. at 163–64. Georgia courts have stated as much multiple times. For example, the Georgia Court of Appeals has unequivocally stated:

O.C.G.A. § 51-1-6 authorizes a plaintiff to recover damages for the breach of a legal duty even when that duty arises from a statute that does not provide a private cause of action. O.C.G.A. § 51-1-6 does not create a legal duty but defines a tort and authorizes damages when a legal duty is breached.

, 322 Ga. App. 699, 705 (2013) (quoting , 314 Ga. App. 257, 259 (2012), , 293 Ga. 162 (2013)). ’s reasoning can be traced back to , 206 Ga. App. 876 (1992). The court found that a criminal statute, which naturally lacked a private cause of action, supplied the standard of care and imposed a duty on a police officer sufficient to state a negligence per se claim. at 879–81. Other courts in Georgia have upheld negligence per se claims under similar 25 reasoning.5 Prior to its decision, the Georgia Supreme Court had also previously suggested that a plaintiff could pursue tort liability under Georgia’s negligence per se statute, O.C.G.A. § 51-1-6, despite the lack of a private right

of action. , 287 Ga. 448, 460 (2010) (relying in part on O.C.G.A. § 9-2-8(b), which states that the requirement that private rights of action be made explicit will not “prevent the breach of any duty imposed by law from being used as the basis for a cause of action under any theory of recovery otherwise recognized by law, including . . . theories of recovery . . . for breach of legal or private duties as set forth in [O.C.G.A.

§ 51-1-6]”). The Court is aware that a number of Georgia courts have enforced a categorical rule that a negligence per se claim cannot proceed if the violation is premised on a statute without a private right of action. , , 334 Ga. App. 826, 833–34 (2015) (affirming the dismissal of a negligence per se claim because “’[n]one of the statutes . . . provides a private cause of action for damages arising from any

5 , , 199 Ga. App. 138, 141 (1991) (quoting , 195 Ga. App. 449, 450 (1990)) (regarding Occupational Safety and Hazard Act regulations); , 328 Ga. App. 775, 789 (2014) (allowing a negligence per se claim based on violations of FTC regulations to proceed), , 333 Ga. App. 897 (2015); , 2018 WL 3018901, at *3 (N.D. Ga. June 18, 2018) (rejecting the defendant’s argument that the negligence per se claim must be dismissed because the underlying statute lacks a private right of action). 26 violation of the respective statute”); , 580 F. Supp. 3d 1314, 1346 (N.D. Ga. 2021) (dismissing a negligence per se claim “[b]ecause there is no private cause of action under O.C.G.A.

§ 19-7-5”).6 The bulk of these cases rely on , 272 Ga. 279 (2000), and , 271 Ga. App. 36 (2004). But, in the Court’s opinion, and do not stand for the categorical rule that a negligence per se claim fails when it is premised on a statute without a private right of action. In , the Georgia Supreme Court held that a negligence per se claim was not cognizable based on the violation

of a certain age discrimination statute. , 272 Ga. at 279–80. It reasoned that a plaintiff could not use Georgia’s negligence per se provision, O.C.G.A. § 51-1-6, to circumvent both Georgia’s statutory bar on tort actions against

6 , , 2014 WL 12489755, at *3 (N.D. Ga. Dec. 31, 2014) (“[V]iolations of civil statutes do not give rise to negligence claims when the statutes do not provide a private cause of action.” (citing , 271 Ga. App. 36, 41–42 & 42 n.17)); , 2017 WL 11151639, at *6–7 (N.D. Ga. July 14, 2017); , 2016 WL 11544774 (N.D. Ga. June 10, 2016), , 2016 WL 11544908, at *28 (N.D. Ga. Aug. 30, 2016); , 2011 WL 10944693, at *6 (N.D. Ga. Oct. 6, 2011) (rejecting a negligence claim where the statute in question did not provide a private cause of action and thus no “civil remedy”); , 2015 WL 13271597, at *9 (N.D. Ga. Apr. 30, 2015), , 2015 WL 13357899, at *1 (N.D. Ga. May 29, 2015); , 2023 WL 5658976, at *7 (S.D. Ga. Aug. 31, 2023) (dismissing a negligence per se claim based on HIPAA because the statute does not provide a private right of action and thus cannot “provide for a civil remedy” (citation omitted)). 27 employers for wrongful termination and the age discrimination statute’s lack of a private right of action. at 280. In , the Georgia Court of Appeals relied on to uphold the dismissal of a negligence per se claim where the

claim was premised on a statute without a private right of action. does not provide much other citation7 or analysis in justifying this holding, nor does it reckon with the significance that placed on Georgia’s specific and long-standing prohibition on torts for wrongful termination. With this context, the Court is not persuaded that either or go so far as to require dismissal of a negligence per se claim if the supporting statute lacks a private

right of action, as the Defendants presume. , 563 F. Supp. 3d at 1374 (interpreting narrowly). 3. FTCA Duty & Violation8 As to Young Consulting’s arguments that the Complaint fails to include

7 The court cited other cases, but none establish a categorical rule as to negligence per se claims and private causes of action. , 243 Ga. App. 894, 895 (2000) (affirming the dismissal of a negligence per se claim in the employment-at-will context where the statute did not specify a civil remedy); , 237 Ga. App. 10, 12– 13 (1999) (noting that a criminal statute does not automatically give rise to “a private cause of action in tort in favor of the victim,” and finding as much for the criminal statute in question); , 198 Ga. App. 49, 50 (1990) (same), , 295 Ga. 235, 239 n.2 (2014). 8 Beyond Blue Shield’s assertion that HIPAA lacks a private right of action, the Defendants do not appear to expressly challenge whether HIPAA imposes a standard of conduct nor whether the Defendants violated any corresponding duty. Out of an abundance of caution, the Court clarifies that HIPAA imposes duties to “maintains reasonable and appropriate 28 sufficient facts alleging an FTCA violation, the Court disagrees. A number of courts in this district have concluded that Section 5 of the FTCA “imposes a legal duty to safeguard personally identifiable information in a business’s

custody.” , 371 F. Supp. 3d 1150, 1176 (N.D. Ga. 2019); , 563 F. Supp. 3d at 1374 (“Section 5 of the FTC Act . . . creates enforceable duties . . . relat[ing] to data breach cases based on the text of the statute and a body of precedent interpreting the statute and applying it . . . . [A] defendant’s inadequate cybersecurity measures fall within the plain meaning of Section 5’s prohibition

on ‘unfair’ practices.” (citation omitted)); , 2023 WL 5167366, at *9 (N.D. Ga. July 19, 2023) (“Georgia courts have recognized that violations of the FTC Act and rules enforcing the Act can support a negligence per se claim under [Georgia] state law.” (citing , 328 Ga. App. at 790)); , 2024 WL 519722, at *9 (N.D. Ga. Feb. 9, 2024). The Court has already explained that the Complaint plausibly pleads that the Defendants failed to employ reasonable and

appropriate data security measures. Therefore, the Plaintiffs adequately plead an FTCA violation as a predicate to their negligence per se claim.

administrative, technical, and physical safeguards” for “health information,” 42 U.S.C. § 1320d-2(d)(2), and to timely notify affected individuals about the breach of this information, 45 C.F.R. §§ 164.400–164.414. The Plaintiffs plausibly plead a violation of these duties as to both Young Consulting and Blue Shield. (CAC ¶¶ 240, 271.) 29 E. Unjust Enrichment (Count V) In the alternative to their breach of implied contract claim (Count IX), the Plaintiffs assert an unjust enrichment claim (Count V) against Blue Shield.

“Unjust enrichment applies when as a matter of fact there is no legal contract, but when the party sought to be charged has been conferred a benefit by the party contending an unjust enrichment which the benefitted party equitably ought to return or compensate for.” , 285 Ga. 632, 635 (2009) (quoting , 265 Ga. 804, 806 (1995)). Such a claim is “premised upon the principle that a party cannot induce, accept, or

encourage another to furnish or render something of value to such party and avoid payment for the value received.” , 338 Ga. App. 382, 386–87 (2016) (quoting , 311 Ga. App. 822, 827–28 (2011)). The “benefit” or “something of value” can refer to “any form of advantage.” , 311 Ga. App. at 828 (citation omitted). But, importantly, “the party conferring the . . . things of value must act with the expectation that the other will be responsible for the cost.” , 375 Ga. App.

567, 575 (2025) (citation omitted). The Plaintiffs allege they paid insurance premiums to Blue Shield to procure health insurance services, (CAC ¶ 299), but with the belief that “Blue Shield would use part of the monies paid . . . to fund proper and reasonable

30 data security practices,” ( ¶ 361).9 They allege that Blue Shield benefited from this arrangement because it “retain[ed] money that it should have used to provide reasonable and adequate data security,” “sold more services and

products than [it] otherwise would have,” and otherwise “profi[ted]” from gathering the Plaintiffs’ data. ( ¶¶ 300, 304–06.) Reasonable courts—applying substantially the same unjust enrichment standard—disagree on whether allegations of this type survive a motion to dismiss, but this Court is persuaded that they do. Here, the Plaintiffs allege they paid Blue Shield on the expectation that the company would provide

health insurance services and data security, yet they did not receive the latter. That is sufficient at the pleading stage to allege a “benefit” conferred that ought to be equitably returned. , 2026 WL 2333808, at *7 (M.D. Ga. Aug. 12, 2026) (declining to dismiss an unjust enrichment claim under Georgia law based on similar facts); , 693 F.3d at 1328 (applying Florida law); , 567 F. Supp. 3d 1130, 1146 (C.D. Cal. 2021) (applying California law);

, 198 F. Supp. 3d 1183, 1201 (D. Or. 2016) (applying Oregon law); , 278 F. Supp. 3d 739,

9 The Plaintiffs allege this fact under their breach of implied contract claim (Count IX), but the Court will consider it in the context of this unjust enrichment claim (Count V) in construing the Complaint in the light most favorable to the Plaintiffs. 31 751 (S.D.N.Y. 2017) (applying New York law); , 455 F. Supp. 3d 749, 766 (C.D. Ill. 2020) (dismissing an unjust enrichment claim under Illinois law where the plaintiffs “ha[d] not alleged that any specific

portion of their payments went toward data protection”).10 Contrary to Blue Shield’s position on the conferral of benefits, (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 12–13), it makes no difference that the Plaintiffs paid their insurance premiums through an employer-sponsored plan as opposed to directly to the Blue Shield. , 838 F. Supp. 2d 1340, 1366 n.27

(N.D. Ga. 2012) (“[I]t is not necessary that the plaintiff allege a direct payment by the plaintiff to the allegedly unjustly-enriched defendant.”); , 2013 WL 12121864, at *8 (S.D. Ga. Mar. 18, 2013)

10 , 2025 WL 552676, at *8 (rejecting the “cost-savings benefit” theory of unjust enrichment); , 377 Ga. App. at 185 (affirming the dismissal of an unjust enrichment claim for failure to allege a benefit conferred, but where the plaintiffs merely alleged they “believed the defendant would keep their information safe” and were “denied . . . the ability to make an informed purchasing decision”); , 732 F. Supp. 3d 765, 782 (S.D. Ohio 2024) (“[A] traditional exchange of payment for goods and services is not a circumstance in which it is ‘unjust’ to allow the defendant to retain the benefit. . . . Plaintiffs fail to plausibly allege that the banking fees Plaintiffs paid ([(the alleged benefit conferred)] were in exchange for PII protection.”); , 2023 WL 8540911, at *5 (D.N.J. May 5, 2023) (“Plaintiffs pay Defendants for medical services received and entrust their Personal Information incidental to those services. Allegations that Plaintiffs would not have engaged Defendants for medical services do not plausibly suggest that the Personal Information itself is part of Defendants’ business model.”). 32 (rejecting the argument that the benefit conferred must be “direct”). F. Breach of Fiduciary Duty (Counts VI–VII) To establish a claim for breach of fiduciary duty in Georgia, a plaintiff

must establish “(1) the existence of a fiduciary duty; (2) breach of that duty; and (3) damage proximately caused by the breach.” , 321 Ga. App. 584, 594 (2013) (citation omitted). “Fiduciary duties and obligations are owed by those in confidential relationships.” , 269 Ga. 604, 606 (1998). Georgia law defines a confidential relationship as one where (1) “one

party . . . exercise[s] a controlling influence over the will, conduct, and interest of another” or (2) “from a similar relationship of mutual confidence, the law requires the utmost good faith.” , 325 Ga. App. 194, 201 (2013) (citing O.C.G.A. § 23-2-58). The confidential relationship may arise from “law, contract, or the facts of a particular case.” , 278 Ga. App. 117, 120 (2006); O.C.G.A. § 23-2-58 (regarding confidential relationships by nature, law, or contract). A fiduciary

“owes a duty of ‘utmost good faith’ and loyalty to the other party.” , 361 Ga. App. 475, 479 (2021) (quoting , 286 Ga. App. 774, 783 (2007)). This duty requires “act[ing] for the benefit of another person on all matters within the scope of their relationship.” , 376 Ga. App. 159, 163–64 (2025) (quoting Black’s Law Dictionary

33 (12th ed. 2024)). The Plaintiffs allege a fiduciary relationship between themselves and both Young Consulting (Count VI) and Blue Shield (Count VII), based on the

exchange of PHI for health insurance and healthcare services. (CAC ¶¶ 319, 332.) Because providing PHI was a requirement for obtaining these services, the Defendants supposedly “exercised a controlling influence over Plaintiffs and Class Members as it related to the security of their Private Information.” ( ¶¶ 320, 333.) According to the Complaint, this relationship gave rise to a fiduciary duty to safeguard the data and exercise oversight over vendors

handling the data, timely notify individuals affected by a data breach, and maintain “complete and accurate records regarding the storage, usage of, and access to the Private Information.” ( ¶¶ 323, 337.) The Defendants allegedly breached this duty and injured the Plaintiffs as a result. ( ¶¶ 326, 340.) The Defendants challenge only the existence of a fiduciary duty, arguing that the Complaint does not allege a confidential relationship involving a “controlling influence.” (Br. in Supp. of Def. Young Consulting’s Mot. to

Dismiss, at 21–22; Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 13.) Blue Shield claims that “Georgia courts do not recognize fiduciary duties by healthcare providers outside the physician-patient relationship and limit such duties strictly to matters of care.” (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 13 (citing ., 279 Ga. App. 586,

34 592 (2006)).) The Court first reviews the case law on relationships that do and do not give rise to fiduciary duties. As an initial matter, fiduciary duties do not

typically arise when individuals disclose sensitive information in standard arms-length consumer transactions. , 272 Ga. App. 703, 705 (2005) (“[A]n arm’s-length relationship by its nature excludes a confidential relationship.” (citation omitted)). In the insurance context, Georgia courts have held that no fiduciary duty ordinarily exists between the insurer and insured. , 321 Ga. App. 496,

501 (2013) (citations omitted). By contrast, physicians typically owe fiduciary duties, including confidentiality and the utmost good faith, to their patients when providing medical care. , 279 Ga. App. at 593 n.14 (citing , 260 Ga. App. 723, 726 (2003)). In , another court in this district considered whether the exchange of PHI in a healthcare provider–patient relationship was more like the exchange of information in a nonconfidential arms-length-transaction relationship or the exchange of information in a

confidential physician-patient relationship. , 563 F. Supp. 3d at 1383. The court reasoned that the alleged healthcare provider–patient relationship “was different from standard consumer transactions insofar as it necessarily entailed the patient-[p]laintiffs sharing and disclosing private health information with [the] [d]efendant that was akin to the health information that

35 would be communicated to a physician when receiving medical care.” Nevertheless, in this case, the breach of fiduciary claims against Blue Shield and Young Consulting both fail as a matter of law. While it may be true

that certain health information collected by Blue Shield (and Young Consulting) may be of the same or similar kind as those collected by a doctor treating a patient, the Court is not persuaded that the relationship between doctors and patients in providing medical care is akin to that between health insurance providers (and their vendors) and their insured members in providing insurance coverage.

, 2025 WL 2179475, at *22 (D. Mass. July 31, 2025) (finding that a medical provider’s fiduciary duty to safeguard patients’ information “presents wholly different questions from whether and under what circumstances an insurer ‘owes an obligation to consider the interests of its insured above its own’ so as to support the existence of a fiduciary relationship”); , 2025 WL 2754760, at *11 (N.D. Ill. Sept. 27, 2025) (rejecting the plaintiffs’ attempt to “use the fiduciary duty a treating

physician owes their patients to bootstrap into Illinois law” a new fiduciary duty owed by healthcare facilities). , 742 F. Supp. 3d 1304, 1318 (N.D. Ga. 2024) (declining to dismiss a breach of fiduciary duty claim given that there was a factual question as to information involved in the data breach and that “in some circumstances, the retention of

36 private information that patients provided while seeking medical care can create a fiduciary duty under Georgia law”). To find otherwise would go too far, in the Court’s view. It would impose

a fiduciary duty on virtually any company dealing with health information, which could be easily characterized as that which a treating physician collects. While the Court has stated that the relationship between Blue Shield and its members is a special one requiring a duty of ordinary care to safeguard members’ PII and PHI, the Court is not convinced it is one requiring a fiduciary duty. “Fiduciaries are held to the highest standard of the law” and must “act

for the benefit” of the other “on all matters within the scope of their relationship.” , 319 Ga. App. 354, 364 n.19 (2012) (citation omitted). The relationship between Blue Shield and its members is not so unequal that Blue Shield possesses a “controlling influence over the will, conduct, and interest” of the Plaintiffs. The Plaintiffs entered into an arms-length transaction with Blue Shield, which is ordinarily insufficient to establish a fiduciary duty. , 272 Ga. App. at 705; ,

567 F. Supp. 3d at 1146 (applying California law); , 2024 WL 5055556, at *13 (S.D. Iowa June 26, 2024) (applying Iowa law, and collecting cases). Georgia courts typically treat the relationship between the insurer and insured as an arms-length transaction. , 321 Ga. App. at 501 (citation omitted). Here, the Plaintiffs do not allege a

37 relationship with Blue Shield that goes beyond the ordinary relationship between a health insurance provider and its member. , 777 F. Supp. 3d 913, 942 (E.D. Wis. 2025). Therefore, Blue

Shield owes no fiduciary duty to the Plaintiffs to safeguard their PII and PHI, and neither does Young Consulting as Blue Shield’s vendor. G. California Invasion of Privacy (Count VIII) California Plaintiffs Emily Desley-Bloom, Kevin Chinchilla Montero, and Alexandra Murillo allege an invasion of privacy claim under the California Constitution against Blue Shield. The California Constitutions protects

individuals from invasions of their privacy. Cal. Const. art. I, § 1. To establish an invasion of privacy claim under the California Constitution, a plaintiff must show “(1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by [the] defendant constituting a serious invasion of privacy.” , 7 Cal. 4th 1, 66 (1994). Blue Shield challenges only the third element, arguing that “the type of personal information impacted by the [data breach] does not qualify as

a ‘serious invasion’ of privacy.” (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 14.) To qualify as a “serious invasion of privacy,” the invasion “must be sufficiently serious in [its] nature, scope, and actual or potential impact” such that it “constitute[s] an egregious breach of the social norms underlying the

38 privacy right.” , 7 Cal. 4th at 37. California courts have dismissed invasion of privacy claims at the pleading stage even where the plaintiffs alleged the disclosure of highly sensitive information such as social security numbers and

geolocation data. , 540 F. Supp. 2d 1121, 1128 (N.D. Cal. 2008), , 380 Fed. App’x 689 (9th Cir. 2010) (holding the theft of 800,00 job applicants’ “personal information, including . . . social security numbers,” did not amount to a serious invasion of privacy); , 844 F. Supp. 2d 1040, 1063 (N.D. Cal. 2012) (holding the disclosure of “unique device identifier number[s], personal data, and geolocation information” from

certain Apple devices “does not constitute an egregious breach of social norms”); , 63 F. Supp. 3d 1159, 1169 (C.D. Cal. 2014) (“[A]n accidental disclosure (of the kind that is inevitable when human beings process large amounts of information) is not necessarily sufficient to sustain a claim under article I, § 1.”). But California courts treat medical records with special importance such that the disclosure of certain medical information may amount to a serious invasion of privacy. , 41 Cal. App. 5th

497, 507 (Cal. Ct. App. 2019) (“It is well established that the right to privacy extends to medical records, which may contain ‘matters of great sensitivity going to the core of the concerns for the privacy of information about an individual.’” (citations omitted)).

39 The Court denies Blue Shield’s Motion to Dismiss on the California privacy claim, finding the nature, scope, and impact of the privacy invasion “sufficiently serious.” Here, the nature of the privacy invasion can be fairly

characterized as serious. Blue Shield’s inadequate security practices allegedly resulted in the disclosure of not only PII such as names, social security numbers, dates of birth, and names, but also PHI such as medical diagnoses, medical treatments, and medication and prescription data. (CAC ¶¶ 47, 54.) California courts have found the disclosure of medical information such as HIV-positive status, substance abuse treatment and prescription records, and

fertility treatment records to be of a serious nature. , , 63 F. Supp. 3d at 1169–70 (HIV); , 65 Cal. App. 5th 621, 645–46 (Cal. Ct. App. 2021) (substance abuse); , 2024 WL 246178, at *1–2, *6 (E.D. Cal. Jan. 23, 2024) (fertility). The compromised data in this case plausibly includes highly sensitive medical information of this sort, in addition to other personally identifiable information. The scope of the privacy invasion is also large, given that the data

breach compromised the identities and medical information of more than one million Blue Shield members across the country. (CAC ¶ 60.) Lastly, the Court finds the impact of the invasion serious. All the records have allegedly been made public by way of being posted on the internet, ( ¶ 52–54), and are ripe for bad actors to sift through—whether to steal the identities of the affected

40 individuals, weaponize their medical information in some way, or take other action. , 82 Cal. App. 4th 419, 429 (Cal. Ct. App. 2000) (dismissing a California privacy claim where personnel records

were disclosed to an attorney). Considering the alleged nature, scope, and impact of the privacy invasion, the Court therefore holds that the Complaint plausibly pleads a serious invasion of privacy. This holding is consistent with other courts who have found comparable breaches of medical information to be serious invasions of privacy. , 501 F. Supp. 3d 898, 906, 926 (S.D. Cal. 2020)

(declining to dismiss a California privacy claim involving a “large data breach” of “protected health information and personal information” such as “name, address, date of birth, gender, and medical claim information including dates of service, diagnosis codes, procedure codes and treating physician”); , 567 F. Supp. 3d at 1138, 1143 (declining to dismiss a privacy claim involving the allegedly data breach of the plaintiffs’ “names, dates of births, [ ] account numbers, health insurance information, confidential medical information,

medical diagnoses, billing information including addresses, email addresses, and telephone numbers, and Social Security numbers”). H. Breach of Implied Contract (Count IX) In Georgia, a contract exists between parties when there is (1) consideration, (2) “the assent of the parties to the terms,” and (3) “a subject

41 matter upon which the contract can operate.” O.C.G.A. § 13-3-1. An implied-in-fact contract is a type of contract where mutual “assent may be implied from the circumstances and the conduct of the parties.”

, 325 Ga. App. 448, 452 (2013) (citations omitted); , 154 Ga. App. 229, 231–32 (1980) (“[T]he only difference between an express contract and a contract implied in fact is that in the former the parties arrive at their agreement by words, whether oral or written, while in the latter their agreement is arrived at by a consideration of their acts and conduct . . . .” (citation omitted)). Mutual assent, or the “meeting

of the minds,” occurs when “one party’s intention is deemed to be that meaning a reasonable man in the position of the other contracting party would ascribe to the first party’s manifestations of assent, or that meaning which the other contracting party knew the first party ascribed to his manifestations of assent.” , 250 Ga. 391, 395 (1982) (noting that the standard is objective). As the Georgia Supreme Court recently explained: “a court will honor [an] intention if the other party has reason to

know it” or “actually knows it.” , 299 Ga. 443, 445 (2016) (quoting E. Allan Farnsworth, Contracts § 3.7, at 122 (2d ed. 1990)). Assuming the existence of a contract, a breach of implied contract claim survives a motion to dismiss if a plaintiff can plausibly plead the traditional elements of a breach of contract: duty, breach, causation, and damages.

42 The Plaintiffs assert this breach of implied contract claim against only Defendant Blue Shield. They allege that, in providing their sensitive information to Blue Shield “as a precondition for receiving health insurance,”

(CAC ¶ 354), they also entered into an implied contract with the company whereby “Blue Shield agreed to safeguard and protect” their sensitive information and “timely and accurately notify them if it was breached or compromised,” ( ¶ 355). To support this implied contract, the Plaintiffs cite, among other representations, Blue Shield’s “Notice of Privacy Practices.” ( ¶ 357.) The privacy notice states: “we maintain physical technical and

administrative safeguards to ensure the privacy of your PHI,” and “[w]e are required to maintain the privacy of your PHI and to notify you in the event that you are affected by a breach of unsecured PHI.” ( ) A separate “HIPAA Notice of Privacy Practices” document contains “the same or similar representations,” plus other representations such as “[w]e will obey any and all laws that require us to give you privacy protections, including HIPAA and any other federal or California privacy law.” ( ¶ 358.)

Blue Shield disputes the existence of mutual assent and, if a contract exists, any breach of such a contract. As to mutual assent, Blue Shield argues that (1) conclusory statements about implied contracts and general references to the company’s privacy policies are insufficient11 and that (2) the Plaintiffs

11 Blue Shield also points out that the Plaintiffs cite the company’s 43 do not allege “they read or relied upon” the company’s privacy representations. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 15.) As to breach, Blue Shield contends that the Complaint “fail[s] to identify any specific contract

term Blue Shield allegedly breached” and instead alleges “only vague failures to implement security measures or oversee contractors.” ( at 16.) Ultimately, the Court rejects Blue Shield’s arguments and denies dismissal of the breach of implied contract claim. The Court first holds that the Plaintiffs have plausibly pleaded mutual assent to an implied contract. A reasonable person would understand Blue Shield’s representations—e.g.,

expressly stating that it would (or intended to) “maintain . . . safeguards to ensure the privacy of your PHI”—as manifestations of assent, amounting to an implied contract. , , 563 F. Supp. 3d at 1381–82 (denying dismissal of a breach of implied contract claim where the plaintiffs alleged that the defendant posted its privacy representations on its website and made the statements “available to patients upon request”); , 667 F. Supp. 3d 1276, 1286–87 (N.D. Ga. 2023) (denying dismissal where the

plaintiffs alleged an expectation that the defendant would implement reasonable data security practices); , 136 F. Supp.

“codes of conduct” but that those codes of conduct do not even apply to the Plaintiffs. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 15.) The Plaintiffs do not respond to this argument. The Court ignores the codes of conduct for now, referring instead to Blue Shield’s privacy policy and other privacy statements, which appear to expressly concern the Plaintiffs. 44 3d 654, 675 (E.D. Pa. 2015) (denying dismissal where the defendant implicitly promised to safeguard the plaintiffs’ PII through “privacy policies, codes of conduct, company security practices, and other conduct”).

Moreover, construed in the light most favorable to the Plaintiffs, the Complaint plausibly alleges that the Plaintiffs relied on Blue Shield’s representations. , 2026 WL 2333808, at *4, 6–7 (inferring reliance from allegations that the plaintiffs “understood” and “believed” the defendant would “safeguard their PI” based on the defendant’s privacy policy); , 2010 WL 11570892, at *6 (N.D. Ga. Feb. 5, 2010)

(denying dismissal where the plaintiffs alleged that they would not have provided their information to the defendant absent the defendant’s representation that it would protect the information). The Plaintiffs allege that they would not have entrusted their information to Blue Shield “in the absence of the . . . implied terms between them and Blue Shield.” (CAC ¶ 362.) Together, Blue Shield’s specific privacy representations and the Plaintiffs’ apparent reliance on those representations are sufficient to

plausibly plead mutual assent. And, indeed, one Georgia appellate court recently denied dismissal of a breach of implied contract claim in similar circumstances, albeit applying Georgia procedure. , 377 Ga. App. at 184. There, the court considered allegations that the plaintiffs “relied on the defendant’s privacy notice, which included promises that the defendant would

45 implement reasonable and adequate data security safeguards and would not disclose their private information to anyone, outside of certain, specific circumstances.”

Having found the existence of an implied contract, the Court further holds that the Plaintiffs plausibly plead the element of breach. The Plaintiffs have alleged that Blue Shield failed to “implement adequate data security” and “exercise sufficient oversight of the data security practices of its contractors,” (CAC ¶ 364), including requiring the specific security measures listed in the Complaint, ( , ¶ 71, 73, 81 ,83), and that it failed to timely notify the

Plaintiffs of a data breach, ( ¶ 364). This is sufficient to plausibly plead breach of the promise to safeguard the privacy of the Plaintiffs’ data and notify the Plaintiffs once PHI is compromised. I. Breach of Third-Party Beneficiary Contract (Count X) The Complaint alleges that Young Consulting qualifies as a “Business Associate” under HIPAA “because it receives, maintains, and electronically transmits PHI from health plans such as Blue Shield to assist in carrying out

healthcare-related functions.” ( ¶ 77.) As a Business Associate, Young Consulting allegedly entered into a written contract (a “Business Associate Agreement”) with Blue Shield in which Young Consulting “agreed . . . to implement adequate security measures to safeguard the Private Information of Plaintiffs and the Class and to timely and adequately notify them of the Data

46 Breach.” ( ¶ 371.) The Complaint alleges that Young Consulting breached this contract, of which the Plaintiffs are third-party beneficiaries. ( ¶¶ 372– 74.)

Young Consulting argues that the Plaintiffs lack standing to assert their breach of contract claims because the alleged contract does not contain “clear and express language . . . demonstrating an intent to create third-party beneficiary rights.” (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 15.) Young Consulting takes issue with the Complaint’s failure to cite any specific terms of the contract. ( at 24.) Young Consulting further argues that

parole evidence cannot be considered in determining the intent of the parties, including statutes and regulations related to the contract. ( at 15–16.) The Court declines to dismiss the Plaintiffs’ third-party beneficiary contract claim on these grounds.12 The key question is “whether the parties’ intention to benefit the third party is shown on the face of the contract.” , 262 Ga. App. 339, 344 (2003) (citing , 160 Ga. App. 756, 758 (1981) (finding that a

12 The Court applies Georgia law for the choice-of-law reasons stated above but notes that the parties dispute whether Georgia or California law applies to this claim. Young Consulting asserts that the contract is governed by Georgia law, though it does not state the basis for concluding such. (Reply Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 6–7 [Doc. 57].) The Plaintiffs “cannot necessarily agree that Georgia law governs,” given that the contract and facts surrounding its drafting remain unavailable. (Pls.’ Joint Resp. Br. in Opp’n to Defs.’ Mots. to Dismiss, at 17 n.5 (noting that the contract may contain a choice-of-law provision).) 47 contract may establish third-party beneficiaries, even if a third-party beneficiary is “not [ ] specifically named”). The Complaint alleges these exact facts—that Young Consulting entered into a contract intended to “protect the

information of individual patients” and is “expressly for the benefit of Plaintiffs and Class Members.” (CAC ¶ 373.) Thus, accepting these allegations as true, the Court finds them sufficient to state a claim for relief. Without the benefit of discovery, it is only natural that the Plaintiffs cannot yet refer to the specific language in the contracts, which are in the hands of the Defendants and not yet in the record. The Court declines to dismiss this claim merely on Young

Consulting’s bald assertions that the contracts lack the requisite language and intent. J. Declaratory and Injunctive Relief (Count XI) The Plaintiffs seek declaratory and injunctive relief against Blue Shield and Young Consulting. Specifically, they ask this Court to enter a judgment declaring that the Defendants owe a duty to secure the Plaintiffs’ data and notify them about it, “breached and continue to breach” this duty, and continue

to harm the Plaintiffs. (CAC ¶ 382.) They also ask the Court to enjoin the Defendants, requiring them to “employ adequate security protocols.” ( ¶ 383.) The Defendants advance three primary grounds for dismissal: (1) the claim is duplicative of the Plaintiffs’ other claims; (2) adequate legal remedies

48 bar declaratory relief; and (3) the allegations do not plausibly plead a threat of future harm. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 26– 27; Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 17.)

Pursuant to its “unique and substantial discretion in deciding whether to declare the rights of litigants,” , 515 U.S. 277, 286 (1995), the Court grants dismissal to the extent this claim seeks a declaration regarding the Defendants’ duties to safeguard and notify as well as their past breach of these duties. The Court denies dismissal as to all other relief requested therein, finding that the Plaintiffs plausibly plead the Defendants’

security practices remain inadequate and create a future risk of harm. (CAC ¶¶ 379–80, 384–85.) K. California Consumer Privacy Act (Count XII) The California Plaintiffs allege a violation of the California Consumer Privacy Act (“CCPA”) against both Defendants Young Consulting and Blue Shield. The CCPA creates a private right of action for “consumer[s] whose nonencrypted and nonredacted personal information . . . is subject to an

unauthorized access and exfiltration, theft, or disclosure as a result of [a] business’ violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information.” Cal. Civ. Code § 1798.150(a)(1) (West 2024). The Complaint seeks injunctive relief and the greater of statutory and actual

49 damages, pursuant to Cal. Civ. Code § 1798.150(a)(1)(A)–(B) (West 2024). (CAC ¶¶ 404–05.) 1. Young Consulting

Young Consulting moves to dismiss the CCPA claim on two primary grounds. First, the company contends that it is not a “business” subject to private civil suit under the CCPA but rather a “service provider” subject only to state administrative enforcement actions. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 28–31.) Second, it contends that the Complaint is devoid of specific factual allegations regarding the company’s failure to

implement reasonable security measures. ( at 31.) The Court dismisses the CCPA claim against Young Consulting, finding that Young Consulting is not a “business” under the statute. The CCPA grants a private right of action to sue “business[es]” under Cal. Civ. Code § 1798.150(a)(1) (West 2024). Beyond this limited private right of action, the California Privacy Protection Agency and California Attorney General enforce violations committed by businesses, service providers, contractors, and similar

entities. §§ 1798.155(a), 1798.199.90(a) (West 2024). The statute defines a “business” as a “corporation . . . that collects consumers’ personal information, or on the behalf of which such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of

50 consumers’ personal information.”13 § 1798.140(d)(1) (West 2024). The Plaintiffs attempt to fit a square peg into a round hole by characterizing Young Consulting as a “business.” The Complaint alleges that

Young Consulting is “a software-as-a-service [ ] company” that provides “software solutions for the marketing, underwriting and administering of medical stop loss insurance” and “collects and processes sensitive data on behalf of its clients, including Blue Shield of California.” (CAC ¶¶ 19, 2.) In other words, Blue Shield collects PII and PHI from its health insurance members and contracts with Young Consulting for its software services to

maintain and process that data on Blue Shield’s behalf. ( ¶¶ 21–22, 36.) As mentioned above, a “business” in the CCPA context (1) collects personal information and (2) “determines the purposes and means” of “processing” that information. Cal. Civ. Code § 1798.140(d)(1) (West 2024). As to the first prong, the CCPA broadly defines “collect[ing]” as including “gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means,” whether that

information is received “actively or passively.” § 1798.140(f). It is clear that Young Consulting collected the Plaintiffs’ personal information because Young

13 The statute only applies to businesses that “do[ ] business” in California and satisfy certain revenue and consumer thresholds. Cal. Civ. Code § 1798.140((d)(1)(A)–(C) (West 2024). Neither Young Consulting nor Blue Shield dispute that they satisfy these requirements, so the Court does not scrutinize this requirement further. 51 Consulting received and accessed the Plaintiffs’ personal information in providing software services to Blue Shield. (CAC ¶ 36.) But the Complaint fails to plausibly satisfy the second prong, that it

“determine[d] the purpose and means” for processing the Plaintiffs’ data. The Complaint alleges that Young Consulting “determine[s] the purpose and means for processing the data because it “use[s] consumers’ personal data to provide services at customers’ requests,” ( ¶ 392), and “performs analytics with consumer data to perform underwriting and block analysis” and “various reporting functions,” ( ¶ 393). It further alleges that Young Consulting

“uses[s] consumers’ personal data to . . . develop, improve, and test Defendants’ services.” ( ¶ 392.) These allegations are all consistent with a company that provides software services at the request of Blue Shield (Young Consulting’s client) and does not plausibly allege something more—determining the (and means) of the data processing.14 This conclusion makes sense given the CCPA’s definition of a “service provider,” which would appear to better fit Young Consulting’s role. A “service

provider” is “a person that processes personal information on behalf of a business and that receives from or on behalf of the business consumer’s personal information for a business purpose pursuant to a written contract,”

14 , 742 F. Supp. 3d at 1327 (finding a health IT company’s services qualify it as a “business”). 52 provided the contract requires certain confidentiality protections for the data. Cal. Civ. Code § 1798.140(ag)(1) (West 2024). Here, the Complaint alleges that Young Consulting processes Blue Shield members’ personal information “on

behalf of” Blue Shield “for a business purpose” and was required by Blue Shield to treat that information with a certain level of care and security. (CAC ¶¶ 19, 26–35.) While the Court does not affirmatively determine that Young Consulting is a “service provider,” this context supports the Court’s holding. Common sense dictates that a company that provides data processing services “on behalf of a business” and “for a business purpose” ordinarily does not set

the purpose of the data processing—rather, that company’s client (like Blue Shield) sets that purpose and hires a service provider to fulfill it. To hold that the Plaintiffs’ allegations here are sufficient to allege a “business” would collapse the definitions of businesses and service providers as virtually every company that “processes personal data on behalf of a business” (a “service provider”) could qualify as a company that collects personal data and determines the purpose and means of processing it (a “business”).15 The Court

15 The Court is aware that some courts have suggested that a company can both be a service provider and a business. , , 2021 WL 3568394, at *6 (D.S.C. Aug. 12, 2021). But the Court reads the CCPA as providing that, while a company could function both as a business and a service provider in separate contexts, a company cannot simultaneously be both the business and the service provider in the context of the same services. Cal. Civ. Code § 1798.145(i)(1) (“A service provider or contractor shall [ ] not be liable under this title for the obligations of a business for which it provides services as set forth in this title 53 is not persuaded that this outcome is consistent with the CCPA’s design. 2. Blue Shield Blue Shield moves to dismiss the CCPA claim on two grounds. First, the

company claims that statutory damages are unavailable because the Plaintiffs did not comply with the CCPA’s pre-suit notice requirement in a timely or sufficient manner. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 17– 18.) Second, Blue Shield moves to dismiss the CCPA claim to the extent it alleges violations based on information protected by HIPAA or the California Confidentiality of Medical Information Act (“CMIA”), as the CCPA exempts

information protected by those statutes. ( at 18–19.) The Court dismisses the CCPA claim against Blue Shield (1) as to statutory damages and (2) to the extent the claim relies on health and medical information governed by HIPAA and the CMIA. The Court clarifies both. First, the Court dismisses the CCPA claim to the extent it seeks statutory damages (but not as to the actual damages or injunctive relief sought). A plaintiff can seek actual damages under the CCPA without pre-suit notice but, in order to

seek statutory damages, he must provide notice and an opportunity to cure thirty days prior to initiating an action. Cal. Civ. Code § 1798.150(b) (West 2024). Here, Plaintiff Montero sent a CCPA notice letter to Blue Shield on July

provided that the service provider or contractor shall be liable for its own violations of this title.”). 54 16, 2025, (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, Ex. 1 [Doc. 46]),16 and then filed this consolidated class action complaint seeking statutory damages under the CCPA on July 21, 2025. This five-day notice-and-cure

period does not comply with the CCPA, so the Plaintiffs cannot recover statutory damages. Contrary to the Plaintiffs position, merely amending the Complaint would not restart the clock, as the statute requires notice “ against a business for statutory damages.” Cal. Civ. Code § 1798.150(b) (West 2024) (emphasis added); , 2022 WL 1811165, at *6 (D. Ariz. June 2, 2022) (“If a notice . . .

could be updated when an amended complaint is filed and satisfy the 30-day notice requirement, then having the pre-suit notice requirement would be pointless.”); , 2025 WL 213744, at *20 (D. Utah Jan. 16, 2025) (finding notice timely between the filing of the initial and amended complaint because the plaintiff alleged a CCPA claim initially only for actual damages and first sought statutory damages in the amendment, which was filed after the thirty-day notice period). Having

determined that the notice was not timely, the Court need not reach Blue Shield’s other arguments as to whether the contents of the notice were

16 A copy of the notice letter was presented to the Court as an attachment to Blue Shield’s motion. The Court finds the CCPA notice letter is central to the Plaintiffs’ claims, and no party disputes its authenticity. , 107 F.4th at 1300. 55 deficient. ( Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 18.) Second, the Court dismisses the claim to the extent it relies on health and medical information governed by HIPAA and the California

Confidentiality of Medical Information Act (but not as to other non-medical PII). The CCPA expressly exempts any “[m]edical information governed by the Confidentiality of Medical Information Act . . . or protected health information that is collected by a covered entity or business associate governed by the privacy, security, and breach notification rules . . . established pursuant to the Health Insurance Portability and Accountability Act of 1996.” Cal. Civ. Code

§ 1798.145(c)(1)(A) (West 2024). However, because the Complaint alleges the breach of non-medical PII such as names, social security numbers, dates of birth, and non-medical patient data, (CAC ¶¶ 21, 47, 394), this dismissal is not fatal to the CCPA claim. L. California Unfair Competition Law (Count XIII) The California Unfair Competition Law (“UCL”) prohibits “unfair competition,” which includes “any unlawful, unfair or fraudulent business act

or practice.” Cal. Bus. & Prof. Code § 17200 (West 2024). Those three types of acts or practices are independent sources of liability under the UCL. , 567 F.3d 1120, 1127 (9th Cir. 2009) (citation omitted). The California Plaintiffs17 allege violations of the unlawful and unfair prongs

17 In response to extraterritoriality concerns from Young Consulting, 56 against both Blue Shield and Young Consulting. (CAC ¶ 413; Pls.’ Joint Resp. Br. in Opp’n to Defs.’ Mot. to Dismiss, at 42.) The Defendants advance a variety of arguments, which the Court addresses in turn. Ultimately, the Court

dismisses the UCL claim as to Young Consulting but not as to Blue Shield, and it dismisses the UCL claim to the extent it is premised on a violation of the California Consumer Privacy Act. 1. UCL Standing The UCL authorizes suit by persons who “ha[ve] suffered injury in fact and ha[ve] lost money or property as a result of the unfair competition.” Cal.

Bus. & Prof. Code § 17204 (West 2024). According to the Defendants, the California Plaintiffs have failed to allege the loss of money or property and thus have no statutory standing. (Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 16–17; Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 20– 21.) The Plaintiffs respond by pointing to alleged damages such as future credit monitoring and other anti-theft costs, loss of the benefit of the bargain (through overpaying for Defendants’ services, which should have but did not include

“adequate data security”), the diminution of value of their PII/PHI, and loss of privacy in their PII/PHI. (CAC ¶¶ 428, 424.) As evident by the parties’ briefs,

(Br. in Supp. of Def. Young Consulting’s Mot. to Dismiss, at 33), the Plaintiffs clarify in briefing that the Complaint brings a UCL claim only on behalf of the California Plaintiffs (Desley-Bloom, Montero, and Murillo). (Pls.’ Joint Resp. Br. in Opp’n to Defs.’ Mots. to Dismiss, at 42.) The Court construes the UCL claim accordingly. 57 courts differ on how they treat these various theories of injury. But California courts generally appear to agree—and this Court is persuaded—that the loss of the benefit of the bargain is an injury sufficient to establish lost money or

property under the UCL. , , 313 F. Supp. 3d 1113, 1131 (N.D. Cal. 2018); , 66 F. Supp. 3d 1197, 1224 (N.D. Cal. 2014) (“Plaintiffs can establish UCL standing by alleging they paid more than they actually valued the product.” (citing , 51 Cal. 4th 310, 330 (2011))). The Court therefore finds that the California Plaintiffs satisfy the

UCL’s standing requirements. 2. CCPA as a Predicate Violation Following argument from Young Consulting, the Plaintiffs concede that their UCL claim cannot be predicated on a violation of the California Consumer Privacy Act standing alone. (Pls.’ Joint Resp. Br. in Opp’n to Defs.’ Mots. to Dismiss, at 43 n.17.) The Court agrees the UCL claim must be dismissed to the extent it’s based on a CCPA violation. Cal. Civ. Code § 1798.150(c) (West 2025)

(“Nothing in this title shall be interpreted to serve as the basis for a private right of action under any other law.”); , 2021 WL 3191752, at *7 (N.D. Cal. July 28, 2021) (dismissing the UCL claim to the extent it is based on a violation of the CCPA because the CCPA “on its face states that consumers may not use [the statute] as a basis for a private right of action

58 under any statute” (citation omitted)). 3. Young Consulting The reach of California’s UCL is limited by the “presumption against

exterritoriality,” meaning it will not apply to conduct occurring outside of California. , 51 Cal. 4th 1191, 1207 (2011) (“[T]he presumption against extraterritoriality applies to the UCL in full force.”).18 The key inquiry is whether the “liability-creating conduct occurs outside of California.” , 889 F.3d 1075, 1079 (9th Cir. 2018). The Court dismisses the UCL claim against Young Consulting on

extraterritoriality grounds. Young Consulting’s principal place of business is Georgia, so it presumably implemented (or failed to implement) security measures in Georgia, where its servers and all of the compromised data were presumably located. The Plaintiffs argue that the UCL applies to Young Consulting because “the conduct giving rise to the claims occurred at least in part in California, where Blue Shield is headquartered and where key decisions regarding vendor oversight, data transmission to Young Consulting,

and data-security practices were made.” (Pls.’ Joint Resp. Br. in Opp’n to Defs. Mots. to Dismiss, at 42.) While these allegations suggest that Blue Shield may have made poor data security decisions in California, they do not plausibly

18 Young Consulting does not argue that this presumption applies to the other California statutory claims alleged against it, so the Court does not consider whether it does. 59 plead that Young Consulting made security-related decisions in California, failed to properly secure data in California, or otherwise engaged in liability-creating conduct in California. Other courts have held the same on

similar facts. , , 631 F. Supp. 3d 573, 596 (N.D. Ill. 2022) (dismissing the California UCL claim for failure to allege the defendants’ poor security measures “emanated from California,” as opposed to Illinois where the defendants’ internal servers were presumably located and attacked); , 2024 WL 2965642, at *11 (W.D. Ky. June 12, 2024) (dismissing the UCL claim

because the defendant “is headquartered out of state and all relevant conduct leading to the data breach, and, presumably, the data breach itself, is alleged to have taken place in Kentucky”). The UCL claim is therefore dismissed against Young Consulting, and the Court does not consider Young Consulting’s alternative grounds for dismissal. 4. Blue Shield Beyond the UCL arguments already addressed above, Blue Shield

advances two additional grounds for dismissal. First, it claims that the Complaint fails to “plead specific facts” showing how the company violated the UCL’s unlawful and unfair prongs. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 19–20.) Second, the company seeks dismissal because the Plaintiffs “have an adequate legal remedy . . . through their negligence and contract

60 claims” and thus cannot access the equitable remedies afforded by the UCL. ( at 21.) These arguments are unavailing. The Complaint pleads sufficient facts

as to Blue Shield’s unlawful business practices. The unlawful prong “prohibits anything that can properly be called a business practice and that at the same time is forbidden by law.” , 613 F. Supp. 3d 1284, 1303 (S.D. Cal. 2020) (quoting , 66 F. Supp. 3d at 1225). Allegations that a defendant violated “[a]lmost any law may serve as a basis for a UCL claim,” so long as those allegations “identify

the particular section of the statute that was violated” and “describe[s] with reasonable particularity the facts supporting the violation.” (quoting , 2010 WL 2486353, at *6 (N.D. Cal. June 16, 2010)). As stated elsewhere, the California Plaintiffs have independently alleged violations of several laws, including tort laws, the California Constitution, and California statutes. They do so with reference to specific statutory provisions and “reasonable particularity” as to Blue Shield. ( , CAC ¶¶ 37–38, 40,

43, 73, 251–56, 258–63, 271–73, 282, 290, 348, 446.) The Complaint also pleads sufficient facts as to Blue Shield’s unfair business practices. The unfair prong prohibits “unfair” business practices, which courts have identified by applying either a “balancing” test and “tethering” test. , 2025 WL 1140788, at *10

61 (C.D. Cal. Feb. 28, 2025). The balancing test “weigh[s] the utility of the defendant’s conduct against the gravity of the harm to the alleged victim.” , 613 F. Supp. 3d at 1303 (citing , 691

F.3d 1152, 1169 (9th Cir. 2012)). The tethering test asks whether the defendant’s conduct “is ‘tethered’ to some legislatively declared policy.” , 2025 WL 1140788, at 10. Several district courts weighing allegations similar to those in the present case—including false representations by the defendant of reasonable and appropriate data security measures and the large-scale breach of PII and PHI as a result of poor security and oversight—have declined

to dismiss UCL claims under the balancing test at the pleading stage. , at 1304 , 2024 WL 4253198, at *11 (D. Nev. Sept. 19, 2024). The Court follows suit and holds similarly. Blue Shield attempts to distinguish these cases because they concerned “breaches of [the defendants’] own systems,” (Reply Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 12 [Doc. 58]), but that is a distinction without a difference. The gravity of the harm is not lessened by the fact that Blue Shield’s negligent

oversight of its vendor’s systems allegedly caused the data breach. ( , CAC ¶ 37–38, 43.) Applying the tethering test would not alter this conclusion; as evidenced by the other claims in this case, the California Constitution and “numerous California statutes . . . reflect California’s public policy of protecting consumer data.” , 2025 WL 1140788, at *10.

62 Blue Shield’s remedies argument fares no better. The UCL authorizes recovery in the form of restitution and injunctive relief. , 903 F. Supp. 2d 942, 970 (S.D.

Cal. 2012). Because these remedies are equitable in nature, a plaintiff generally must show the lack of an adequate remedy at law in order to establish this claim. , 971 F.3d 834, 844 (9th Cir. 2020). However, at the pleading stage, the Plaintiffs may assert claims in the alternative, including those involving remedies at law and equity. , 668 F. Supp. 3d 881, 894–97 (N.D. Cal. 2022) (allowing the

UCL claim to proceed in the alternative notwithstanding existing claims involving remedies at law, and limiting ’s applicability because that case occurred “on the eve of trial” rather than at the pleading stage). The only case that Blue Shield cites in its favor is , but California district courts have limited the applicability of that case at the pleading stage. , , 668 F. Supp. 3d at 896; , 651 F. Supp. 3d 1111, 1129 (N.D. Cal. 2023) (“A number of district courts since

have concluded that it has minimal application at the pleading stage.”). M. California Confidentiality of Medical Information Act (Count XIV) The California Plaintiffs allege a violation of California’s Confidentiality of Medical Information Act against Blue Shield and Young Consulting. The CMIA imposes liability on “[a]ny provider of health care, health care service

63 plan, . . . or contractor who negligently creates, maintains, preserves, stores, abandons, destroys, or disposes of medical information.” Cal. Civ. Code § 56.101 (West 2024); § 56.36 (West 2024) (providing for actual and

statutory damages). It also prohibits any “provider of health care, health care service plan . . . or contractor” from “disclos[ing] medical information regarding a patient of the provider of health care or an enrollee or subscriber of a health care service plan without first obtaining an authorization.” § 56.10(a) (West 2024). The Defendants seeks dismissal of both the section 56.101 and 56.10(a)

claims. As to section 56.101, both Defendants argue that the Complaint fails to plausibly allege that “an unauthorized person” actually “viewed” the Plaintiffs’ medical information or that the alleged viewing resulted from the Defendants’ negligence. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 23 (first citing , 227 Cal. App. 4th 1546, 1555 (Cal. Ct. App. 2014); and then citing , 220 Cal. App. 4th 549, 564 (Cal. Ct. App. 2013)); Br. in Supp. of Def. Young

Consulting’s Mot. to Dismiss, at 40–41.) As to section 56.10(a), Blue Shield argues that it did not “disclose” the Plaintiffs’ medical information within the meaning of the statute because it did not “affirmative[ly]” disclose the information; rather, a third-party stole the information. ( at 21–22.)

64 The Court quickly disposes with the Plaintiffs’ CMIA claim under section 56.10(a). The Plaintiffs concede that section 56.10(a) governs affirmative disclosures, which are inapplicable to the Defendants. (Pls.’ Joint

Resp. Br. in Opp’n to Defs.’ Mots. to Dismiss, at 46 n.19.) The Court agrees; the Plaintiffs’ data was allegedly stolen rather than affirmatively shared by the Defendants. The section 56.10(a) claim is therefore dismissed. As to the section 56.101 claim, the Court denies dismissal. The California Supreme Court recently rejected the “actually viewed” criterion espoused by the Defendants and set out by and .

, 19 Cal. 5th 705, 720–21 (2026). It held that “the key criterion” for a section 56.101 claim is “whether the [medical] information is exposed to a significant risk of unauthorized access or use,” not whether the information “is actually viewed by an unauthorized person.” at 721; at 722 (“[A]n ‘actually viewed’ standard would pose difficult problems of pleading and proof. Victims of data breaches are unlikely to know what an unauthorized party has done with their data unless they suffer actual damages

. . .”). Here, the Plaintiffs allege that a ransomware group stole their medical information and posted it on the dark web for over a year, with a “a directory listing each stolen file by name.” (CAC ¶¶ 44–57.) They further point to Young Consulting and Blue Shield’s notice letter, which stated that “an unauthorized actor gained access to [Young Consulting’s] network . . . and downloaded copies

65 of certain files.” ( ¶ 46.) Given the wrongful download of the Plaintiffs’ medical information, the prolonged availability of the information on a public internet platform, and the Court’s duty to construe the allegations in the light

most favorable to the Plaintiffs, the Court finds it plausible that the data breach created a “significant risk of unauthorized access [to] or use [of]” the Plaintiffs’ medical information. , 19 Cal. 5th at 723. Other courts have made similar inferences, albeit before the California Supreme Court opinion clarified the CMIA standard. , , 501 F. Supp. 3d at 923–24 (“Given that Plaintiffs allege that Inmediata posted their

information on the internet, making it searchable, findable, viewable, printable, copiable, and downloadable by anyone in the world with an internet connection, it can be reasonably inferred that someone viewed it.” (citation omitted)); , 2024 WL 3678984, at *14 (E.D. Pa. Aug. 6, 2024) (inferring that the plaintiffs’ data “had been wrongfully viewed or accessed” based on allegations that a ransomware group posted and sold the data on the dark web and that the defendants’ notice letter stated that

the group “accessed” the files). N. California Customer Records Act (Count XV) The California Plaintiffs allege two violations of the California Customer Records Act (“CCRA”) against Blue Shield, pursuant to sections 1798.81.5(b) and 1798.82(a)(1) of the California Civil Code.

66 Section 1798.81.5(b) provides that “[a] business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the

nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” Cal. Civ. Code § 1798.81.5(b) (West 2024). At the time of the breach, section 1798.82(a) provided that “[a] . . . business that conducts business in California, and that owns or licenses computerized data that includes personal information, shall disclose a breach of the security of the system following discovery or

notification of the breach in the security of the data to a resident of California [ ] whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.” § 1798.82(a) (West 2024). That version of the CCRA generally required disclosure “in the most expedient time possible and without unreasonable delay.”19 (noting exceptions for law enforcement involvement). The CCRA creates a private right of action to any “customer” injured by a business’s failure to comply with the statute.

§ 1798.84(b) (West 2024). The statute defines a “customer” as “an individual who provides personal information to a business for the purpose of purchasing

19 This language was effective through December 31, 2025. The Court notes that the California legislature has since revised the language to require disclosure within thirty calendar days. Cal. Civ. Code § 1798.82(a)(2)(A) (West 2026). 67 or leasing a product or obtaining a service from the business.” § 1798.80(c) (West 2024). According to the Plaintiffs, they were Blue Shield customers who were harmed by the company’s failure to “implement and maintain reasonable

security procedures,” (CAC ¶¶ 89, 92, 458), and provide timely and sufficient notice of the breach, ( ¶465–66). Blue Shield seeks dismissal on four grounds. First, the company argues that the California Plaintiffs are not “customers” because “the Complaint pleads (at most) a transactional relationship between Blue Shield and nonparty employers/plan sponsors . . . , not that Plaintiffs went into the

marketplace to . . . obtain a service from Blue Shield.” (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 24.) Second, the company argues that the Complaint fails to plead facts as to its supposed failure to “implement and maintain reasonable security procedures” under section 1798.81.5(b). ( at 24.) Third, Blue Shield suggests that Young Consulting’s notice letter satisfied its notice obligations and that the Complaint nonetheless fails to allege how the notice was “untimely or inaccurate.” (Br. in Supp. of Def. Blue Shield’s Mot.

to Dismiss, at 24–25.) Fourth, the company contends that the “Plaintiffs also fail to allege the required incremental harm resulting from any purported delay.” ( at 25.) Finding that each of these grounds fail, the Court denies Blue Shield’s Motion to Dismiss this CCRA claim. As an initial matter, the Plaintiffs have

68 alleged that they are “customers” within the meaning of the CCRA. CCRA customers include “individual[s] who provide[ ] personal information to a business for the purpose of . . . obtaining a service from the business.” Cal. Civ.

Code § 1798.80(c) (West 2024). Here, the California Plaintiffs allege that they provided their personal information to Blue Shield to obtain its health insurance services. (CAC ¶¶ 124, 132, 156.) That the Plaintiffs obtained these insurance services via an employer-sponsored plan does not change this fact, contrary to Blue Shield’s position, (Reply Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 14–15). The Court is further unpersuaded by Blue Shield’s

reliance on , 742 F. Supp. 3d 1304 (N.D. Ga. 2024) to argue that the Plaintiffs are not customers. (Br. in Supp. of Def. Blue Shield’s Mot. to Dismiss, at 23–24.) is inapposite as to Blue Shield since it did not concern a healthcare provider but rather an “information technology company” that received the plaintiffs’ information in the course of providing software services to healthcare providers. at 1313. In that case, this Court held that the plaintiffs were not customers of the software company

because the plaintiffs “did not provide their private information to NextGen in exchange for NextGen’s software” but rather provided their information to their healthcare provider in exchange for its services. at 1321; , 713 F. Supp. 3d 623, 629 (N.D. Cal. 2024) (dismissing a CCRA claim against a software company on similar grounds).

69 The Court easily dispenses with the remaining three arguments. The Plaintiffs have adequately pleaded that Blue Shield failed to implement and maintain reasonable oversight of its vendor’s security procedures. (CAC ¶¶ 37,

73.) As to delayed notice, the Court is satisfied with the Plaintiff’s allegations of a four-month delay between discovery of the breach and notice, ( ¶ 3), which plausibly speaks to unreasonable delay. , 567 F. Supp. 3d at 1150 (declining to dismiss a CCRA claim where the plaintiffs alleged a three-month delay). Lastly, the Plaintiffs have plausibly pleaded incremental harm in so far as they were prevented from taking timely protective measures

to avoid harm. (CAC ¶¶ 122, 467.) IV. Conclusion For the reasons set forth above, the Court GRANTS in part and DENIES in part Defendant California Physicians’ Service’s d/b/a Blue Shield of California Motion to Dismiss [Doc. 43] and GRANTS in part and DENIES in part Defendant Young Consulting, LLC’s d/b/a Connexure Motion to Dismiss [Doc. 45]. The Court GRANTS Defendant Blue Shield’s Motion to Dismiss

[Doc. 43] as to Count VII (breach of fiduciary duty), Count XI (declaratory and injunctive relief) to the extent the Amended Complaint seeks a declaration regarding the Defendants’ duties to safeguard and notify and their past breach of these duties, Count XII (California Consumer Privacy Act), and Count XIV (California Confidentiality of Medical Information Act) as to violations of

70 section 56.10(a). The Court GRANTS Defendant Young Consulting’s Motion to Dismiss [Doc. 45] as to Count VI (breach of fiduciary duty), Count XI (declaratory and injunctive relief) to the extent the Amended Complaint seeks a declaration regarding the Defendants’ duties to safeguard and notify and their past breach of these duties, Count XII (California Consumer Privacy Act), Count XIII (California Unfair Competition Law), and Count XIV (California Confidentiality of Medical Information Act) as to violations of section 56.10(a). The Court DENIES the Motions as to all other relief requested therein. SO ORDERED, this 15th day of September, 2026.

A termcen. Fehon THOMAS W. THRASH, JR. United States District Judge