IN THE UNITED STATES DISTRICT COURT NORTHERN DISTRICT OF TEXAS DALLAS DIVISION
JOHN COSSETTE, et al., § § Plaintiffs, § § v. § Civil Action No. 3:25-CV-1057-N § JANI-KING INTERNATIONAL, INC. § § Defendant. §
MEMORANDUM OPINION AND ORDER This Order addresses Defendant Jani-King International Inc.’s (“Jani-King”) motion to dismiss [18]. First, the Court holds that Plaintiffs have standing to bring all their claims except the declaratory and injunctive relief claim. Then, the Court grants the motion to dismiss as to the unjust enrichment claim and denies the motion as to the breach of contract and negligence claims. The Court defers ruling on the negligence per se claim until the Court rules on class certification. I. ORIGINS OF THE MOTION Jani-King is a commercial cleaning company franchise.1 Pls.’ Am. Compl. ¶ 2 [10]. Between November 26, 2024, and December 21, 2024, Jani-King was the target of a cybersecurity attack in which an unauthorized third party accessed the personally identifiable information (PII) of “employees, franchisees, and other individuals” such as names, addresses, and social security numbers. Id. ¶¶ 6, 33. The hacker also accessed and
1 For the purposes of this motion, the Court accepts the truth of all well-pleaded facts in the complaint. copied other private information such as franchisee financial information. Id. ¶ 6. The hacker retained access to Jani-King’s system for at least a month. Id. ¶ 5. Jani-King
notified its “employees, franchisees, and other individuals” of the data breach on or around April 16, 2025. Id. ¶ 3. Plaintiffs are a putative class of Jani-King employees, franchisees, and others whose PII was accessed during the data breach. Id. ¶¶ 10, 31. They allege that their PII stolen in the data breach “has either already been offered for sale on dark web marketplaces or will inevitably appear there.”2 Id. ¶ 11. Plaintiffs also allege that they have already experienced
an increase in spam calls, texts and emails following the data breach. Id. ¶ 214. Named Plaintiffs include John Cossette, Sophia Ivy, Shelly Jacquez, Edwin Dalmacio, and Francis Breedlove. Id. ¶ 1. All Named Plaintiffs except Cossette allege that they received notices that their PII, including their names and Social Security numbers, had been improperly accessed or obtained by unauthorized third parties. Id. ¶¶ 109, 122, 134,
146; see also Def.’s Mot. Br. 9 [19]. Jacquez alleges that she “has suffered from so many unwanted spam calls and messages” that she takes anxiety and depression medication to mitigate the resulting stress. Id. ¶ 130. All Named Plaintiffs plead that they have spent multiple hours, and anticipate spending additional time, on efforts to react to and protect themselves from harm resulting from the data breach. Id. ¶¶ 103, 112, 124, 137, 148.
2 “The dark web is an area of the internet accessible only by using an encryption tool. It provides anonymity and privacy online, and perhaps consequently, frequently attracts those with criminal intentions.” United States v. Schultz, 88 F.4th 1141, 1142 n.1 (5th Cir. 2023) (citing Gareth Owen & Nick Savage, The Tor Dark Net, Global Commission on Internet Governance, Paper Series No. 20, 1 (2015)). Named Plaintiffs bring this action on behalf of themselves and on behalf of other persons similarly situated in a proposed nationwide class. Id. ¶ 33. The claims on behalf
of Named Plaintiffs and the nationwide class include (1) negligence (2) negligence per se, (3) breach of implied contract, (4) unjust enrichment, and (5) declaratory and injunctive relief. Pls.’ Am. Compl. ¶¶ 166–240. Jani-King brings this motion to dismiss, arguing first that Plaintiffs lack standing to bring the claims and second that the Court should dismiss all the claims because Plaintiffs fail to state any claim upon which relief can be granted. See Def.’s Mot. Dismiss [18].
II. LEGAL STANDARDS TO DISMISS A. Rule 12(b)(1) Standard Under the United States Constitution, a federal court may decide only actual “cases” or “controversies.” U.S. CONST. ART. III, § 2. A court properly dismisses a case where it lacks the constitutional power to decide it. Home Builders Ass’n of Miss., Inc. v. City of
Madison, 143 F.3d 1006, 1010 (5th Cir. 1998). “The justiciability doctrines of standing, mootness, political question, and ripeness all originate in Article III’s ‘case’ or ‘controversy’ language.” Choice Inc. of Tex. v. Greenstein, 691 F.3d 710, 715 (5th Cir. 2012) (internal quotation marks omitted) (quoting Daimler Chrysler Corp. v. Cuno, 547 U.S. 332, 352 (2006)). “Standing and ripeness are required elements of subject matter
jurisdiction and are therefore properly challenged on a Federal Rule of Civil Procedure 12(b)(1) motion to dismiss.” Roman Cath. Diocese v. Sebelius, 927 F. Supp. 2d 406, 415– 16 (N.D. Tex. 2013) (citing Xerox Corp. v. Genmoora Corp., 888 F.2d 345, 350 (5th Cir. 1989) and Western Geco L.L.C. v. Ion Geophysical Corp., 776 F. Supp. 2d 342, 350 (S.D. Tex. 2011)).
The standing requirement has three elements: (1) injury in fact, (2) causation, and (3) redressability. See Bennett v. Spear, 520 U.S. 154, 167 (1997). The injury cannot be merely “conjectural or hypothetical.” Summers v. Earth Island Inst., 555 U.S. 488, 493 (2009). Causation requires that the injury “fairly can be traced to the challenged action of the defendant” rather than to “the independent action of some third party not before the court.” Simon v. E. Ky. Welfare Rts. Org., 426 U.S. 26, 41–42 (1976). And redressability
requires that it is likely, “as opposed to merely ‘speculative,’ that the injury will be ‘redressed by a favorable decision.’” Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992) (quoting Simon, 426 U.S. at 38, 43). When “‘standing is challenged on the basis of the pleadings,’ [courts] must ‘accept as true all material allegations of the complaint and . . . construe the complaint in favor of the complaining party.’” Ass’n of Am. Physicians &
Surgeons, Inc. v. Tex. Med. Bd., 627 F.3d 547, 550 (5th Cir. 2010) (omission in original) (quoting Pennell v. City of San Jose, 485 U.S. 1, 7 (1988)). B. Rule 12(b)(6) Standard When deciding a Rule 12(b)(6) motion to dismiss, a court must determine whether the plaintiff has asserted a legally sufficient claim for relief. Blackburn v. City of Marshall,
42 F.3d 925, 931 (5th Cir. 1995). A viable complaint must include “enough facts to state a claim to relief that is plausible on its face.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 570 (2007). To meet this “facial plausibility” standard, a plaintiff must plead “factual content that allows the court to draw the reasonable inference that the defendant is liable for the misconduct alleged.” Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A court generally accepts well-pleaded facts as true and construes the complaint in the light most favorable
to the plaintiff. Gines v. D.R. Horton, Inc., 699 F.3d 812, 816 (5th Cir. 2012). But a plaintiff must provide “more than labels and conclusions, and a formulaic recitation of the elements of a cause of action will not do.” Twombly, 550 U.S. at 555 (citations omitted). “Factual allegations must be enough to raise a right to relief above the speculative level . . . on the assumption that all the allegations in the complaint are true (even if doubtful in fact).” Id. (citations omitted).
In ruling on a Rule 12(b)(6) motion, a court generally limits its review to the face of the pleadings, accepting as true all well-pleaded facts and viewing them in the light most favorable to the plaintiff. See Spivey v. Robertson, 197 F.3d 772, 774 (5th Cir. 1999). However, a court may also consider documents outside of the pleadings if they fall within certain limited categories. First, a “court is permitted . . . to rely on ‘documents
incorporated into the complaint by reference, and matters of which a court may take judicial notice.’” Dorsey v. Portfolio Equities, Inc., 540 F.3d 333, 338 (5th Cir. 2008) (quoting Tellabs, Inc. v. Makor Issues & Rts, Ltd., 551 U.S. 308, 322 (2007)). Second, a “written document that is attached to a complaint as an exhibit is considered part of the complaint and may be considered in a 12(b)(6) dismissal proceeding.” Ferrer v. Chevron Corp., 484
F.3d 776, 780 (5th Cir. 2007). Third, a “court may consider documents attached to a motion to dismiss that ‘are referred to in the plaintiff’s complaint and are central to the plaintiff’s claim.’” Sullivan v. Leor Energy, LLC, 600 F.3d 542, 546 (5th Cir. 2010) (quoting Scanlan v. Tex. A&M Univ., 343 F.3d 533, 536 (5th Cir. 2003)). Finally, in “deciding a 12(b)(6) motion to dismiss, a court may permissibly refer to matters of public record.” Cinel v. Connick, 15 F.3d 1338, 1343 n.6 (5th Cir. 1994) (citation omitted); see also, e.g., Funk,
631 F.3d at 783 (stating, in upholding district court’s dismissal pursuant to Rule 12(b)(6), that the “district court took appropriate judicial notice of publicly-available documents and transcripts produced by the [Food and Drug Administration], which were matters of public record directly relevant to the issue at hand”). III. PLAINTIFFS HAVE STANDING Jani-King argues that Plaintiffs lack standing for each claim because they failed to
plead facts sufficient to allege that they suffered a legally cognizable injury in fact. Def.’s Br. 2–8. In response, Plaintiffs assert that they have alleged concrete and particularized harms through (1) a post-breach increase in spam communications; (2) diminution in PII value; (3) the likely theft of their PII; (4) costs associated with mitigating exposure of PII; (5) severe emotional distress, (6) violations of their privacy rights; (8) loss of the benefit
of the bargain; and (9) imminent risk of future harm. Pls.’ Resp. Br. 6–12. A. Standard for Standing in Data Breach Cases In Cabezas v. Mr. Cooper Group, Inc., 2025 WL 2053287, at *6 (N.D. Tex. 2025), this Court adopted the three-factor test established by the Second Circuit in McMorris v. Carlos Lopez & Associates, 995 F.3d 295 (2d Cir. 2021) to determine whether an injury in
the data breach context is sufficiently imminent for purposes of standing. The test looks at three non-exhaustive factors: (1) Whether the data at issue was compromised “as the result of a targeted attack intended to obtain the plaintiffs’ data”; (2) Whether “at least some part of the compromised dataset has been misused — even if plaintiffs’ particular data . . . has not yet been affected”; and
(3) Whether the data at issue “is more or less likely to subject plaintiffs to a perpetual risk of identity theft or fraud once it has been exposed.”
McMorris, 995 F.3d at 301–02. The test does not require fulfillment of each factor, but rather uses these, along with other relevant factors, as guidance to show whether the plaintiff has shown an injury in fact sufficient for standing. Id. at 302 (“These factors are by no means the only ones relevant . . . [a]fter all, determining standing is an inherently fact-specific inquiry.”); see also Clemens v. ExecuPharm Inc., 48 F.4th 146, 154 (3d Cir. 2022) (“Of note, misuse is not necessarily required.”). Moreover, Courts have found an injury in fact in data breach cases that resulted in the unauthorized disclosure of PII including names and Social Security numbers “even though there were no allegations that the data had already been misused by the hackers.” Hays v. Frost & Sullivan, Inc., 2024 WL 4052741 at *6 (W.D. Tex. 2024), R. & R. adopted, 2024 WL 4047166 (W.D. Tex. 2024); see also Bohnak v. Marsh & McLennan Comp. Inc., 79 F.4th 276, 289 (2d Cir. 2023) (concluding that plaintiff sufficiently alleged injury in fact even though she did not allege any known misuse of information in the dataset accessed in the hack); Bruno v. Donohoe as Tr. of Texas Med. Liab. Tr., 754 F. Supp. 3d 737 (W.D. Tex. 2024) (observing that misuse of data is not a necessary component of establishing
standing). The Second Circuit, building on the cases following McMorris, has also determined that exposure of PII “as a result of a targeted attempt by a third party to access the data set” is sufficient to show a concrete and imminent injury for the purposes of standing. Bohnak v. Marsh & McLennan Cos., Inc., 79 F.4th 276, 288–89 (2d Cir. 2023). The court in that case compared an exposure of PII by data breach to the Supreme Court’s ruling in
TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), where the Supreme Court “recognized that ‘disclosure of private information’ was an intangible harm ‘traditionally recognized as providing a basis for lawsuits in American courts.’” Bohnak, 79 F.4th at 286 (quoting TransUnion, 594 U.S. at 425). “The Eleventh Circuit also relies on TransUnion to add the caveat that ‘mere risk of future harm, without more, does not give rise to Article III standing for recovery of damages, even if it might give rise to Article III standing for purposes of
injunctive relief.’” Cabezas, 2025 WL 2053287, at *4 (quoting Green-Cooper v. Brinker Int’l, Inc., 73 F.4th 883, 889 (11th Cir. 2023)). However, the Green-Cooper court did determine that standing existed where plaintiffs’ pleading extended beyond mere risk of harm and alleged that their credit card and personal information was “exposed for theft and sale on the dark web.” Green-Cooper, 73 F.4th at 889.
B. Plaintiffs Have Sufficiently Alleged an Injury in Fact 1. Spam communications do not constitute an injury in fact. — First, Plaintiffs have alleged an increase in spam calls, text messages, and emails. Pls.’ Am. Compl. ¶ 214. Courts have held that an allegation of an increase in spam phone calls or phishing communications is insufficient to establish an injury in fact. See, e.g., Cabezas, 2025 WL
2053287, at *5 (collecting cases); see also Legg v. Leaders Life Ins. Co., 574 F. Supp. 3d 985, 993 (W.D. Okla. 2021) (“But the receipt of phishing emails, while perhaps ‘consistent with’ data misuse, does not ‘plausibly suggest’ that any actual misuse of [PII] has occurred.”). The Court agrees with these rulings that spam and phishing communications alone are not enough to establish injury in fact.
2. Plaintiffs have not established standing under theories of diminution of value or loss of benefit of the bargain. — The Court concludes that Plaintiffs have not suffered an injury in fact based on a diminution in value of their PII or a lack of benefit of the bargain. “Courts are divided on whether diminution of value of personal information constitutes a concrete harm.” Hulse v. Acadian Ambulance Serv. Inc., 2025 WL 1453847, at *8 (W.D. La. 2025). But “district courts in Texas have been more skeptical” than many
other courts as to a diminution of value for PII claim. In re ESO Sols., Inc. Breach Litig., 2024 WL 4456703, at *7 (W.D. Tex. 2024). First, Plaintiffs do not allege that they intended or attempted to sell their data and were forced to do so at a diminished price. Thus, the Court determines that they have not plausibly pled diminution of value. See id. (rejecting diminution of value claim because
even “if diminished PII was cognizable in the Fifth Circuit, Plaintiffs do not plausibly show their PII has diminished in value. Plaintiffs fail to allege that they attempted to or would have ever sold their PII”). Furthermore, Plaintiffs fail to plead a loss of benefit of the bargain because they do not allege that they bargained for and paid for the protection of their PII. Williams v.
Bienville Orthopaedic Specialist, LLC, 737 F. Supp. 3d 411, 422 (S.D. Miss. 2024) (“There is no allegation that any of the plaintiffs paid a certain amount of money to [the company] in exchange for protection of their private information.”). Plaintiffs allege that Jani-King funds its data security measures from its general revenue, which includes payments made by Named Plaintiffs and prospective class members in exchange for a reasonable level of data security. Pl.’s Am. Compl. ¶¶ 220–221.
At most, these allegations suggest that Jani-King failed to comply with industry standards related to data security. “Benefit of the bargain theories for standing are disfavored in the data breach context.” Cabezas, 2025 WL 2053287, at *6 (collecting cases). “And even courts willing to entertain this theory of standing consistently reject this theory in data breach cases where plaintiffs have not alleged that the value of the goods or services they purchased was diminished as a result of the data breach.” Podroykin v. Am.
Armed Forces Mut. Aid Ass’n, 634 F. Supp. 3d 265, 272 (E.D. Va. 2022) (cleaned up). The Court determines that Plaintiffs have not sufficiently alleged that data protection was part of the bargain for services with Jani-King. 3. Plaintiffs except Cossette have sufficiently alleged an increased risk of future harm. — Next, the Court uses the McMorris test to analyze risk of imminent future harm
for standing in the data breach context. The Court finds that each Named Plaintiff except Cossette has sufficiently alleged an increase risk of future harm. First, the Court determines that the PII at issue was compromised “as the result of a targeted attack intended to obtain the plaintiffs’ data.” McMorris, 995 F.3d at 301. Named Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove allege that the data breach was a targeted
attack in which the hacker gained “unfettered access to Plaintiffs’ and Class Members’ PII for nearly a month before the intrusion was detected and contained.” Pls.’ Am. Compl. ¶ 5. Additionally, each Named Plaintiff other than Cossette3 received a notice that an unauthorized third party improperly accessed their PII. Id. ¶¶ 109, 122, 134, 146.
Next, the Court finds that Plaintiffs have not sufficiently alleged that “at least some part of the compromised dataset has been misused.” McMorris, 995 F.3d at 301. Plaintiffs merely allege that they experienced an increase in spam calls, texts, and emails. Cf. Hawkins v. Scout Energy Mgmt., LLC, 2025 WL 2244327 at *5 (N.D. Tex. 2025) (holding an unauthorized attempt to open a bank account in named plaintiff’s name a sufficient allegation of misuse).
Finally, the Court decides that the data at issue, particularly Plaintiffs’ names and Social Security numbers, Pls.’ Am. Compl. ¶ 6, is the type of data that is “likely to subject plaintiffs to a perpetual risk of identity theft or fraud once it has been exposed.” McMorris, 995 F.3d at 302. Thus, because Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove have sufficiently pled allegations satisfying the first and third McMorris factors, the Court
concludes that Plaintiffs’ allegations of a targeted hack exposing their names and Social Security numbers to unauthorized actors are sufficient to suggest an imminent risk of future harm. Thus, the Court holds that these Plaintiffs have standing based on the risk of future harm. In contrast, Plaintiff Cossette did not allege facts specifically suggesting that his
data was exposed on the dark web as a result of Jani-King’s 2024 breach. Thus, Cossette
3 John Cossette, a former Jani-King employee, alleges only that he is a victim of the Jani- King data breach “upon information and belief.” Pls.’ Compl. ¶ 99–100. Cossette does not explicitly allege that he received a notice letter from Jani-King confirming that his PII was exposed in the data breach. does not satisfy the first or second McMorris factors. The Court concludes that Cossette’s allegations are insufficient to suggest an imminent risk of future harm.
4. Exposure of Plaintiffs’ data to a third-party and on the dark web does sufficiently constitute an injury in fact. — Additionally, Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove have established a present injury in their allegations of the sale or exposure of their PII to the dark web. These Plaintiffs sufficiently alleged that unauthorized third parties improperly accessed or obtained their PII from Jani-King’s database. Pls.’ Am. Compl. ¶¶ 109, 122, 134, 146. They also allege that their stolen PII “is at a high risk of
being sold or has already been sold on dark web marketplaces.” Id. Therefore, the Court holds that Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove also have standing based on the exposure of data to an unauthorized third party, similar to a claim for public disclosure of private facts. See, e.g., Hawkins, 2025 WL 2244327, at *5 (N.D. Tex. 2025). Additionally, the Court finds that Cossette does not have standing on this basis because he
does not allege that sufficiently allege that his data was exposed to the dark web by the Jani-King breach. 5. Plaintiffs have standing for mitigation costs and emotional distress. — Mitigation costs alone cannot create standing. See e.g., Logan v. Marker Grp., Inc., 2024 WL 3489208, at *6 (S.D. Tex. 2024) (holding that because the court determined “that the
risk of future identity theft based on the data breach is not a concrete injury sufficient to confer standing, Plaintiffs’ . . . harms based on fear of that hypothetical future harm is also insufficient to establish standing”). However, emotional distress and mitigation costs, “when coupled with the risk of harm . . . is a concrete injury sufficient to confer standing.” Hulse, 2025 WL 1453847, at *8. Because the Court finds that Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove have sufficiently alleged a risk of future harm, the Court
concludes that Plaintiffs other than Cossette have standing to pursue their claims for mitigation costs and emotional distress. 6. The Court denies standing for Plaintiffs’ claim for declaratory and injunctive relief because it is based on a speculative future harm. — Plaintiffs plead that any PII still in Jani-King’s possession “remains at imminent risk of further compromise and dark web dissemination” unless Jani-King “materially improves its data security.” Pls.’ Am.
Compl. ¶ 236. Plaintiffs therefore ask the Court to order Jani-King to implement and maintain court-supervised security measures. Id. ¶ 240. This claim for relief is based entirely on the speculative risk of a second data breach. Courts have held that the future harm of a second cyberattack is too speculative and not sufficiently imminent to support an injury in fact. See e.g., Williams 737 F. Supp. 3d
at 422 (S.D. Miss. 2024) (“Plaintiffs do not have standing to seek declaratory or injunctive relief because they have failed to allege facts ‘tending to show that a second data breach is currently impending or there is a substantial risk that one will occur.’” (quoting Hummel v. Teijin Auto. Techs., Inc., 2023 WL 6149050, at *14 (E.D. Mich. 2023))). Thus, the Court holds that Plaintiffs lack standing to seek declaratory and injunctive relief for the
speculative future harm of a second cyberattack. C. Plaintiffs Sufficiently Allege Causation and Redressability Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove have sufficiently alleged an injury in fact. The Court now turns to whether these Plaintiffs have pled sufficient facts to establish that the injury is fairly traceable to the data breach and whether the alleged injury would be redressed by a favorable decision.
In data breach cases, the pleading standard for causation can be met where a plaintiff has pled “(1) the defendant failed to secure his private information, (2) its network was subsequently hacked, (3) the plaintiff’s private information was stolen by hackers, and (4) the plaintiff became the victim of [the pled injury in fact].” Williams, 737 F. Supp. 3d at 423. Here, Plaintiffs allege that Jani-King’s actions, or lack thereof, allowed Jani-King
to be hacked and led to the disclosures of their PII. Pls.’ Resp. 13. They further allege that their injuries only began after the data breach. Id. Lastly, Plaintiffs sufficiently allege that their injuries are fairly traceable to Jani-King’s data breach because Plaintiffs received notices that their data stored on Jani-King’s network was exposed. Id.; see also Merrell v. 1st Lake Props., Inc., 2023 WL 6316257, at *4 (E.D. La. 2023) (“Plaintiff has alleged that
he does not recall receiving any other notices of data breach, and that his PII was compromised because defendant failed to implement minimum safeguards. . . . At this stage, nothing further is required to establish traceability for constitutional purposes.”). The Court therefore holds that Plaintiffs have adequately pled causation. Jani-King also argues that Plaintiffs fail to sufficiently allege redressability for the
same reasons that they lack standing to seek injunctive relief. Def.’s Mot. Br. 10. However, the Court agrees with Plaintiffs that monetary relief, including the cost of adequate credit monitoring services, would redress Plaintiffs’ injuries. Pls.’ Resp. 12; see also Smith v. Am. Pain & Wellness, PLLC, 747 F. Supp. 3d 989, 1003 (E.D. Tex. 2024) (concluding that plaintiffs’ alleged data breach injuries were redressable with monetary relief). The Court thus holds that Plaintiffs have adequately pled causation and redressability.
IV. THE COURT GRANTS IN PART AND DENIES IN PART THE MOTION TO DISMISS FOR FAILURE TO STATE A CLAIM
Next, Jani-King moves to dismiss Plaintiffs’ remaining claims for failure to state a claim upon which relief can be granted. Def.’s Mot. Br. 12–22. The Court addresses each of these claims in turn.4 A. The Court Denies the Motion as to the Negligence Claim Under Texas law, a negligence claim requires (1) the existence of a duty; (2) a breach of that duty; and (3) damages proximately caused by the breach. W. Invs., Inc. v. Urena, 162 S.W.3d 547, 550 (Tex. 2005). Jani-King asserts that Plaintiffs did not adequately plead the duty or damages elements. Def.’s Br. 12–15. 1. Plaintiffs plausibly allege an existing a duty of care. — Jani-King argues that Plaintiffs do not sufficiently allege that Jani-King owed them a duty to protect their PII from the criminal acts of a third party because the parties lacked a special relationship imposing such a duty. Def.’s Br. 12–13. But, as Plaintiffs argue, Texas law does not require
such a relationship where the duty arises from a defendant’s own conduct and the foreseeability of harm. See e.g., ESO, 2024 WL 4456703, at *10 (“Under Texas common law principles, the Court determines that ESO has a duty to safeguard PII it chooses to retain.”).
4 Because the Court has already concluded that Plaintiffs do not have standing to pursue a claim for declaratory and injunctive relief, the Court dismisses that claim without further analysis. “In determining whether there is a duty, the court considers several factors, including the risk, foreseeability, and the likelihood of injury,” weighed against the social
utility and cost to the defendant. Washington v. U.S. Dep’t of Hous. & Urban Dev., 953 F. Supp. 762, 773 (N.D. Tex. 1996). Here, Plaintiffs adequately allege that Jani-King “knew or should have known” about the risk of a data breach because Jani-King received internal and external warnings of “systemic deficiencies in its IT infrastructure, including outdated or unpatched operating systems, poor logging controls, and failure to patch known vulnerabilities” prior to the breach. Pls.’ Am. Compl. ¶ 32. Under Texas common law
principles, Jani-King has a duty to safeguard PII it chooses to retain. See In re Cap. One Consumer Data Sec. Breach Litig., 488 F. Supp. 3d 374, 397 (E.D. Va. 2020) (analyzing Texas law and determining that where defendants implemented harmful storage of PII “without adequate safeguards to protect against hacking . . . the Texas Supreme Court would recognize a duty separate and apart from the parties’ contractual relationship”).
Thus, Plaintiffs established that Jani-King owed a duty to protect Plaintiffs’ data. 2. Plaintiffs plausibly allege damages, and the economic loss rule does not bar Plaintiffs’ negligence claim. — Jani-King argues that (1) Plaintiffs plead their damages in a vague and conclusory fashion, and (2) the economic loss rule bars Plaintiffs’ negligence claim to the extent that they allege a loss arising from breach of express or implied contract.
Def.’s Br. 16. First, the Court determines that Plaintiffs have sufficiently alleged that they suffered damages. They assert that, as a result of the data breach, their PII has been or will be sold or exposed on the dark web, and they have suffered an increased risk of future harm. Pls.’ Am. Compl. ¶ 11.
Next, the economic loss rule does not bar tort claims “when the duty allegedly breached is independent of the contractual undertaking and the harm suffered is not merely the economic loss of a contractual benefit.” Chapman Custom Homes, Inc. v. Dall. Plumbing Co., 445 S.W.3d 716, 718 (Tex. 2014). When determining whether an action sounds in tort or contract such that the economic loss doctrine may preclude a particular tort claim, Texas courts “look to the source of the duty allegedly violated and the nature of
the claimed loss.” El Paso Mktg., LP v. Wolf Hollow I, L.P., 383 S.W.3d 138, 143 (Tex. 2012). Here, the Court has determined that the duty to safeguard data does not arise solely out of the implied contract, and the claimed loss extends beyond the economic losses of the benefits under the contract. Therefore, the Court holds that the economic loss rule does not bar the negligence claim at this stage.
B. The Court Denies the Motion as to the Breach of Implied Contract Claim Under Texas law, to state a claim for breach of contract, Plaintiffs must allege “(1) the existence of a valid contract; (2) performance or tendered performance by the plaintiff; (3) breach of the contract by the defendant; and (4) damages sustained by the plaintiff as a result of the breach.” Smith Int’l, Inc. v. Egle Grp., LLC, 490 F.3d 380, 387 (5th Cir. 2007)
(quoting Valero Mktg. & Supply Co. v. Kalama Int’l, L.L.C., 51 S.W.3d 345, 351 (Tex. App. — Houston [1st Dist.] 2001, no pet.)). The existence of a valid contract, whether express or implied, requires: “(1) an offer, (2) an acceptance, (3) a meeting of the minds, (4) each party’s consent to the terms, and (5) execution and delivery of the contract with the intent that it be mutual and binding.” DeClaire v. G & B McIntosh Fam. Ltd. P’ship, 260 S.W.3d 34, 44 (Tex. App. — Houston
[1st Dist.] 2008, no pet.); see Univ. Nat’l Bank v. Ernst & Whinney, 773 S.W.2d 707, 710 (Tex. App. — San Antonio 1989, no writ) (“The elements of a contract, express or implied, are identical.”). In an express contract, the parties usually state and agree to specific terms. Haws & Garrett Gen. Contractors, Inc. v. Gorbett Bros. Welding Co., 480 S.W.2d 607, 609 (Tex. 1972). However, an implied contract arises when the parties’ conduct creates an inference of mutual intention to contract. Id.
Plaintiffs argue that they entered into an implied contract with Jani-King and that there was a “mutual understanding that [Jani-King] would preserve the privacy and confidentiality of Plaintiffs’ and Class Members’ personal information.” Pls.’ Am. Compl. ¶ 204. Specifically, Plaintiffs claim that in accepting Plaintiffs’ payment for services and accepting possession of their PII, Jani-King implicitly agreed to protect their PII. Id. ¶
199–200. Plaintiffs plead that the implied promises include: (a) use such PII for business purposes only, (b) take reasonable steps to safeguard that PII, (c) prevent unauthorized disclosures of the PII, (d) provide Plaintiffs and Class Members with prompt and sufficient notice of any and all unauthorized access and/or theft of their PII, (e) reasonably safeguard and protect the PII of Plaintiffs and Class Members from unauthorized disclosure or uses, (f) retain the PII only under conditions that kept such information secure and confidential.
Id. ¶ 202. Jani-King moves to dismiss this claim, arguing Plaintiffs did not establish that the parties had a bargained-for agreement relating to data security. Def.’s Br. 19. Addressing a similar fact pattern, this Court has held that “an implied contract is sufficiently alleged where the plaintiffs plead that an implied contract was created in the implied promise to protect PII when customers are required to provide PII as a condition of receiving defendant’s services.” Hawkins, 2025 WL 2244327, at *7 (collecting cases).
The Court thus holds Plaintiffs’ pleadings are sufficient to allege the existence of an implied contract to safeguard the PII. Therefore, the Court denies Jani-King’s motion to dismiss the claim for breach of implied contract. C. The Court Grants the Motion as to the Unjust Enrichment Plaintiffs do not sufficiently allege a claim for unjust enrichment. Pls.’ Am. Compl. ¶¶ 217–228. The Court agrees with Jani-King that “Plaintiffs provide no allegations that
they specifically paid money to Jani-King for the particular purpose of data security.” Def.’s Br. 21. Plaintiffs allege that Jani-King “funds its data security measures from its general revenue, which includes payments made for the benefit of Plaintiffs and Class Members.” Pls.’ Am. Compl. ¶ 220. However, these pleadings fail to connect how such a purported
benefit was obtained by fraud, duress, or taking of an undue advantage. The pleadings do not support that Plaintiffs paid Jani-King for the specific purpose of data security. Thus, there is no reasonable interpretation of the facts that plausibly supports that Jani-King fraudulently obtained the money as though for data security and then used instead for some advantage to Jani-King. See Cabezas, 2025 WL 2053287, at *12. Therefore, the Court
dismisses this claim. V. THE COURT DEFERS JUDGMENT ON THE NEGLIGENCE PER SE CLAIM Jani-King also seeks dismissal of Plaintiffs’ negligence per se claim. Def.’s Br. 16- 17. Because the law governing negligence per se varies between states, and because a law other than Texas law may apply, the Court defers judgment on this claim until the choice- of-law analysis is completed at the class certification stage. See In re Am. Med. Collection Agency, Inc. Customer Data Sec. Breach Litig., 2021 WL 5937742 at *17 (D.N.J. 2021). CONCLUSION First, the Court determines that Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove have standing to bring all their claims except the claim for declaratory and injunctive relief and thus grants the motion to dismiss as to that claim only. Next, the Court holds that Plaintiffs Ivy, Jacquez, Dalmacio, and Breedlove have alleged sufficient facts to state a claim for their breach of implied contract and negligence claims and denies the motion to dismiss as to those claims. Additionally, the Court decides that Plaintiffs have not alleged facts sufficient to state a claim for unjust enrichment and grants the motion as to that claim. The Court also reserves judgment on the negligence per se claim until the Court rules on class certification. Finally, the Court grants the motion to dismiss for lack of standing as to Cossette and grants leave to amend Cossette’s allegations regarding standing. Plaintiffs have twenty-one (21) days from the date of this Order to file their amended complaint as to Cossette’s standing only.
Signed August 4, 2026. De David C. Godbey Senior United States District Judge
MEMORANDUM OPINION AND ORDER — PAGE 20