John Wagner, Gwenda Coburn-Bowman, James Robertson III, Daniel Saniga, Jr., John W. Miles, and Iris R. Mitchell, individually and on behalf of all others similarly situated v. Andy Frain Services, Inc.

• Court: District Court, N.D. Illinois
• Decided: July 2, 2026
• Docket: 1:25-cv-05252
• Status: Unknown

Opinion

IN THE UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF ILLINOIS EASTERN DIVISION

John Wagner, Gwenda Coburn- ) No. 25 cv 5252 Bowman, James Robertson III, ) No. 25 cv 5274 Daniel Saniga, Jr., John W. ) No. 25 cv 5505 Miles, and Iris R. Mitchell, ) No. 25 cv 5306 individually and on behalf of ) No. 25 cv 5333 all others similarly ) No. 25 cv 5402 situated, ) No. 25 cv 5616 ) No. 25 cv 5649 Plaintiffs, ) No. 25 cv 5706 ) ) v. ) ) ) Andy Frain Services, Inc., ) ) Defendant. )

Memorandum Opinion and Order Plaintiffs in these consolidated cases allege on behalf of themselves and a putative class that when they applied for jobs with the security company Andy Frain Services, Inc., (“Andy Frain” or “the company”), they were required to provide the company with their personal identifying information (“PII”), including their names and social security numbers. Thereafter, on or around October 23, 2024, unauthorized third parties gained access to Andy Frain’s network systems and obtained files containing plaintiffs’ PII. Months after discovering this data breach, Andy Frain notified plaintiffs and the putative class that their PII had fallen into the hands of cybercriminals. Plaintiffs allege that the data breach was the result of the company’s inadequate security measures to secure, protect, and safeguard their PII. They allege further that the company’s delay in notifying them about the data breach “virtually ensured that the unauthorized third parties who exploited those security lapses could monetize, misuse, or disseminate that PII before Plaintiffs and Class members could take affirmative steps to protect their sensitive information.” CC Am. Compl., ECF 32 at ¶ 79. Plaintiffs claim that Andy Frain is liable for negligence and for breach of implied contract. As an alternative to their implied contract theory, they

claim that Andy Frain was unjustly enriched because of its misconduct. Plaintiffs seek injunctive relief as well as damages and/or equitable relief. Andy Frain moves to dismiss the complaint on various grounds: First, that all but one named plaintiff signed a binding arbitration agreement that covers the claims they assert, while the remaining plaintiff signed a different agreement in which he waived his right to a jury trial; second, that plaintiffs lack standing because they suffered no injury-in-fact; and third, that they fail to state an actionable claim. The motion is denied for the following reasons. Standing

Although defendant does not lead with the argument that plaintiffs lack standing, I begin with this issue because if defendant is correct, my analysis ends there. See Mack v. Resurgent Cap. Servs., L.P., 70 F.4th 395, 402 (7th Cir. 2023) (“[i]f the plaintiff lacks Article III standing to sue, the court has no jurisdiction to hear the matter.”) (citing Spokeo, Inc. v. Robins, 578 U.S. 330, 337–38 (2016)). For the reasons explained below, however, I am satisfied that my jurisdiction is secure. Three elements comprise the “irreducible constitutional minimum” of standing. Lujan v. Defenders of Wildlife, 504 U.S. 555, 560 (1992). A “plaintiff must have (1) suffered an injury in fact, (2) that is fairly traceable to the challenged conduct of the defendant, and (3) that is likely to be redressed by a favorable

judicial decision.” Spokeo, Inc. v. Robins, 578 U.S. 330, 338 (2016). Defendant argues that plaintiffs’ allegations do not reasonably suggest the first two elements. Two named plaintiffs—Robertson and Mitchell—allege that shortly after the data breach, they discovered unauthorized activity on their accounts: Robertson’s bank notified him about fraudulent charges on his account, and Mitchell experienced both unauthorized charges and the unauthorized opening of a Verizon account in her name. CC Am. Compl. at ¶¶ 33, 65. After the company notified him of the data breach, Robertson purchased a $70 monthly subscription to Norton LifeLock to protect himself from identity theft. Id. at ¶ 32.

In addition, all named plaintiff allege an “uptick in spam text messages, calls and emails” that they attribute to the breach; that they spent time on “reasonable efforts to mitigate the impact of the Data Breach”; and that they will forever spend valuable time monitoring accounts for actual or attempted fraud and feeling fearful and anxious about the loss of privacy and the risk identity theft and fraud. CC Am. Compl. at ¶¶ 12-13, 22-23, 34-35, 44-45, 54-55, 64-65 (describing uptick in spam and mitigation steps); ¶¶ ¶¶ 13- 14, 23-24, 35-36, 45-46, 55-56, 65-66 (describing opportunity costs and emotional impact). Based on their personal experiences, plaintiffs allege that the putative class members have suffered these types of injuries and damages: (i) a substantially increased and imminent risk of identity theft; (ii) the compromise, publication, and theft of their PII; (iii) out of-pocket expenses associated with the prevention, detection, and recovery from unauthorized use of their PII; (iv) lost opportunity costs associated with efforts attempting to mitigate the actual and future consequences of the Data Breach; (v) the continued risk to their PII which remains in Defendant’s possession; and (vi) future costs in terms of time, effort, and money that will be required to prevent, detect, and repair the impact of the PII compromised as a result of the Data Breach.

CC Am. Compl. at 91.

Andy Frain argues that the injuries plaintiffs allege are both too speculative and too remote from the company’s conduct to satisfy the first and second elements of the standing inquiry: injury-in- fact and fair traceability. But this argument fails to confront the fraudulent activity Robertson and Mitchell already discovered on their accounts as well as the costs Robertson incurred to protect himself from additional fraud. Monetary losses such as Robertson’s are among the “traditional tangible harms” that “readily qualify as concrete injuries under Article III.” TransUnion LLC v. Ramirez, 594 U.S. 413, 425 (2021)). So Robertson obviously has standing to assert claims to recover those costs, and Mitchell—who “spent time and effort resolving” fraudulent charges, even if they “did not result in injury to [her] wallet”—does too. Lewert v. P.F. Chang's China Bistro, Inc., 819 F.3d 963, 967 (7th Cir. 2016). In fact, Lewert and its predecessor, Remijas v. Neiman Marcus Group, LLC, 794 F.3d 688 (7th Cir. 2015), held that even data breach victims who had not suffered fraudulent charges had standing to recover “mitigation expenses” to protect against future injuries.

819 F.3d. at 967. In Remijas, the Seventh Circuit considered the claims of customers whose credit card information was stolen from a department store’s computer systems. The court held that the victims who had already incurred fraudulent charges suffered concrete and particularized harms in the form of “the aggravation and loss of value of the time needed to set things straight,” and that even the victims who had not suffered those harms had standing based on “two imminent injuries: an increased risk of future fraudulent charges and greater susceptibility to identity theft.” Id. at 692. The court reasoned that the latter harms were “certainly impending,” and that “customers should not have to wait until hackers commit identity

theft or credit-card fraud in order to give the class standing[.]” Id. (quoting Clapper v. Amnesty Int’l USA, 568 U.S. 398, 401 (2013)). See also Lewert, 819 F.3d at 966-68 (7th Cir. 2016) (restaurant patrons who spent time and effort to mitigate risks caused by data breach had standing even if no fraudulent charges had been made on their accounts). This sweeps in the remaining named plaintiffs, all of whom allegedly suffered aggravation and the loss of their time to mitigate the risks of fraud and identity theft. Defendants observe correctly that since Remijas and Lewert, the Seventh Circuit has acknowledged “a shift in the Court’s standing jurisprudence.” Dinerstein v. Google, LLC, 73 F.4th 502, 516 (7th Cir. 2023). In TransUnion LLC v. Ramirez, 594 U.S. 413 (2021), the Supreme Court clarified that “a risk of harm qualifies as a concrete

injury only for claims for ‘forward-looking, injunctive relief to prevent the harm from occurring.’” Pierre v. Midland Credit Mgmt., Inc., 29 F.4th 934, 938 (7th Cir. 2022) (quoting TransUnion LLC v. Ramirez, 594 U.S. 413, 435 (2021)). In other words, “[a] plaintiff seeking money damages has standing to sue in federal court only for harms that have in fact materialized.” Id. Where defendant goes wrong is in conflating an intangible harm with a harm that has not “materialized.” TransUnion does not stand for the proposition that only tangible harms are sufficiently concrete to support standing. To the contrary, the TransUnion Court reaffirmed that “[v]arious intangible harms can also be concrete,”

including “disclosure of private information, and intrusion upon seclusion.” 594 U.S. at 425. And, indeed, lower courts have continued, post-TransUnion, to hold that data breach victims who spend time and money on efforts to mitigate the consequences of the breach have standing to assert damages claims. See, e.g., In re Lurie Children's Hosp. Data Sec. Litig., No. 24-CV-05503, 2025 WL 2754760, at *6 (N.D. Ill. Sept. 27, 2025) (Wood, J.) (“[t]here is no reason to think that TransUnion undermines the Seventh Circuit’s recognition in [Lewert and Remijas] that mitigation efforts may constitute concrete injuries in fact.”); Florence v. Ord. Express, Inc., 674 F. Supp. 3d 472, 481 (N.D. Ill. 2023) (“post-TransUnion data-breach decisions in the Seventh Circuit have relied on Remijas and Lewert to find that mitigation costs based on imminent future

harm amount to a concrete injury in fact.”) (citing cases). As all plaintiffs allege, at a minimum, losses arising from the kinds of mitigation efforts that Remijas and Lewert held sufficient for standing, I am satisfied that they assert an injury-in-fact. On the question of fair traceability, defendant suggests that Remijas and Lewert do not apply because plaintiffs do not allege that their phone numbers, email addresses, bank accounts, or credit card numbers were accessed. But the complaint explains how cybercriminals access and collect personal information from different sources to create “Fullz” packages containing a complete set of an individual’s PII. Even if only a portion of that

information was obtained in the data breach here, it included plaintiffs’ social security numbers -- unquestionably an important portion. See In re Equifax Inc. Customer Data Sec. Breach Litig., 999 F.3d 1247, 1274 (11th Cir. 2021) (noting “unique risks associated with stolen Social Security numbers”). See also Bernardino v. HAH Grp. Holding, LLC, No. 1:24-CV-7595, 2026 WL 1398722, at *4 (N.D. Ill. May 19, 2026) (Kendall, CJ.) (“[the defendant] notified [the plaintiff] that the data breach exposed her Social Security number and date of birth....It seems rather clear how a bad faith actor could use this information to access a credit card account. Additionally, the Plaintiffs have alleged that the hackers may have used a ‘fullz package’ to fill in any information gaps.”). I am satisfied that plaintiffs’ allegations plausibly suggest a risk of

imminent harm that is fairly—if not exclusively—traceable to the data breach at issue. The Arbitration Agreement and Jury Trial Waiver Andy Frain’s lead argument for dismissal is based on a document captioned “Dispute Resolution Agreement” (let us call it the “DRA”), copies of which bear the electronic signatures of plaintiffs Wagner, Bowman,1 Robertson, Miles, and Mitchell. The company argues that by signing the DRA, these plaintiffs “agreed to arbitrate all claims arising out of or relating to their employment with Andy Frain.” Mot., ECF 38-1 at 3. Eliminating some of the thornier threshold issues that commonly plague motions to compel arbitration, the

parties appear to agree on a few important points: 1) that an agreement to arbitrate was formed between the company and each named

1 This plaintiff is identified alternatively as Gwenda Coburn-Bowman and Gwenda Bowman. plaintiff who signed the DRA; 2) that these agreements are governed by Federal Arbitration Act, which “requires courts to enforce many private arbitration agreements,” Flowers Foods, Inc. v. Brock, 146 S. Ct. 1358, 1362 (2026); and 3) that the agreements themselves empower me—not an arbitrator—to resolve disputes concerning their “scope or enforceability.” Id. at 3 n.1; Opp., ECF 44, at 3. See also Atkins Decl., Exhs. A-E, ECF 39-1 to 39-5 (DRA). The FAA reflects the fundamental principle that arbitration is a matter of contract.” Rent-A-Ctr., W., Inc. v. Jackson, 561 U.S.

63, 67 (2010). Accordingly, courts must enforce valid arbitration agreements “according to their terms.” Id. By the same token, “a party cannot be required to submit to arbitration any dispute which he has not agreed so to submit.” Howsam v. Dean Witter Reynolds, Inc., 537 U.S. 79, 83 (2002). Plaintiffs do not challenge the enforceability of the DRA, so I assume without deciding that the agreement is enforceable. But I conclude that the claims plaintiffs assert are not within the scope of its terms. The DRA begins with a paragraph setting forth the terms of the signatory’s “employment, position, and compensation at Andy Frain.” In particular, it explains the at-will nature of the signatory’s

employment, and it specifies that no other agreements between the parties exist. It then goes on to provide: I and the Company agree to use binding individual arbitration as the sole and exclusive means to resolve all disputes that may arise out of or be related in any way to my employment. I and the Company each specifically waive and relinquish our respective rights to bring a claim against the other in a court of law and have a trial by jury. Both I and the Company agree that any claim, dispute, and/or controversy that I may have against the Company (or its owners, directors, officers, managers, PEOs, employees, or agents), or the Company may have against me, shall be submitted to and determined exclusively by binding arbitration under the Federal Arbitration Act (“FAA”). ... Included within the scope of this Agreement are all disputes, whether based on tort, contract, statute (including, but not limited to, any claims of discrimination, harassment and/or retaliation, whether they be based on the Title VII of the Civil Rights Act of 1964, as amended, or any other state or federal law or regulation), equitable law, or otherwise. The only exceptions to binding arbitration shall be for claims arising under the National Labor Relations Act which are brought before the National Labor Relations Board, claims for medical and disability benefits under state workers’ compensation laws, claims for unemployment insurance, or other claims that are not subject to arbitration under current law. However, nothing herein shall prevent me from filing and pursuing proceedings before the United States Equal Employment Opportunity Commission or similar state governmental agency that enforces state fair employment laws (although if I choose to pursue a claim following the exhaustion of such administrative remedies, that claim would be subject to the provisions of this Agreement).

ECF 39-1 at 2. The DRA goes on to limit the signatory’s class or collective action rights and to delineate the rules and procedures that govern arbitration under the agreement. It then concludes with a final section captioned “Employee Acknowledgment.” This section, which is set off from the remainder of the text, contains the following statement: MY SIGNATURE ATTESTS TO THE FACT THAT I HAVE READ, UNDERSTAND, AND AGREE TO BE LEGALLY BOUND TO ALL OF THE ABOVE TERMS. I FURTHER UNDERSTAND THAT THIS AGREEMENT REQUIRES ME TO ARBITRATE ANY AND ALL DISPUTES THAT ARISE OUT OF MY EMPLOYMENT. DO NOT SIGN UNTIL YOU HAVE READ THE ABOVE ACKNOWLEDGMENT AND AGREEMENT.

Id. (ALL CAPS in original). The parties’ dispute boils down to whether plaintiffs’ claims arising out of the October 2024 data breach “arise out of” or are “related in any way to” their employment with Andy Frain. I conclude that they are not. It is true, as the company observes, that the Seventh Circuit interprets both of these phrases broadly. See, e.g., Gore v. Alltel Commc’ns, LLC, 666 F.3d 1027, 1033 (7th Cir. 2012); Kiefer Specialty Flooring, Inc. v. Tarkett, Inc., 174 F.3d 907, 909 (7th Cir. 1999); Sweet Dreams Unlimited, Inc. v. Dial–A–Mattress Int’l, Ltd., 1 F.3d 639, 642 (7th Cir. 1993). But their breadth is not boundless. Although the phrases indeed signal “a broad arbitration clause,” meaning one that “does not limit arbitration to the literal interpretation or performance of the contract,” their reach extends only to disputes “having a significant relationship to the contract[.]” Kiefer, 174 F.3d at 910 (internal quotation marks and citation omitted). Nothing in the DRA, which focuses on the terms and conditions of the signatory’s employment, would lead a reasonable person to believe that by signing it, he or she waives the right to bring any action whatsoever against defendant—even one that is entirely unrelated to the parties’ employment relationship—except in arbitration. Indeed, the broadest language of the DRA, such as the mutual waiver of the parties’ rights “to bring a claim against the other in a court of law and to have a trial by jury,” and their agreement to arbitrate “any claim, dispute, and/or controversy that I may have against the Company (or its owners, directors, officers, managers, PEOs, employees, or agents), or the Company may have against me,” is sandwiched between provisions narrowing the scope of the agreement as a whole to the parties’ employment relationship. The paragraph containing the language just quoted opens with the sentence, “I and the Company agree to utilize binding individual arbitration as the sole and exclusive means to resolve all disputes that may arise out

of or be related in any way to my employment.” (Emphasis added) And the “Employee Acknowledgment” confirms that the DRT pertains to “ANY AND ALL DISPUTES THAT ARISE OUT OF MY EMPLOYMENT.” Id. In this context, the only reasonable interpretation of the arbitration agreement is that it applies only to claims arising out of or relating to plaintiffs’ employment. Plaintiffs’ negligence claims, at a minimum, are not of that sort. On this score, I agree with the court in Davis v. ISCO Indus., Inc., 864 S.E.2d 391, 397 (S.C. Ct. App. 2021), that “even though [the defendant] had [the plaintiff’s] personal identifying information only due to his previous employment with it,” the

plaintiff’s negligence action for disclosure of his personal information “d[id] not truly relate to his employment.” In fact, that conclusion is all the more sensible here, where two of the named plaintiffs—as well as an unknown number of absent class members—were merely “prospective employee[s],” who were never employed by defendant at all. See CC Am. Comp. at ¶¶ 8, 18.2 Defendant’s argument that plaintiff Saniga waived his right to a jury trial is a variation on the preceding argument but is even less compelling. The agreement to which defendant claims Saniga is bound explicitly covers “workplace disputes.” ECF 39-8 at 2 (“Both Member and Client Company agree to try, in good faith, to resolve any covered workplace issues or disputes through the PRP before resorting to litigation in the court system. If a lawsuit is filed,

the parties agree to WAIVE THE RIGHT TO A JURY TRIAL.”) (original emphasis); id. at 4 (“Except as prohibited by law, the Member, Client Company and PEOPLE® agree to WAIVE THE RIGHT TO A JURY TRIAL in any action or proceeding related to, or arising out of, Member’s employment which is covered by the PRP that they may have now or in the future while the PRP is in effect including, but not limited to, any claim relating to discrimination, harassment and/or any terms and conditions of Member’s employment (including, but not limited to, hiring, promotion, pay and termination decisions).” Because the

2 Defendant tries to blunt the persuasive force of Davis by observing that state courts are not bound by the FAA. See Reply ECF 45 at 2. That may be so, but after observing that South Carolina precedent requires state courts to “address questions of arbitrability with a healthy regard for the federal policy favoring arbitration,” the Davis court went on to apply the same standards that apply under the FAA requires. Davis. 864 S.E.2d at 394-95. Defendant also points to minor factual differences between that case and this, but it does not explain—nor can I discern—any way in which those differences are material to the analysis. right to a jury trial is a constitutional guarantee, courts are generally reluctant to enforce jury trial waivers in form contracts absent evidence that the waiver was knowing and voluntary. See, e.g., Heller Financial, Inc. v. Finch-Bayless Equipment Co., No. 90 C 1672, 1990 WL 77500, at *2 (N.D. Ill. May 31, 1990). For this reason alone, I decline to strike Saniga’s demand for a jury trial at this juncture on the basis of the form to which defendant points. Failure to State a Claim The final section of defendant’s memorandum in support of its

motion to compel arbitration and dismiss the case argues that none of plaintiffs’ claims for negligence, breach of implied contract, or unjust enrichment is adequately pled. I need not decide at this juncture, however, whether plaintiffs can prevail on each of these theories if the evidence they uncover supports their allegations. “A complaint that invokes a recognized legal theory (as this one does) and contains plausible allegations on the material issues (as this one does) cannot be dismissed under Rule 12.” Richards v. Mitcheff, 696 F.3d 635, 638 (7th Cir. 2012). As another court in this district has explained, while plaintiffs may organize their complaints into various “counts” to reflect different legal theories on which they

hope to prevail, they do not necessarily represent separate “claims.” Zurbriggen v. Twin Hill Acquisition Co., Inc., 455 F. Supp. 3d 702, 719 (N.D. Ill. 2020). “No matter how many counts a plaintiff may plead, they constitute a single claim to the extent that they are premised on the same facts,” and Rule 12(b) (6) does not allow for ‘piecemeal dismissals of parts of claims.’” Id. (quoting BBL, Inc. v. City of Angola, 809 F.3d 317, 325 (7th Cir. 2015)) (emphasis in original). Because I am satisfied that the complaint articulates plausible allegations to support claims under recognized legal theories, dismissal under Rule 12(b) (6) is inappropriate. For the foregoing reasons, Andy Frain’s motion to dismiss the action is denied.

ENTER ORDER:

Elaine E. Bucklo United States District Judge Dated: July 2, 2026