Jessica Mangum et al. v. Robert H. Clarkson Insurance Agency, LLC d/b/a Clarkson Insurance; and RH Clarkson Financial Services, Inc. d/b/a Clarkson Financial

Opinion

UNITED STATES DISTRICT COURT WESTERN DISTRICT OF KENTUCKY LOUISVILLE DIVISION CIVIL ACTION NO. 3:25-CV-00414-GNS

JESSICA MANGUM et al., individually and on behalf of all others similarly situated PLAINTIFFS

v.

ROBERT H. CLARKSON INSURANCE AGENCY, LLC d/b/a CLARKSON INSURANCE; and RH CLARKSON FINANCIAL SERVICES, INC. d/b/a CLARKSON FINANCIAL DEFENDANTS

MEMORANDUM OPINION AND ORDER This matter is before the Court on Defendants’ Motion to Dismiss (DN 32). The motion is ripe for adjudication. I. STATEMENT OF FACTS AND CLAIMS This action arises from a third party’s breach of Defendants’ database, which contained Plaintiffs’ private information. Defendants Clarkson Insurance and Clarkson Financial (jointly, “Defendants”) offer a variety of insurance services throughout the United States. (Am. Compl. ¶ 3, DN 23). Jessica Mangum (“Mangum”), Peter Mcintyre, and Kaitlin Mize (“Plaintiffs”) and the proposed class members (“Class Members”) are current and former clients of Defendants who entrusted their private information to Defendants to obtain insurance. (Am. Compl. ¶¶ 3-5). Databases maintained by Defendants contained unencrypted data, including data no longer useful to their operations. (Am. Compl. ¶¶ 11-12). On or about November 20, 2024, cybercriminals gained unauthorized access to Defendants’ computer network systems, and Defendants began an internal investigation into the incident the same day. (Am. Compl. ¶¶ 2, 49). By June 2, 2025, Defendants concluded that databases containing personally identifying information (“PII”) of Plaintiffs and Class Members, including full legal names and Social Security numbers, had been accessed. (Am. Compl. ¶ 49). On or about June 30, 2025, Defendants sent notice letters to Plaintiffs and Class Members informing them that their PII had been accessed and potentially acquired by cybercriminals and recommended that they enroll in a complimentary twelve-month membership of Experian

IdentityWorks. (Am. Compl. ¶¶ 48-49).1 Mangum filed a class action complaint, which she later amended to add Plaintiffs McIntyre and Mize. (Compl., DN 1; Am. Compl.). Defendants now move to dismiss the Amended Complaint. (Defs.’ Mot. Dismiss, DN 32). II. JURISDICTION The Court has subject-matter jurisdiction over this action through diversity jurisdiction because there is complete diversity between the parties and the amount in controversy exceeds the sum of $75,000.00. See 28 U.S.C. § 1332. III. STANDARD OF REVIEW

To survive a motion to dismiss under Fed. R. Civ. P. 12(b)(6), “a complaint must contain sufficient factual matter, accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009) (internal quotation marks omitted) (citing Bell Atl. Corp. v. Twombly, 550 U.S. 544, 570 (2007)). A claim is facially plausible “when the plaintiff

1 The Amended Complaint alleges that data breaches of this nature are well-known risks to companies that collect private information. Industry-leading companies have suffered similar attacks; for example, 250 million records were stolen from Microsoft in 2019, and 8.3 billion records were stolen from Advanced Info Service in 2020. (Am. Compl. ¶ 61). Due to the prevalence of these attacks, the Federal Trade Commission (“FTC”) released guidelines to help companies reduce the vulnerability of their data. The guidelines recommend maintaining data no longer than is necessary to authorize a transaction, using intrusion detection technology to identify breaches as soon as they occur, and monitoring systems for large data transfers. (Am. Compl. ¶ 70 (citing Fed. Trade Comm’n, Protecting Personal Information: A Guide for Business (2016))). pleads factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Id. (citing Twombly, 550 U.S. at 556). When considering a motion to dismiss, a court must “accept all the [plaintiff’s] factual allegations as true and construe the complaint in the light most favorable to the [plaintiff].” Hill v. Blue Cross & Blue Shield of Mich., 409 F.3d 710, 716 (6th Cir. 2005) (citation omitted). “A pleading that offers

labels and conclusions or a formulaic recitation of the elements of a cause of action will not do. Nor does a complaint suffice if it tenders naked assertion[s] devoid of further factual enhancement.” Iqbal, 556 U.S. at 678 (internal quotation marks omitted) (internal citation omitted) (quoting Twombly, 550 U.S. at 557). IV. DISCUSSION Plaintiffs allege negligence per se, a breach of implied contract, unjust enrichment, tortious intrusion upon seclusion, and a violation of the Kentucky Consumer Protection Act (“KCPA”), KRS 367.110-.361. A. Count I – Negligence

“A common law negligence claim requires proof of (1) a duty owed by the defendant to the plaintiff, (2) breach of that duty, (3) injury to the plaintiff, and (4) legal causation between the defendant’s breach and the plaintiff’s injury.” Wright v. House of Imps., Inc., 381 S.W.3d 209, 213 (Ky. 2012) (citation omitted). In this instance, Defendants claim that there is an inadequate pleading of both damages and causation. (Defs.’ Mot. Dismiss 4). First, Defendants argue Plaintiffs’ negligence claim should be dismissed because there is no plausible claim of compensatory damages. (Defs.’ Mot. Dismiss 4). Defendants cite Savidge v. Pharma-Save, Inc., No. 3:17-CV-186-CHB, 2017 WL 5986972 (W.D. Ky. Dec. 1, 2017), for the proposition that there is no cause of action for negligence in Kentucky “until the conduct causes injury that produces loss or damage.” (Defs.’ Mot. Dismiss 4 (quoting Savidge, 2017 WL 5986972, at *3) (citation omitted)). Defendants contend that Plaintiffs’ “self-imposed burdens of mitigation” in conjunction with “claims of anxiety, emotional distress, and a ‘continued and certainly increased risk’ of identity theft and fraud” are not injuries that have materialized yet, and thus, cannot support a cause of action for negligence. (Defs.’ Mot. Dismiss

4-5). The Court, however, later retracted its holding in Savidge that future risk of harm could not be a cognizable injury. Savidge v. Pharm-Save, Inc., No. 3:17-CV-186-CHB, 2023 WL 2755305, at *13-15 (W.D. Ky. Mar. 31, 2023). “[S]o long as Plaintiffs can show they are at a material risk of concrete harm, and that they have suffered any other harm from that risk—not, as the Court previously held, out-of-pocket expenses specifically—they may be entitled to damages for an increased risk of future harm,” and that other harm “may be the emotional distress caused by the threat of identity theft.” Id. at *15. Thus, Plaintiffs’ negligence claim is sufficiently pled because it asserts the risk of future identity theft and the stress and anxiety suffered by Plaintiffs.

Defendants also argue that Plaintiffs do not plausibly allege that the harm suffered— spam calls and robocalls—was caused by the data breach. (Defs.’ Reply Mot. Dismiss 2, DN 34). While no phone numbers were leaked, the stolen data could plausibly have been used to complete a “Fullz” package—a practice developed by cybercriminals that allows one to match unregulated data with stolen data to assemble a comprehensive dossier on an individual— encouraging cybercriminals to reach out to potential victims armed with new PII that increases their chances of extracting additional information. (Am. Compl. ¶¶ 112-113). This could plausibly account for the increase in spam communications. See McKenzie v. Allconnect, Inc., 369 F. Supp. 3d 810, 818-19 (E.D. Ky. 2019) (finding plaintiffs’ allegations of lost time and money to safeguard information after the breach and emotional distress sufficient to state a negligence claim). Defendants further claim that time spent monitoring and nominal spam-blocker expenses are not attributable to the data breach. (Defs.’ Reply Mot. Dismiss 2). A sister court, however, has found the opposite. McKenzie, 369 F. Supp. 3d at 818-19 (finding plaintiffs’ allegations of

lost time and money used to safeguard information after the breach and emotional distress sufficient to state a negligence claim). Thus, Plaintiffs’ negligence claim should not be dismissed, and Defendants’ motion is denied. B. Count II – Breach of Contract To establish a breach of implied contract, Plaintiffs must plausibly allege the existence of an enforceable contract, created by mutual assent, and the failure of a party to comply with the contract terms. See Furtula v. Univ. of Ky., 438 S.W.3d 303, 308-09 (Ky. 2014). Defendants allege that no plausible “meeting of the minds” is pled in the amended complaint because no specific promises about data security were made, and thus, it is implausible that an enforceable

contract exists. (Defs.’ Mot. Dismiss 6). Defendants, however, required Plaintiffs to furnish their private information in exchange for insurance services, which supports a reasonable inference that Defendants entered an implied contract to safeguard the information it collected and maintained. See Savidge, 2017 WL 5986972, at *9 (“While [the defendant] made no explicit promises as to the ongoing protection of personal information, it is difficult to imagine how, in our day and age of data and identity theft, the mandatory receipt of Social Security numbers or other sensitive personal information would not imply the recipient’s assent to protect the information sufficiently.” (citation omitted)). Plaintiffs further allege that this duty was breached by Defendants’ failure to encrypt or delete the data of individuals who were no longer clients. (Am. Compl. ¶¶ 6, 11). Although Defendants also claim that Plaintiffs fail to allege that consideration was provided, Plaintiffs are careful to assert that their monetary payments in exchange for insurance serve as consideration even if the independent monetary value of their PII cannot be established. (Defs.’ Mot. Dismiss 8-9, Pls.’ Resp. Defs.’ Mot. Dismiss 7-8, DN 33).

Additionally, Defendants assert that pre-existing statutory and regulatory obligations to protect the data—e.g., FTC guidelines—make Plaintiffs’ allegations implausible because valid consideration cannot have been provided where there is a legal obligation to do the same. (Defs.’ Mot. Dismiss 9 (citing Fidelity-Phenix Fire Ins. Co. v. Duvall, 106 S.W.2d 991, 997 (Ky. 1937; Wallace v. Cook, 227 S.W. 279, 281 (Ky. 1921))). This Court, however, has rejected a similar argument. See Lurry v. PharMerica Corp., No. 3:23-CV-297-RGJ, 2024 WL 2965642, at *4 n.6 (W.D. Ky. June 12, 2024). Thus, Plaintiffs plausibly allege an actionable breach of contract claim, and Defendants’ motion is denied as to this claim.

C. Count III – Unjust Enrichment For an unjust enrichment claim to be well-pled, a plaintiff must claim a benefit conferred upon another party resulting in a benefit to that party along with an inequitable retention of that benefit without payment for its value. Furlong Dev. Co. v. Georgetown-Scott Cnty. Plan. & Zoning Comm’n, 504 S.W.3d 34, 39-40 (Ky. 2016). Defendants aver that Plaintiffs fail to allege conferment or unjust retention of a benefit. (Defs.’ Mot. Dismiss 9-11). Plaintiffs, however, allege that they provided consideration, in the form of monetary payments, to Defendants which failed to encrypt the information, train employees to recognize and guard against cyberattacks, or implement a system to alert the company of unauthorized access. (Pls.’ Resp. Defs.’ Mot. Dismiss 9); Silveira v. Com. Specialty Truck Holdings, LLC, No. 5:25-CV-048-DCR, 2025 WL 2323911, at *6 (E.D. Ky. Aug. 12, 2025) (holding that an unjust enrichment claim could survive because plaintiffs alleged that defendant enriched itself by saving money not protecting PII). Thus, Defendants’ motion is denied as to Count III. D. Count IV – Invasion of Privacy

To succeed on a claim of invasion of privacy, a plaintiff must demonstrate: (1) an intentional intrusion by the defendant; (2) into a matter the plaintiff has a right to keep private; (3) which is highly offensive to a reasonable person. Wells v. Craig & Landreth Cars, Inc., No. 3:10-CV-376, 2012 WL 6487392, at *5 (W.D. Ky. Dec. 13, 2012). While Plaintiffs do not allege that Defendants themselves intentionally intruded, this is not necessary. Kentucky has adopted the Restatement of Torts’ definition which allows for the “intentional intrusion” element to be satisfied by recklessness. Pearce v. Whitenack, 440 S.W.3d 392, 400-01 (Ky. App. 2014); Restatement (Second) of Torts § 652B (A.L.I. 1965). Plaintiffs allege that Defendants were reckless in their failure to properly secure the data they collected, which can plausibly satisfy the

intent element. (Am. Compl. ¶ 12). Defendants, however, argue that Plaintiffs’ claim still fails; while recklessness can satisfy the intent element, Plaintiffs must still allege that the Defendants themselves intruded upon the Plaintiffs. (Defs.’ Reply Mot. Dismiss 6-7). For example, an intrusion claim related to a data breach was allowed to proceed where an employee of the company holding the data had gathered and transmitted the sensitive information in response to a phishing email. See McKenzie, 369 F. Supp. 3d at 819. There are no allegations in this case, however, suggesting that any employee of Defendants directly contributed to the intrusion or intruded themself. Thus, this element of intrusion upon seclusion is not well-pled and the claim will be dismissed. E. Count V – Violation of the KCPA The KCPA allows for a right of action when a person who “purchases or leases goods or services primarily for personal, family or household purposes” subsequently suffers an ascertainable loss “as a result of” an unfair or deceptive practice. KRS 367.220(1). Defendants claim that Plaintiffs are not “purchasers” with privity and thus lack a private right of action.

(Defs.’ Mot. Dismiss 12). Plaintiffs, however, purchased Defendants’ services and, as a requirement of those services, were required to entrust Defendants with their PII. See Viviali v. One Point HR Sols., LLC, No. 2:24-CV-185-DCR, 2025 WL 1158740, at *10 (E.D. Ky. Apr. 21, 2025) (finding that allegations that the defendant required the plaintiff to entrust their PII as a condition of obtaining the defendant’s services plausibly suggest that the plaintiff purchased services from the defendant as customers). Defendants also claim that no unfair or deceptive practice occurred. (Defs.’ Mot. Dismiss 14). Although Defendants only withheld information about the leak for twenty-eight days, this delay could plausibly constitute an unfair practice because it deprived Plaintiffs of the

opportunity to respond to the breach of their PII. See Viviali, 2025 WL 1158740, at *10. In Viviali, for example, the defendant failed to notify clients of the breach for 431 days and the court held this sufficient to establish an unfair practice. Id. Additionally, Defendants claim that no “ascertainable loss” is alleged by Plaintiffs. (Defs.’ Mot. Dismiss 13-14). To the contrary, Plaintiffs allege numerous damages, including imminent risk of identity theft in combination with emotional distress, which are sufficient to support a KCPA claim. (Am. Compl. ¶¶ 14-15); Savidge, 2023 WL 2755305, at *15 (quoting TransUnion LLC, 594 U.S. at 437). Accordingly, Count V may proceed. V. CONCLUSION For the foregoing reasons, IT IS HEREBY ORDERED that Defendants’ Motion to Dismiss (DN 32) is GRANTED IN PART and DENIED IN PART. Count IV of the Amended Complaint is DISMISSED WITHOUT PREJUDICE.

Greg N. Stivers, Judge United States District Court August 3, 2026

ce: counsel of record